ci: migrate workflows and dependencies to Gitea
This commit is contained in:
Codex committed
1 parent
c9e26c5600
commit
7cae60bbe6
60 files changed
+19962
-3721
No files matched your search
@@ -0,0 +1,224 @@
|
||||
name: services/docs - next/required
|
||||
'on':
|
||||
push:
|
||||
branches:
|
||||
- next
|
||||
paths:
|
||||
- services/docs/**
|
||||
- .gitea/workflows/services-docs-next-required.yml
|
||||
- ci/docker/docs/**
|
||||
- ci/config/nginx/**
|
||||
- ci/scripts/**
|
||||
- .gitea/scripts/**
|
||||
- .gitea/actions/**
|
||||
concurrency:
|
||||
group: ci-docs-${{ github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
permissions:
|
||||
contents: read
|
||||
actions: read
|
||||
jobs:
|
||||
setup-hugo:
|
||||
name: Setup - Hugo
|
||||
runs-on: apex-debian13
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
|
||||
case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
|
||||
AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
|
||||
\ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
|
||||
git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
|
||||
\ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
|
||||
git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
|
||||
test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
|
||||
\ = recursive ]; then\n key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
|
||||
)\n trap 'rm -f \"$key_file\"' EXIT\n umask 077\n printf '%s\\n'\
|
||||
\ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n chmod 600 \"$key_file\"\n export\
|
||||
\ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
|
||||
\ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
|
||||
\n git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
|
||||
\ = true ]; then\n git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
|
||||
\ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
|
||||
env:
|
||||
CHECKOUT_REF: ${{ github.sha }}
|
||||
CHECKOUT_SUBMODULES: recursive
|
||||
CHECKOUT_TOKEN: ${{ github.token }}
|
||||
PERSIST_CREDENTIALS: 'false'
|
||||
HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
|
||||
- name: Setup Hugo
|
||||
run: hugo version | grep extended
|
||||
build-hugo:
|
||||
name: Build - Hugo Site
|
||||
needs: setup-hugo
|
||||
runs-on: apex-debian13
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
|
||||
case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
|
||||
AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
|
||||
\ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
|
||||
git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
|
||||
\ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
|
||||
git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
|
||||
test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
|
||||
\ = recursive ]; then\n key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
|
||||
)\n trap 'rm -f \"$key_file\"' EXIT\n umask 077\n printf '%s\\n'\
|
||||
\ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n chmod 600 \"$key_file\"\n export\
|
||||
\ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
|
||||
\ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
|
||||
\n git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
|
||||
\ = true ]; then\n git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
|
||||
\ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
|
||||
env:
|
||||
CHECKOUT_REF: ${{ github.sha }}
|
||||
CHECKOUT_SUBMODULES: recursive
|
||||
CHECKOUT_TOKEN: ${{ github.token }}
|
||||
PERSIST_CREDENTIALS: 'false'
|
||||
HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
|
||||
- name: Setup Hugo
|
||||
run: hugo version | grep extended
|
||||
- name: Build Hugo site
|
||||
working-directory: services/docs
|
||||
run: hugo --gc --minify
|
||||
release-docker:
|
||||
name: Release - Docker Image
|
||||
needs: build-hugo
|
||||
runs-on: apex-debian13
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
|
||||
case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
|
||||
AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
|
||||
\ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
|
||||
git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
|
||||
\ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
|
||||
git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
|
||||
test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
|
||||
\ = recursive ]; then\n key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
|
||||
)\n trap 'rm -f \"$key_file\"' EXIT\n umask 077\n printf '%s\\n'\
|
||||
\ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n chmod 600 \"$key_file\"\n export\
|
||||
\ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
|
||||
\ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
|
||||
\n git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
|
||||
\ = true ]; then\n git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
|
||||
\ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
|
||||
env:
|
||||
CHECKOUT_REF: ${{ github.sha }}
|
||||
CHECKOUT_SUBMODULES: recursive
|
||||
CHECKOUT_TOKEN: ${{ github.token }}
|
||||
PERSIST_CREDENTIALS: 'false'
|
||||
HEXTRA_READ_KEY: ${{ secrets.HEXTRA_READ_KEY }}
|
||||
- name: Log in to GitHub Container Registry
|
||||
run: python3 .gitea/scripts/docker.py login
|
||||
env:
|
||||
REGISTRY: git.ermnvldmr.com
|
||||
REGISTRY_USER: ${{ github.repository_owner }}
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
- name: Extract Docker metadata
|
||||
id: meta
|
||||
run: python3 .gitea/scripts/docker.py metadata
|
||||
env:
|
||||
IMAGES: git.ermnvldmr.com/${{ github.repository }}/docs
|
||||
TAG_RULES: 'type=raw,value=latest
|
||||
|
||||
type=sha,format=short
|
||||
|
||||
'
|
||||
SOURCE_SHA: ${{ github.sha }}
|
||||
- name: Compute short SHA
|
||||
id: vars
|
||||
run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
|
||||
- name: Build and push Docker image
|
||||
run: python3 .gitea/scripts/docker.py build
|
||||
env:
|
||||
TAGS: ${{ steps.meta.outputs.tags }}
|
||||
LABELS: ${{ steps.meta.outputs.labels }}
|
||||
BUILD_ARGS: 'COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
|
||||
|
||||
VERSION=${{ steps.vars.outputs.short_sha }}
|
||||
|
||||
'
|
||||
DOCKERFILE: ci/docker/docs/Dockerfile
|
||||
PLATFORMS: ''
|
||||
PUSH: 'true'
|
||||
CONTEXT: .
