Story Crater Bot
b0ce2fb67c
- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit SHA stamped via VERSION build arg. - .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the runner declares only the "docker" label. Verify job on every push; image build and push gated to main. - Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran. - deployment.yaml: image from the Forgejo registry, forgejo-registry pull secret, runAsUser 65532 to match distroless nonroot. - kustomization.yaml: pin the tag in one place. Promoting a build is a one-line newTag bump, never :latest.
86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
# Forgejo Actions CI. Note the path: Forgejo reads .forgejo/workflows/, not
|
|
# .github/workflows/. The remote for this repo is git.riotpiao.com, so a GitHub
|
|
# workflow here would never run.
|
|
#
|
|
# runs-on: docker matches the only label the cluster runner declares
|
|
# (talos-runner, labels: [docker]).
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: forgejo.riotpiao.com
|
|
IMAGE: forgejo.riotpiao.com/rock/api-gateway
|
|
|
|
jobs:
|
|
verify:
|
|
name: Test, vet, build
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-bookworm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: go vet
|
|
run: go vet ./...
|
|
|
|
# The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
|
|
- name: go test -race
|
|
run: go test ./... -race
|
|
|
|
- name: Static build
|
|
run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
|
|
|
|
- name: govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|
|
continue-on-error: true
|
|
|
|
image:
|
|
name: Build and push image
|
|
runs-on: docker
|
|
needs: verify
|
|
# Only publish from main. PRs get the verify job and nothing else, so an
|
|
# untrusted branch can never push a tag the cluster might pull.
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
container:
|
|
image: docker:27-cli
|
|
# The runner's dind sidecar shares the pod network and the mTLS cert
|
|
# emptyDir, so the daemon is reachable on localhost with the client certs
|
|
# dind generated at startup.
|
|
options: --network host
|
|
env:
|
|
DOCKER_HOST: tcp://localhost:2376
|
|
DOCKER_TLS_VERIFY: "1"
|
|
DOCKER_CERT_PATH: /docker-certs/client
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Registry login
|
|
run: |
|
|
echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
|
|
--username rock --password-stdin
|
|
env:
|
|
FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
|
|
|
|
# SHA tags only. 6.1 requires them, and :latest makes an Argo rollout
|
|
# non-deterministic — the same tag can resolve to different bits.
|
|
- name: Build
|
|
run: |
|
|
docker build \
|
|
--build-arg "VERSION=${GITHUB_SHA}" \
|
|
-t "${IMAGE}:${GITHUB_SHA}" \
|
|
.
|
|
|
|
- name: Push
|
|
run: docker push "${IMAGE}:${GITHUB_SHA}"
|
|
|
|
- name: Report digest
|
|
run: |
|
|
docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${GITHUB_SHA}"
|