30-birthday/.gitea/workflows/container.yml

name: Publish and deploy birthday invitation

on:
  push:

env:
  IMAGE: registry.brunner.ninja/feedc0de/30-birthday
  KUBERNETES_API: https://host.containers.internal:6443
  KUBERNETES_TLS_SERVER_NAME: 192.168.0.2

jobs:
  test:
    name: Check JavaScript
    runs-on: linux_amd64
    steps:
      - name: Check out source
        uses: actions/checkout@v4
      - name: Check server and browser scripts
        run: |
          authfile=$(mktemp)
          trap 'rm -f "$authfile"' EXIT
          printf '{"auths":{}}' > "$authfile"
          export REGISTRY_AUTH_FILE="$authfile"
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < server.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < database.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/app.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/admin.js
          podman run --rm \
            --volume "$PWD:/app:ro" \
            --workdir /app \
            docker.io/library/node:24-alpine npm test

  publish:
    name: Build and push
    if: gitea.ref == 'refs/heads/main'
    needs: test
    runs-on: linux_amd64
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Configure isolated registry access
        env:
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          set -euo pipefail
          authfile="${RUNNER_TEMP}/quay-auth.json"
          printf '{"auths":{}}' > "$authfile"
          chmod 0600 "$authfile"
          printf '%s' "$QUAY_TOKEN" | podman login registry.brunner.ninja \
            --authfile "$authfile" --username "$QUAY_USERNAME" --password-stdin
          echo "REGISTRY_AUTH_FILE=$authfile" >> "$GITHUB_ENV"

      - name: Build image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          podman build \
            --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/30-birthday" \
            --tag "${IMAGE}:${COMMIT_SHA}" \
            .

      - name: Push commit tag
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: podman push "${IMAGE}:${COMMIT_SHA}"

      - name: Push latest tag
        if: gitea.ref == 'refs/heads/main'
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
          podman push "${IMAGE}:latest"

      - name: Remove registry credentials
        if: always()
        run: rm -f "${RUNNER_TEMP}/quay-auth.json"

  deploy:
    name: Deploy to Kubernetes
    if: gitea.ref == 'refs/heads/main'
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - name: Install kubectl
        env:
          KUBECTL_VERSION: v1.36.4
        run: |
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/kubectl" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          chmod 0700 "${RUNNER_TEMP}/kubectl"

      - name: Configure Kubernetes access
        env:
          KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
        run: |
          test -n "${KUBE_CONFIG_BASE64}"
          printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
          chmod 0600 "${RUNNER_TEMP}/kubeconfig"
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" config set-cluster cluster \
            --server="${KUBERNETES_API}" \
            --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"

      - name: Deploy commit image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" --namespace default set image \
            deployment/30-birthday \
            "30-birthday=${IMAGE}:${COMMIT_SHA}"

          for attempt in {1..60}; do
            IFS='|' read -r generation observed desired updated available unavailable <<< "$(
              "${RUNNER_TEMP}/kubectl" --namespace default get deployment/30-birthday \
                --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.updatedReplicas}|{.status.availableReplicas}|{.status.unavailableReplicas}'
            )"

            echo "Rollout ${attempt}/60: generation ${observed}/${generation}, replicas ${updated}/${desired} updated, ${available}/${desired} available"
            if [[ "${observed}" == "${generation}" \
                  && "${updated}" == "${desired}" \
                  && "${available}" == "${desired}" \
                  && ( -z "${unavailable}" || "${unavailable}" == "0" ) ]]; then
              echo "Deployment successfully rolled out"
              exit 0
            fi

            sleep 5
          done

          "${RUNNER_TEMP}/kubectl" --namespace default describe deployment/30-birthday
          exit 1