30-birthday/.gitea/workflows/publish.yml

name: Test, publish birthday app and chart

on:
  push:
  pull_request:

env:
  IMAGE: registry.brunner.ninja/feedc0de/30-birthday

jobs:
  validate:
    runs-on: linux_amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Helm
        run: |
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/helm.tar.gz" \
            https://get.helm.sh/helm-v4.2.2-linux-amd64.tar.gz
          tar -xzf "${RUNNER_TEMP}/helm.tar.gz" -C "${RUNNER_TEMP}" linux-amd64/helm
          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
          chmod 0700 "${RUNNER_TEMP}/helm"
          echo "${RUNNER_TEMP}" >> "$GITHUB_PATH"
      - name: Validate application and chart
        run: |
          set -euo pipefail
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < server.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < database.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/app.js
          podman run --rm --interactive docker.io/library/node:24-alpine node --check - < public/admin.js
          podman run --rm --volume "$PWD:/app:ro" --workdir /app \
            docker.io/library/node:24-alpine npm test
          chart/test.sh

  publish-image:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs: validate
    runs-on: linux_amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Configure isolated registry access
        env:
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          set -euo pipefail
          authfile="${RUNNER_TEMP}/quay-auth.json"
          printf '{"auths":{}}' > "$authfile"
          chmod 0600 "$authfile"
          printf '%s' "$QUAY_TOKEN" | podman login registry.brunner.ninja \
            --authfile "$authfile" --username "$QUAY_USERNAME" --password-stdin
          echo "REGISTRY_AUTH_FILE=$authfile" >> "$GITHUB_ENV"
      - name: Build and push immutable image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          podman build \
            --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/30-birthday" \
            --tag "${IMAGE}:${COMMIT_SHA}" .
          podman push "${IMAGE}:${COMMIT_SHA}"
          podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
          podman push "${IMAGE}:latest"
      - if: always()
        run: rm -f "${RUNNER_TEMP}/quay-auth.json"

  publish-chart:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs:
      - validate
      - publish-image
    runs-on: linux_amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Helm
        run: |
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/helm.tar.gz" \
            https://get.helm.sh/helm-v4.2.2-linux-amd64.tar.gz
          tar -xzf "${RUNNER_TEMP}/helm.tar.gz" -C "${RUNNER_TEMP}" linux-amd64/helm
          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
          chmod 0700 "${RUNNER_TEMP}/helm"
          echo "${RUNNER_TEMP}" >> "$GITHUB_PATH"
      - id: chart
        name: Derive chart version
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          git fetch --tags origin main
          test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
          description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
          case "$description" in *-dirty) echo 'Refusing dirty chart tree' >&2; exit 1 ;; esac
          version=${description#v}
          case "$version" in *-0-g*) version=${version%%-0-g*} ;; esac
          echo "version=${version}" >> "$GITHUB_OUTPUT"
      - name: Package and publish chart
        env:
          PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
          CHART_VERSION: ${{ steps.chart.outputs.version }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          test -n "$PACKAGE_USERNAME" && test -n "$PACKAGE_TOKEN"
          helm lint chart
          helm template 30-birthday chart --namespace default \
            --set persistence.existingClaim=30-birthday-data \
            --set ingress.enabled=true --set ingress.host=30.brunner.ninja >/dev/null
          helm package chart --version "$CHART_VERSION" --app-version "$COMMIT_SHA" --destination "$RUNNER_TEMP"
          curl --fail --silent --show-error \
            --user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
            --request POST --upload-file "${RUNNER_TEMP}/30-birthday-${CHART_VERSION}.tgz" \
            https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts
      - name: Promote GitOps chart version
        env:
          GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }}
          CHART_VERSION: ${{ steps.chart.outputs.version }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          test -n "$GITOPS_TOKEN"
          test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
          auth=$(printf 'feedc0de:%s' "$GITOPS_TOKEN" | base64 | tr -d '\n')
          git -c "http.extraheader=AUTHORIZATION: basic ${auth}" clone --depth=1 \
            https://code.brunner.ninja/feedc0de/homelab-gitops.git "$RUNNER_TEMP/gitops"
          unset auth
          cd "$RUNNER_TEMP/gitops"
          gitops_auth=$(printf 'feedc0de:%s' "$GITOPS_TOKEN" | base64 | tr -d '\n')
          unset GITOPS_TOKEN
          git config user.name feedc0de
          git config user.email feedc0de@users.noreply.code.brunner.ninja
          sed -i -E "0,/targetRevision: [^ ]+/s//targetRevision: ${CHART_VERSION}/" bootstrap/30-birthday.yaml
          if git diff --quiet; then exit 0; fi
          git add bootstrap/30-birthday.yaml
          git commit -m "Deploy birthday invitation chart ${CHART_VERSION}"
          for attempt in 1 2 3; do
            if git -c "http.extraheader=AUTHORIZATION: basic ${gitops_auth}" push origin HEAD:main; then exit 0; fi
            git -c "http.extraheader=AUTHORIZATION: basic ${gitops_auth}" fetch origin main
            git rebase origin/main
          done
          exit 1