157 lines
3.7 KiB
Markdown
157 lines
3.7 KiB
Markdown
# CI/CD Workflow Template for Poimen Repos
|
|
|
|
## Pattern Used by Homelab-Frontend
|
|
|
|
**File**: `.gitea/workflows/build-prod.yaml` (equivalent: `.forgejo/workflows/build.yaml`)
|
|
|
|
### Key Components
|
|
|
|
```yaml
|
|
jobs:
|
|
build:
|
|
runs-on: golang # or rust, or docker
|
|
container:
|
|
image: docker:27-cli
|
|
volumes:
|
|
- /docker-certs/client:/docker-certs/client:ro
|
|
env:
|
|
DOCKER_HOST: tcp://localhost:2376
|
|
DOCKER_TLS_VERIFY: "1"
|
|
DOCKER_CERT_PATH: /docker-certs/client
|
|
steps:
|
|
- name: Registry login
|
|
run: |
|
|
echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
|
|
--username rock --password-stdin
|
|
env:
|
|
REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
|
|
|
|
- name: Build
|
|
run: docker build -t "${IMAGE}:latest" .
|
|
|
|
- name: Push
|
|
run: docker push "${IMAGE}:latest"
|
|
```
|
|
|
|
---
|
|
|
|
## How to Apply to Any Poimen Repo
|
|
|
|
### Step 1: Create Personal Access Token
|
|
|
|
```bash
|
|
# In browser: https://git.riotpiao.com/user/settings/tokens
|
|
# Or use the existing 'rock' PAT for the organization
|
|
```
|
|
|
|
### Step 2: Set Repository Secret
|
|
|
|
Go to **`https://git.riotpiao.com/rock/<repo>/settings/secrets`**
|
|
|
|
Add secret:
|
|
- **Name**: `REGISTRY_PAT`
|
|
- **Value**: `<token-from-step-1>`
|
|
|
|
### Step 3: Create Workflow File
|
|
|
|
Copy this to `.forgejo/workflows/build.yaml`:
|
|
|
|
```yaml
|
|
name: Build and Push
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: forgejo.riotpiao.com
|
|
IMAGE_NAME: rock/<your-repo-name>
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: rust # or golang, or docker
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Run tests
|
|
run: cargo test --all # adjust for your language
|
|
|
|
build:
|
|
runs-on: golang
|
|
needs: test
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
container:
|
|
image: docker:27-cli
|
|
volumes:
|
|
- /docker-certs/client:/docker-certs/client:ro
|
|
env:
|
|
DOCKER_HOST: tcp://localhost:2376
|
|
DOCKER_TLS_VERIFY: "1"
|
|
DOCKER_CERT_PATH: /docker-certs/client
|
|
steps:
|
|
- name: install node (required by JS-based actions)
|
|
run: apk add --no-cache nodejs git
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Registry login
|
|
run: |
|
|
echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
|
|
--username rock --password-stdin
|
|
env:
|
|
REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
|
|
|
|
- name: Build
|
|
run: |
|
|
docker build \
|
|
-t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" \
|
|
-t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" \
|
|
.
|
|
|
|
- name: Push
|
|
run: |
|
|
docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
|
|
docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
|
|
```
|
|
|
|
---
|
|
|
|
## Apply to Poimen Repos
|
|
|
|
### poimen-memory ✅ (current)
|
|
- Status: Uses `FORGEJO_TOKEN` (built-in)
|
|
- Can upgrade to `REGISTRY_PAT` pattern
|
|
|
|
### poimen (orchestrator)
|
|
- If has Dockerfile: add workflow
|
|
- If K8s-only: validate with `yamllint` + `kustomize`
|
|
|
|
### poimen-workflows
|
|
- If has Docker: add workflow
|
|
- Otherwise: validate YAML only
|
|
|
|
### Pattern for All Repos
|
|
|
|
```
|
|
.forgejo/workflows/
|
|
├── build.yaml # For repos with Dockerfile
|
|
├── validate.yaml # For K8s-only repos (like homelab)
|
|
```
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
**Established Pattern**:
|
|
1. `REGISTRY_PAT` secret in repo
|
|
2. `docker login` → `docker build` → `docker push`
|
|
3. Image tagged: `latest` + commit SHA
|
|
4. ArgoCD watches and auto-deploys
|
|
|
|
**Once set up once**:
|
|
- Every push triggers build
|
|
- Image auto-pushes to registry
|
|
- ArgoCD syncs automatically
|
|
- Zero manual intervention
|
|
|
|
**Effort**: ~5 minutes per repo (token + secret + workflow file)
|