|
||||
SOURCE_SHA: ${{ github.sha }}
|
||||
RUN_ID: ${{ github.run_id }}
|
||||
deploy:
|
||||
name: Deploy - Kubernetes (GitOps)
|
||||
needs: release-docker
|
||||
runs-on: apex-debian13
|
||||
if: github.event_name == 'push' && github.ref == 'refs/heads/next'
|
||||
permissions:
|
||||
contents: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
|
||||
case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
|
||||
AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
|
||||
\ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
|
||||
git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
|
||||
\ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
|
||||
git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
|
||||
test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
|
||||
\ = recursive ]; then\n key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
|
||||
)\n trap 'rm -f \"$key_file\"' EXIT\n umask 077\n printf '%s\\n'\
|
||||
\ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n chmod 600 \"$key_file\"\n export\
|
||||
\ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
|
||||
\ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
|
||||
\n git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
|
||||
\ = true ]; then\n git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
|
||||
\ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
|
||||
env:
|
||||
CHECKOUT_REF: ${{ github.sha }}
|
||||
CHECKOUT_SUBMODULES: 'false'
|
||||
CHECKOUT_TOKEN: ${{ github.token }}
|
||||
PERSIST_CREDENTIALS: 'false'
|
||||
HEXTRA_READ_KEY: ''
|
||||
- name: Setup Kustomize
|
||||
run: test "$(kustomize version)" = v5.3.0
|
||||
- name: Deploy via GitOps
|
||||
run: 'DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
|
||||
|
||||
bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"
|
||||
|
||||
'
|
||||
env:
|
||||
GIT_WRITE_KEY: ${{ secrets.DOCS_DEPLOY_KEY }}
|
||||
verify-rollout:
|
||||
name: Verify - Production Rollout
|
||||
needs: deploy
|
||||
runs-on: apex-debian13
|
||||
if: github.event_name == 'push' && github.ref == 'refs/heads/next'
|
||||
steps:
|
||||
- name: Await production rollout
|
||||
run: "TARGET_COMMIT=\"sha-$(echo ${{ github.sha }} | cut -c1-7)\"\nENDPOINT=\"\
|
||||
https://docs.ermnvldmr.com/version.json\"\n\necho \"========================================================\"\
|
||||
\necho \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
|
||||
\ $TARGET_COMMIT\"\necho \"========================================================\"\
|
||||
\n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
|
||||
\ $MAX_ATTEMPTS ]; do\n echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
|
||||
\n\n RESP_FILE=$(mktemp)\n HTTP_CODE=$(curl -sL --max-time 10 \\\n -H\
|
||||
\ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
|
||||
\ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n -H \"Accept:\
|
||||
\ application/json\" \\\n -o \"$RESP_FILE\" \\\n -w \"%{http_code}\"\
|
||||
\ \\\n \"$ENDPOINT\" || echo \"000\")\n\n if [ \"$HTTP_CODE\" = \"200\"\
|
||||
\ ]; then\n LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
|
||||
\ || true)\n echo \" Live commit: ${LIVE_COMMIT:-<none>}\"\n\n if [\
|
||||
\ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n echo \"\u2705 Success!\
|
||||
\ Production docs has successfully rolled out $TARGET_COMMIT.\"\n rm\
|
||||
\ -f \"$RESP_FILE\"\n exit 0\n fi\n elif [ \"$HTTP_CODE\" = \"403\"\
|
||||
\ ] || [ \"$HTTP_CODE\" = \"503\" ]; then\n echo \" HTTP $HTTP_CODE: Cloudflare\
|
||||
\ WAF/challenge encountered from runner IP.\"\n CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
|
||||
\ + 1))\n else\n echo \" HTTP $HTTP_CODE: Endpoint returned unexpected\
|
||||
\ status code or timed out.\"\n fi\n\n rm -f \"$RESP_FILE\"\n\n if [ $CF_BLOCKED_COUNT\
|
||||
\ -ge 5 ]; then\n echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
|
||||
\ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n echo\
|
||||
\ \"The GitOps release commit was already pushed to the repository; FluxCD\
|
||||
\ will reconcile the cluster.\"\n echo \"Skipping further external HTTP\
|
||||
\ verification to avoid false negative.\"\n exit 0\n fi\n\n ATTEMPT=$((ATTEMPT\
|
||||
\ + 1))\n sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
|
||||
\ after 7.5 minutes.\"\nexit 1\n"
|
||||
Reference in new issue
Block a user