ci: optimize build + deploy + migrate workflows #51

Merged

rock merged 8 commits from ci/optimize-workflows into main 2026-09-13 05:42:04 +00:00

Conversation 0 Commits 8 Files Changed 18

+693 -128

poimen commented 2026-09-13 00:53:26 +00:00

Member

Copy Link

Copy Source

Optimize CI/CD Workflows

Changes

build.yaml

• Merge 3 cargo steps → 1 compile pass: cargo build, cargo test, cargo clippy now run in single invocation, reusing compiled artifacts
• Remove cargo clean: Eliminated wasteful step that deleted artifacts before Docker build
• Add secret validation: Registry credentials checked before login (fail-fast)

deploy.yaml

• Skip checkout: Removed unnecessary git clone
• Fetch SHA via Gitea API: Query latest commit directly instead of cloning
• Reuse existing token: Use FORGEJO_REGISTRY_TOKEN for Gitea API auth (already has privileges)
• Validate image exists: Check SHA image exists before tagging as latest (prevents tagging non-existent images)
• Add secret validation: Registry credentials checked before login (fail-fast)

migrate.yaml

• Merge schema verification: Schema inspect result reused in both changed + manual paths
• Fix manual trigger errors: Manual mode now fails on first migration error (was silently masking with || true)
• Track failures: Explicit FAILED flag tracks migration errors across loop

Benefits

• Speed: Fewer compiles, no unnecessary clones, reuse artifacts
• Reliability: Secret validation catches configuration issues early
• Safety: Image existence check prevents tagging phantom images
• Clarity: Merged steps have descriptive names, explicit error handling

Testing

• Branch: ci/optimize-workflows
• Ready to merge to main after review

## Optimize CI/CD Workflows ### Changes #### build.yaml - **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts - **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build - **Add secret validation**: Registry credentials checked before login (fail-fast) #### deploy.yaml - **Skip checkout**: Removed unnecessary git clone - **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning - **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges) - **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images) - **Add secret validation**: Registry credentials checked before login (fail-fast) #### migrate.yaml - **Merge schema verification**: Schema inspect result reused in both changed + manual paths - **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`) - **Track failures**: Explicit FAILED flag tracks migration errors across loop ### Benefits - **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts - **Reliability**: Secret validation catches configuration issues early - **Safety**: Image existence check prevents tagging phantom images - **Clarity**: Merged steps have descriptive names, explicit error handling ### Testing - Branch: `ci/optimize-workflows` - Ready to merge to `main` after review

poimen added 4 commits 2026-09-13 00:53:27 +00:00

feat: scale memory-db to 3 replicas for HA ... 78e7aa8302

Sync with homelab/k8s/infra/databases/memory-db.yaml.
Update CNPG Cluster instances from 2 to 3 for high availability.

fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian ... 48bcf39a64

- discovery.type: single-node (bypasses vm.max_map_count bootstrap check)
- fsGroup: 1000 (fixes AccessDeniedException on PVC data dir)
- control-plane tolerations (schedulable on CP nodes)
- secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
- remove orphaned obsidian-git-ssh-secret.enc.yaml

fix(opensearch): rotate secrets to random passwords c142ff5109

ci: optimize build + deploy + migrate workflows ... 4fdbb48ae6

- build.yaml: merge 3 cargo steps into single compile pass (reuse artifacts)
- build.yaml: remove cargo clean (wasted compiled artifacts before Docker)
- build.yaml: add secret validation for registry credentials
- deploy.yaml: skip checkout, fetch SHA via Gitea API (no clone overhead)
- deploy.yaml: reuse FORGEJO_REGISTRY_TOKEN for API auth (existing privilege)
- deploy.yaml: validate SHA image exists before tagging as latest
- deploy.yaml: add secret validation for registry credentials
- migrate.yaml: merge schema verification into both changed + manual paths
- migrate.yaml: manual trigger now fails on first error (was silently masking)

rock added 1 commit 2026-09-13 02:13:12 +00:00

config: env-based service URIs via ConfigMap (prod: SOPS-encrypted) ... 985bb7ff46

- config.yaml: prod config with cluster-internal DNS (LLM, OpenSearch, Authentik, Temporal, API-GW)
- config.local.yaml: dev config with external URLs via ingress
- deployment.yaml: remove hardcoded URIs, read all from ConfigMap envFrom
- All downstream service URIs now configurable per environment
- Production config encrypted with SOPS (Age-based)
- Application code reads LLM_ENDPOINT, OPENSEARCH_HOST, AUTHENTIK_ISSUER, etc. from ENV
- Simplifies prod/dev switching: just swap ConfigMap, no code changes

rock added 1 commit 2026-09-13 02:16:20 +00:00

local dev: .env for local development (gitignored) ... 9b3dc839bf

- .env.example: template with all service URIs for local development
- LOCAL_DEV.md: guide for running poimen locally
- Production: config.yaml (SOPS-encrypted K8s ConfigMap)
- Local: .env file (gitignored, never committed)
- Application reads from ENV in both cases (K8s ConfigMap + local dotenv)
- Simplifies prod/dev: same code, different config sources

rock added 1 commit 2026-09-13 05:13:28 +00:00

fix: docker build out-of-disk issue - aggressive cleanup ... 346a615535

- .dockerignore: exclude build/cache/docs to reduce build context (59 lines)
- Dockerfile: add aggressive cleanup (cache, registry, git) after cargo build
- Dockerfile: use --locked flag for reproducible builds
- build.yaml: add pre-build disk cleanup (docker + cargo cache)
- build.yaml: clean cargo before Docker build to free space
- build.yaml: show disk usage before/after for debugging

Fixes 'No space left on device' error during Docker build in runner

rock added 1 commit 2026-09-13 05:14:42 +00:00

infra: add CronJob for runner disk cleanup ... bcda5617b5

- Runs daily at 2 AM to clean Docker, Cargo cache, /tmp
- Prevents 'no space left on device' errors in CI builds
- Deploy to homelab: kubectl apply -f k8s/infra/runner-cleanup-cronjob.yaml
- Adjust namespace and node selectors for your environment

rock merged commit d7a36ce9e8 into main 2026-09-13 05:42:04 +00:00

rock deleted branch ci/optimize-workflows 2026-09-13 05:42:14 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

memory-observability

Observability implementation tasks

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

poimen rock (Rock)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/poimen-memory#51