devteam/sharenet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

More CI workflow fixes #3
Some checks failed
CI/CD Pipeline with Secure Ephemeral PiP / test-backend (push) Failing after 0s
Details
CI/CD Pipeline with Secure Ephemeral PiP / test-frontend (push) Has been skipped
Details
CI/CD Pipeline with Secure Ephemeral PiP / build-backend (push) Has been skipped
Details
CI/CD Pipeline with Secure Ephemeral PiP / build-frontend (push) Has been skipped
Details
CI/CD Pipeline with Secure Ephemeral PiP / deploy-prod (push) Failing after 0s
Details

Browse source
This commit is contained in:
continuist 2025-09-10 00:34:19 -04:00
parent 60668d4b38
commit 64524010a0
1 changed files with 30 additions and 77 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

107
.forgejo/workflows/ci.yml
View file

@ -24,16 +24,13 @@ env:
NODE_IMG_DIGEST: ${{ secrets.NODE_IMG_DIGEST }} # e.g., docker.io/library/node@sha256:...
POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }} # e.g., docker.io/library/postgres@sha256:...
PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} # e.g., quay.io/podman/stable@sha256:...
PODMAN_SOCK: /run/user/999/podman/podman.sock
jobs:
test-backend:
runs-on: [ci]
container:
image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
env:
PODMAN_SOCK: /run/user/999/podman/podman.sock
container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
steps:
- uses: actions/checkout@v4
@ -58,7 +55,7 @@ jobs:
- name: Setup ephemeral PiP container
env:
PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
SOCKET_PATH: ${{ env.PODMAN_SOCK }}
run: |
chmod +x ./secure_pip_setup.sh
@ -139,11 +136,7 @@ jobs:
runs-on: [ci]
needs: test-backend
container:
image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
env:
PODMAN_SOCK: /run/user/999/podman/podman.sock
container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
steps:
- uses: actions/checkout@v4
@ -163,7 +156,7 @@ jobs:
- name: Setup ephemeral PiP container
env:
PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
SOCKET_PATH: ${{ env.PODMAN_SOCK }}
run: |
chmod +x ./secure_pip_setup.sh
@ -201,11 +194,7 @@ jobs:
runs-on: [ci]
needs: test-frontend
container:
image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
env:
PODMAN_SOCK: /run/user/999/podman/podman.sock
container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
steps:
- uses: actions/checkout@v4
@ -218,7 +207,7 @@ jobs:
- name: Setup ephemeral PiP container
env:
PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
SOCKET_PATH: ${{ env.PODMAN_SOCK }}
run: |
chmod +x ./secure_pip_setup.sh
@ -272,11 +261,7 @@ jobs:
runs-on: [ci]
needs: test-frontend
container:
image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
env:
PODMAN_SOCK: /run/user/999/podman/podman.sock
container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
steps:
- uses: actions/checkout@v4
@ -289,7 +274,7 @@ jobs:
- name: Setup ephemeral PiP container
env:
PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
SOCKET_PATH: ${{ env.PODMAN_SOCK }}
run: |
chmod +x ./secure_pip_setup.sh
@ -343,66 +328,34 @@ jobs:
runs-on: [prod]
needs: [build-backend, build-frontend]
if: success()
container:
image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
env:
PODMAN_SOCK: /run/user/999/podman/podman.sock
container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
steps:
- uses: actions/checkout@v4
- name: Deploy to production
env:
REGISTRY_HOST: ${{ env.REGISTRY }}
APP_NAME: ${{ env.APP_NAME }}
IMAGE_TAG: ${{ env.IMAGE_TAG }}
POSTGRES_USERNAME: ${{ env.POSTGRES_USERNAME }}
POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
POSTGRES_HOST: ${{ env.POSTGRES_HOST }}
POSTGRES_PORT: ${{ env.POSTGRES_PORT }}
POSTGRES_DATABASE_NAME: ${{ env.POSTGRES_DATABASE_NAME }}
PROD_BACKEND_HOST: ${{ env.PROD_BACKEND_HOST }}
PROD_BACKEND_PORT: ${{ env.PROD_BACKEND_PORT }}
PROD_FRONTEND_PORT: ${{ env.PROD_FRONTEND_PORT }}
run: |
# Install envsubst if not available (gettext package)
command -v envsubst >/dev/null 2>&1 || {
if command -v apt-get >/dev/null 2>&1; then
sudo apt-get update && sudo apt-get install -y gettext-base
elif command -v yum >/dev/null 2>&1; then
sudo yum install -y gettext
elif command -v apk >/dev/null 2>&1; then
sudo apk add gettext
fi
}
- name: Resolve Podman user socket (prod)
run: |
SVC_USER="prod-service"
uid=$(id -u "$SVC_USER")
echo "PODMAN_SOCK=/run/user/${uid}/podman/podman.sock" >> "$GITHUB_ENV"
- name: Verify runner wiring to Podman
- name: Verify Podman in job container
run: |
podman --version
test -S "${PODMAN_SOCK}" || { echo "Missing socket ${PODMAN_SOCK}"; exit 1; }
# Optional: sanity poke of the service via PiP later
podman info --log-level=error >/dev/null
- name: Render prod spec
run: envsubst < deploy/prod-pod.yml > prod-pod-deploy.yml
- name: Apply with Podman (no registry login needed)
# Your prod-pod.yml uses ${REGISTRY_HOST}, but the workflow defines REGISTRY.
# Export a one-off alias so templating resolves.
- name: Render prod spec (no envsubst)
env:
PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
REGISTRY_HOST: ${{ env.REGISTRY }}
run: |
cat prod-pod-deploy.yml | \
podman run --rm -i \
-v "${PODMAN_SOCK}:${PODMAN_SOCK}" \
-e "CONTAINER_HOST=unix://${PODMAN_SOCK}" \
"${PODMAN_CLIENT_IMG_DIGEST}" \
sh -lc 'cat >/tmp/spec.yml; podman play kube --replace /tmp/spec.yml'
awk '{
while (match($0, /\$\{[A-Za-z_][A-Za-z0-9_]*\}/)) {
k = substr($0, RSTART+2, RLENGTH-3);
v = ENVIRON[k];
gsub("\\$\\{" k "\\}", v);
}
print
}' deploy/prod-pod.yml > prod-pod-deploy.yml
- name: Apply with Podman
run: podman play kube --replace prod-pod-deploy.yml
- name: Clean up generated file
run: rm -f prod-pod-deploy.yml
if: always()
run: rm -f prod-pod-deploy.yml