Jon Chery
3be86e6daf
REQ-183: Fix .gitea/workflows/release.yml — the git clone of the private coreci repo failed because the clone command had no credentials. The actions/checkout@v4 step only injects auth for the orca repo. Fix: pass GITEA_TOKEN env to the Install CoreCI step and embed it in the clone URL (https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/...). REQ-184: Rewrite .coreci.yml from the invalid pipelines:/steps:/image:/ commands: format to CoreCI's native jobs:/plugin:/invoke:/vars: format with a proper DAG (needs:). CoreCI's Pipeline struct only recognizes jobs:/services:/env: top-level keys — unknown fields are silently dropped by yaml.Unmarshal, producing an empty Jobs map → zero jobs execute. The rewrite: - 8 jobs: go-vet → fan-out (verify-reqs, gosec, govulncheck, gitleaks) → build → test → release - plugin: docker://golang:1.25.12 + invoke: on each job (container path with shell-isolated fallback — Go is installed on the runner) - GITEA_TOKEN via vars: with ${{ secrets.GITEA_TOKEN }} (resolved from env via CoreCI's secret resolver os.Getenv fallback) - CI_COMMIT_BRANCH (tag name on tag push) and CI_COMMIT_SHA for version injection — no ${VAR} interpolation in YAML fields (shell expansion only works inside invoke: via sh -c) - No apk add (runner is ubuntu, not alpine — uses curl for tool downloads) - Release job handles duplicate release (ship workflow creates release first with title+body; coreci run attaches binary assets later via API fallback if tea releases create fails) - Release job verifies asset count ≥ 2 (REQ-097 gate C-21) with retry Root cause: all 87 releases in repo history had zero binary assets because coreci run never executed any jobs (empty Jobs map from the invalid format) and the Gitea Actions workflow failed before reaching coreci run (private repo clone had no credentials). ---ci--- project: orca phase: 1 milestone: v0.16 status: execute requirements: covered: [183, 184] partial: [] ---/ci---
92 lines
2.9 KiB
YAML
92 lines
2.9 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
ci:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.25'
|
|
|
|
- name: Install CoreCI
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
run: |
|
|
git clone --depth=1 https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/coreci/coreci.git /tmp/coreci
|
|
cd /tmp/coreci
|
|
CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
|
|
coreci version
|
|
|
|
- name: Run CoreCI pipeline
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
run: |
|
|
coreci run
|
|
|
|
container-orca:
|
|
runs-on: ubuntu-latest
|
|
needs: ci
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
options: --entrypoint /bin/sh
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build and push orca image
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
mkdir -p /kaniko/.docker
|
|
AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0)
|
|
echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json
|
|
GIT_COMMIT=$(echo -n "${{ gitea.sha }}" | cut -c1-12)
|
|
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
/kaniko/executor \
|
|
--dockerfile=Dockerfile \
|
|
--context=dir://. \
|
|
--destination=git.cloudinit.dev/coreci/orca:${VERSION} \
|
|
--destination=git.cloudinit.dev/coreci/orca:latest \
|
|
--build-arg=VERSION=${VERSION} \
|
|
--build-arg=GIT_COMMIT=${GIT_COMMIT} \
|
|
--build-arg=BUILD_TIME=${BUILD_TIME} \
|
|
--skip-tls-verify-registry
|
|
|
|
container-traefik:
|
|
runs-on: ubuntu-latest
|
|
needs: ci
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
options: --entrypoint /bin/sh
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build and push orca-traefik image
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
if [ ! -f Dockerfile.traefik ]; then
|
|
echo "Dockerfile.traefik not found at this tag — skipping orca-traefik image"
|
|
exit 0
|
|
fi
|
|
mkdir -p /kaniko/.docker
|
|
AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0)
|
|
echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json
|
|
/kaniko/executor \
|
|
--dockerfile=Dockerfile.traefik \
|
|
--context=dir://. \
|
|
--destination=git.cloudinit.dev/coreci/orca-traefik:${VERSION} \
|
|
--destination=git.cloudinit.dev/coreci/orca-traefik:latest \
|
|
--skip-tls-verify-registry |