diff --git a/.gitea/workflows/build-prod.yaml b/.gitea/workflows/build-prod.yaml deleted file mode 100644 index 5762279..0000000 --- a/.gitea/workflows/build-prod.yaml +++ /dev/null @@ -1,58 +0,0 @@ -# Build and push on main branch — triggered automatically when commits land on main. -# Tag is commit short SHA: unique, immutable, maps to exactly one commit. -# Image: forgejo.riotpiao.com/rock/api-gateway: -# -# ArgoCD auto-deploys to api namespace as revisions roll in. -name: Build and push - -on: - push: - branches: [main] - -env: - REGISTRY: forgejo.riotpiao.com - IMAGE: forgejo.riotpiao.com/rock/api-gateway - -jobs: - build: - name: Build and push image - runs-on: golang - container: - image: docker:27-cli - volumes: - - /docker-certs/client:/docker-certs/client:ro - env: - DOCKER_HOST: tcp://localhost:2376 - DOCKER_TLS_VERIFY: "1" - DOCKER_CERT_PATH: /docker-certs/client - steps: - - name: install node (required by JS-based actions) - run: apk add --no-cache nodejs git - - - uses: actions/checkout@v4 - - - name: Get short SHA - id: sha - run: | - SHORT_SHA=$(git rev-parse --short HEAD) - echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT - - - name: Registry login - run: | - echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \ - --username rock --password-stdin - env: - REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} - - - name: Build - run: | - docker build \ - --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \ - -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \ - -t "${IMAGE}:latest" \ - . - - - name: Push - run: | - docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}" - docker push "${IMAGE}:latest" diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml deleted file mode 100644 index 030a514..0000000 --- a/.gitea/workflows/build.yaml +++ /dev/null @@ -1,87 +0,0 @@ -# Forgejo Actions build — push image on main only. -# Tag is commit short SHA: unique, immutable, maps to exactly one commit. -# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously. -# Enabled by Stage 1 (B, C1). -name: Build - -on: - push: - branches: [main] - -env: - REGISTRY: forgejo.riotpiao.com - IMAGE: forgejo.riotpiao.com/rock/api-gateway - -jobs: - build: - name: Build and push image - # golang, not a retired generic "docker" runner -- this repo is Go, and - # every runner now carries its own dind sidecar to build/push that - # repo's images. `container.image` below overrides the runner's own - # default (golang:1.26-bookworm) with docker:27-cli for this job only. - runs-on: golang - container: - image: docker:27-cli - # No `options: --network host` here -- act_runner ignores that per-job - # override and always decides the job container's network from its own - # config.yaml (container.network), which defaults to an isolated - # per-job bridge. Confirmed live: with that default, DOCKER_HOST= - # tcp://localhost:2376 resolved to the job container itself, not dind, - # so every command past `docker login` (which never touches DOCKER_HOST - # -- it only talks to the registry) failed with "Cannot connect to the - # Docker daemon". host networking is set once, for every job, in the - # runner's own Helm chart. - # - # The mTLS certs dind generates at startup are a separate gap: they - # live in an emptyDir mounted into the runner/dind containers, not into - # containers a workflow spins up. Job containers get no bind mounts at - # all unless the path is in the runner's container.valid_volumes - # allowlist (empty by default -- this exact mount was rejected until - # the runner's Helm chart added a config.yaml scoping valid_volumes to - # exactly this path). - volumes: - - /docker-certs/client:/docker-certs/client:ro - env: - DOCKER_HOST: tcp://localhost:2376 - DOCKER_TLS_VERIFY: "1" - DOCKER_CERT_PATH: /docker-certs/client - steps: - # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with - # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the - # checkout step fails with "exec: node: executable file not found in - # $PATH" before any of the job's own steps run. Verified locally: - # `apk add --no-cache nodejs git` in this exact image gets node v22 + - # git 2.47, and the checkout action's dist/index.js then actually - # executes (confirmed by running it directly) instead of failing on a - # missing binary. - - name: install node (required by JS-based actions) - run: apk add --no-cache nodejs git - - - uses: actions/checkout@v4 - - - name: Get short SHA - id: sha - run: | - SHORT_SHA=$(git rev-parse --short HEAD) - echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT - - - name: Registry login - run: | - echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \ - --username rock --password-stdin - env: - REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} - - - name: Build - run: | - docker build \ - --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \ - -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \ - . - - - name: Push - run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}" - - - name: Report digest - run: | - docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}" diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index d2e46ec..0a4f050 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -1,19 +1,5 @@ -# Forgejo Actions CI — verification only (vet, test, build). -# Build and push happens in build.yaml on main push. -# -# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/. -# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com) -# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run -# row on push, not once, for any repo -- confirmed both from application logs -# (silent, no error) and directly in the action_run table. A .gitea/workflows -# file with an identical job spec fires immediately. .github/workflows also -# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on -# kmsvc-manage both got action_run rows despite matching no runner) -- so -# .forgejo/workflows/ specifically appears unsupported on this instance/version, -# not workflow detection being off in general. -# -# runs-on: golang -- the generic "docker" runner was retired in favor of -# per-language runners (golang/node/rust), each with its own dind sidecar. +# Single pipeline: verify → build → push. +# One workflow per push, one concurrency group per branch. name: CI on: @@ -22,18 +8,21 @@ on: pull_request: branches: [main] +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +env: + REGISTRY: forgejo.riotpiao.com + IMAGE: forgejo.riotpiao.com/rock/api-gateway + jobs: verify: - name: Test, vet, build + name: Vet, test, build runs-on: golang container: image: golang:1.26-bookworm steps: - # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with - # `node`, which golang:1.26-bookworm doesn't ship. Without this the - # checkout step fails with "exec: node: executable file not found in - # $PATH" before any of the job's own steps run. Same fix already in use - # in kmsvc-manage's ci.yaml; carried over here. - name: install node (required by JS-based actions) run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git @@ -42,15 +31,53 @@ jobs: - name: go vet run: go vet ./... - # The race detector needs cgo, so this cannot run with CGO_ENABLED=0. - name: go test -race run: go test ./... -race - - name: Static build + - name: Static build (smoke) run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway - - name: govulncheck + push: + name: Build and push image + needs: verify + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + runs-on: golang + container: + image: docker:27-cli + volumes: + - /docker-certs/client:/docker-certs/client:ro + env: + DOCKER_HOST: tcp://localhost:2376 + DOCKER_TLS_VERIFY: "1" + DOCKER_CERT_PATH: /docker-certs/client + steps: + - name: install node (required by JS-based actions) + run: apk add --no-cache nodejs git + + - uses: actions/checkout@v4 + + - name: Get short SHA + id: sha run: | - go install golang.org/x/vuln/cmd/govulncheck@latest - govulncheck ./... - continue-on-error: true + SHORT_SHA=$(git rev-parse --short HEAD) + echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT + + - name: Registry login + run: | + echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \ + --username rock --password-stdin + env: + REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} + + - name: Build image + run: | + docker build \ + --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \ + -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \ + -t "${IMAGE}:latest" \ + . + + - name: Push image + run: | + docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}" + docker push "${IMAGE}:latest"