ci: optimize build + deploy + migrate workflows (#51)

## Optimize CI/CD Workflows ### Changes #### build.yaml - **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts - **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build - **Add secret validation**: Registry credentials checked before login (fail-fast) #### deploy.yaml - **Skip checkout**: Removed unnecessary git clone - **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning - **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges) - **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images) - **Add secret validation**: Registry credentials checked before login (fail-fast) #### migrate.yaml - **Merge schema verification**: Schema inspect result reused in both changed + manual paths - **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`) - **Track failures**: Explicit FAILED flag tracks migration errors across loop ### Benefits - **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts - **Reliability**: Secret validation catches configuration issues early - **Safety**: Image existence check prevents tagging phantom images - **Clarity**: Merged steps have descriptive names, explicit error handling ### Testing - Branch: `ci/optimize-workflows` - Ready to merge to `main` after review --------- Co-authored-by: rock <[email protected]> Reviewed-on: #51 Co-authored-by: poimen <[email protected]>
2026-09-13 05:42:01 +00:00
parent 9f70109c1d
commit d7a36ce9e8
13 changed files with 636 additions and 68 deletions
@@ -0,0 +1,121 @@
+# CronJob to periodically clean Gitea Actions runner disk space
+# Prevents "no space left on device" errors during Docker builds
+# Deploy to: kubectl apply -f k8s/infra/runner-cleanup-cronjob.yaml
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: runner-disk-cleanup
+  namespace: ci  # Adjust to your runner namespace
+  labels:
+    app: runner-cleanup
+spec:
+  # Run daily at 2 AM
+  schedule: "0 2 * * *"
+  
+  # Keep last 3 successful jobs
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: runner-cleanup
+        spec:
+          serviceAccountName: runner-cleanup
+          
+          # Run on node with Gitea Actions runner
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/hostname
+                        operator: In
+                        values:
+                          - runner-node  # Adjust to your runner node name
+          
+          containers:
+            - name: cleanup
+              image: docker:24
+              securityContext:
+                privileged: true  # Needed to access Docker daemon
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  echo "=== Runner disk cleanup at $(date) ==="
+                  
+                  df -h /
+                  echo ""
+                  
+                  echo "Cleaning Docker..."
+                  docker system prune -af --volumes 2>&1 | tail -5
+                  
+                  echo ""
+                  echo "Cleaning Cargo cache..."
+                  rm -rf /root/.cargo/registry/cache 2>/dev/null
+                  rm -rf /root/.cargo/registry/index 2>/dev/null
+                  rm -rf /root/.cargo/git 2>/dev/null
+                  
+                  echo ""
+                  echo "Cleaning /tmp..."
+                  rm -rf /tmp/* 2>/dev/null
+                  
+                  echo ""
+                  echo "Disk after cleanup:"
+                  df -h /
+              
+              volumeMounts:
+                - name: docker-sock
+                  mountPath: /var/run/docker.sock
+                - name: runner-home
+                  mountPath: /root
+          
+          volumes:
+            # Access Docker daemon on host
+            - name: docker-sock
+              hostPath:
+                path: /var/run/docker.sock
+            # Access runner home directory
+            - name: runner-home
+              hostPath:
+                path: /home/runner  # Adjust to your runner home path
+          
+          restartPolicy: OnFailure
+
+---
+# ServiceAccount for cleanup job
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: runner-cleanup
+  namespace: ci
+
+---
+# Role for cleanup job
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: runner-cleanup
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+
+---
+# RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: runner-cleanup
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: runner-cleanup
+subjects:
+  - kind: ServiceAccount
+    name: runner-cleanup
+    namespace: ci