From eadf2cc2c5857f905e33a65f6a318274475eb5a4 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Mon, 10 Aug 2026 20:59:10 +0000 Subject: [PATCH] fix(P1): Gitea Actions workflow + kaniko container publishing (REQ-180,181) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New .gitea/workflows/release.yml: - Triggers on push: tags: ['v*'] (deterministic) - Job 'ci': checkout + install Go + install coreci binary + coreci run (executes .coreci.yml: validate, build, test, release) - Job 'container-orca': kaniko executor:debug with --entrypoint /bin/sh, builds+pushes orca image (no DinD) - Job 'container-traefik': same, builds+pushes orca-traefik image (skips if Dockerfile.traefik absent at that tag) - Uses PAT_TOKEN secret (Gitea reserves GITEA_ prefix) .coreci.yml: - Removed container-publish + container-publish-traefik steps (moved to Gitea Actions — CoreCI's podman executor appends sh -c which conflicts with kaniko's /kaniko/executor entrypoint) - Keeps validate/build/test/release (tarball + Gitea release) scripts/trigger_coreci.sh: - Added tag ref handling (refs/tags/*) so pre-push hook triggers CoreCI for tag pushes too (Gitea Actions webhook is secondary) ---ci--- project: orca phase: 1 milestone: v0.15 status: execute ---/ci--- --- .coreci.yml | 36 --------------- .gitea/workflows/release.yml | 90 ++++++++++++++++++++++++++++++++++++ scripts/trigger_coreci.sh | 14 ++++++ 3 files changed, 104 insertions(+), 36 deletions(-) create mode 100644 .gitea/workflows/release.yml diff --git a/.coreci.yml b/.coreci.yml index e61ea58..c7e7480 100644 --- a/.coreci.yml +++ b/.coreci.yml @@ -147,39 +147,3 @@ pipelines: -F "attachment=@SHA256SUMS" fi fi - - name: container-publish - description: Build and publish OCI image to Gitea container registry (REQ-046) - image: docker:24-cli - env: - GITEA_TOKEN: ${GITEA_TOKEN} - VERSION: ${CI_COMMIT_TAG} - GIT_COMMIT: ${CI_COMMIT_SHA} - BUILD_TIME: ${CI_BUILD_TIME} - commands: - - docker build - --build-arg VERSION=${VERSION} - --build-arg GIT_COMMIT=${GIT_COMMIT} - --build-arg BUILD_TIME=${BUILD_TIME} - -t git.cloudinit.dev/coreci/orca:${VERSION} - -t git.cloudinit.dev/coreci/orca:latest - . - - echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin - - docker push git.cloudinit.dev/coreci/orca:${VERSION} - - docker push git.cloudinit.dev/coreci/orca:latest - - docker logout git.cloudinit.dev - - name: container-publish-traefik - description: Build and publish orca-traefik OCI image (REQ-171, R-024) - image: docker:24-cli - env: - GITEA_TOKEN: ${GITEA_TOKEN} - VERSION: ${CI_COMMIT_TAG} - commands: - - docker build - -f Dockerfile.traefik - -t git.cloudinit.dev/coreci/orca-traefik:${VERSION} - -t git.cloudinit.dev/coreci/orca-traefik:latest - . - - echo "${GITEA_TOKEN}" | docker login git.cloudinit.dev -u cloudinit-bot --password-stdin - - docker push git.cloudinit.dev/coreci/orca-traefik:${VERSION} - - docker push git.cloudinit.dev/coreci/orca-traefik:latest - - docker logout git.cloudinit.dev diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml new file mode 100644 index 0000000..c76b2d5 --- /dev/null +++ b/.gitea/workflows/release.yml @@ -0,0 +1,90 @@ +name: Release + +on: + push: + tags: + - 'v*' + +jobs: + ci: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: '1.25' + + - name: Install CoreCI + run: | + git clone --depth=1 https://git.cloudinit.dev/coreci/coreci.git /tmp/coreci + cd /tmp/coreci + CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci + coreci version + + - name: Run CoreCI pipeline + env: + GITEA_TOKEN: ${{ secrets.PAT_TOKEN }} + run: | + coreci run + + container-orca: + runs-on: ubuntu-latest + needs: ci + container: + image: gcr.io/kaniko-project/executor:debug + options: --entrypoint /bin/sh + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Build and push orca image + env: + GITEA_TOKEN: ${{ secrets.PAT_TOKEN }} + VERSION: ${{ gitea.ref_name }} + run: | + mkdir -p /kaniko/.docker + AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0) + echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json + GIT_COMMIT=$(echo -n "${{ gitea.sha }}" | cut -c1-12) + BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) + /kaniko/executor \ + --dockerfile=Dockerfile \ + --context=dir://. \ + --destination=git.cloudinit.dev/coreci/orca:${VERSION} \ + --destination=git.cloudinit.dev/coreci/orca:latest \ + --build-arg=VERSION=${VERSION} \ + --build-arg=GIT_COMMIT=${GIT_COMMIT} \ + --build-arg=BUILD_TIME=${BUILD_TIME} \ + --skip-tls-verify-registry + + container-traefik: + runs-on: ubuntu-latest + needs: ci + container: + image: gcr.io/kaniko-project/executor:debug + options: --entrypoint /bin/sh + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Build and push orca-traefik image + env: + GITEA_TOKEN: ${{ secrets.PAT_TOKEN }} + VERSION: ${{ gitea.ref_name }} + run: | + if [ ! -f Dockerfile.traefik ]; then + echo "Dockerfile.traefik not found at this tag — skipping orca-traefik image" + exit 0 + fi + mkdir -p /kaniko/.docker + AUTH=$(echo -n "cloudinit-bot:${GITEA_TOKEN}" | base64 -w0) + echo "{\"auths\":{\"git.cloudinit.dev\":{\"auth\":\"${AUTH}\"}}}" > /kaniko/.docker/config.json + /kaniko/executor \ + --dockerfile=Dockerfile.traefik \ + --context=dir://. \ + --destination=git.cloudinit.dev/coreci/orca-traefik:${VERSION} \ + --destination=git.cloudinit.dev/coreci/orca-traefik:latest \ + --skip-tls-verify-registry \ No newline at end of file diff --git a/scripts/trigger_coreci.sh b/scripts/trigger_coreci.sh index 758cf25..ba35b2a 100755 --- a/scripts/trigger_coreci.sh +++ b/scripts/trigger_coreci.sh @@ -30,6 +30,20 @@ fi while read local_ref local_sha remote_ref remote_sha; do branch="${remote_ref#refs/heads/}" if [ -z "$branch" ] || [ "$branch" = "HEAD" ]; then + # Check if this is a tag push (refs/tags/*) + tag="${remote_ref#refs/tags/}" + if [ -n "$tag" ] && [ "$tag" != "$remote_ref" ]; then + echo "→ Triggering CoreCI for tag: $tag (${local_sha:0:7})" + payload=$(printf '{"repo":"coreci/orca","branch":"%s","ref":"%s"}' "$tag" "$local_sha") + if command -v curl >/dev/null 2>&1; then + curl -fsS -X POST "${CORECI_URL}/api/pipeline/run" \ + -H "Authorization: token ${GITEA_TOKEN}" \ + -H "Content-Type: application/json" \ + -d "$payload" >/dev/null 2>&1 \ + && echo " ✓ CoreCI triggered" \ + || echo " (CoreCI trigger failed; Gitea Actions webhook is secondary path)" + fi + fi continue fi echo "→ Triggering CoreCI for branch: $branch (${local_sha:0:7})"