Jon Chery
5c07fafa18
CoreCI's buildIsolatedEnv only forwards CI_* and CORECI_* prefixed vars
from os.Environ(). GITEA_TOKEN is not prefixed, so it's only available
if it's in the job vars map (via ${{ secrets.GITEA_TOKEN }}). The
secret resolver's os.Getenv fallback should work, but to be safe, also
set CI_GITEA_TOKEN in the workflow env (always forwarded as a CI_* var).
Add debug output for GITEA_TOKEN length and CI context vars.
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
93 lines
2.9 KiB
YAML
93 lines
2.9 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
ci:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.25'
|
|
|
|
- name: Install CoreCI
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
run: |
|
|
git clone --depth=1 https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/coreci/coreci.git /tmp/coreci
|
|
cd /tmp/coreci
|
|
CGO_ENABLED=0 go build -tags sqlite_go -o /usr/local/bin/coreci ./cmd/coreci
|
|
coreci version
|
|
|
|
- name: Run CoreCI pipeline
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
CI_GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
run: |
|
|
coreci run
|
|
|
|
container-orca:
|
|
runs-on: ubuntu-latest
|
|
needs: ci
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
options: --entrypoint /bin/sh
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build and push orca image
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
mkdir -p /kaniko/.docker
|
|
AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0)
|
|
echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json
|
|
GIT_COMMIT=$(echo -n "${{ gitea.sha }}" | cut -c1-12)
|
|
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
/kaniko/executor \
|
|
--dockerfile=Dockerfile \
|
|
--context=dir://. \
|
|
--destination=git.cloudinit.dev/coreci/orca:${VERSION} \
|
|
--destination=git.cloudinit.dev/coreci/orca:latest \
|
|
--build-arg=VERSION=${VERSION} \
|
|
--build-arg=GIT_COMMIT=${GIT_COMMIT} \
|
|
--build-arg=BUILD_TIME=${BUILD_TIME} \
|
|
--skip-tls-verify-registry
|
|
|
|
container-traefik:
|
|
runs-on: ubuntu-latest
|
|
needs: ci
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
options: --entrypoint /bin/sh
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build and push orca-traefik image
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
|
|
VERSION: ${{ gitea.ref_name }}
|
|
run: |
|
|
if [ ! -f Dockerfile.traefik ]; then
|
|
echo "Dockerfile.traefik not found at this tag — skipping orca-traefik image"
|
|
exit 0
|
|
fi
|
|
mkdir -p /kaniko/.docker
|
|
AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0)
|
|
echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json
|
|
/kaniko/executor \
|
|
--dockerfile=Dockerfile.traefik \
|
|
--context=dir://. \
|
|
--destination=git.cloudinit.dev/coreci/orca-traefik:${VERSION} \
|
|
--destination=git.cloudinit.dev/coreci/orca-traefik:latest \
|
|
--skip-tls-verify-registry |