30-birthday/.gitea/workflows/container.yml

name: Publish and deploy birthday invitation

on:
  push:

env:
  IMAGE: registry.brunner.ninja/feedc0de/30-birthday
  KUBERNETES_API: https://host.containers.internal:6443
  KUBERNETES_TLS_SERVER_NAME: 192.168.0.2

jobs:
  test:
    name: Check JavaScript
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4
      - name: Check server and browser scripts
        run: |
          docker run --rm --interactive node:24-alpine node --check - < server.js
          docker run --rm --interactive node:24-alpine node --check - < database.js
          docker run --rm --interactive node:24-alpine node --check - < public/app.js
          docker run --rm --interactive node:24-alpine node --check - < public/admin.js

  publish:
    name: Build and push
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Log in to Quay
        uses: docker/login-action@v3
        with:
          registry: registry.brunner.ninja
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Build image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          docker build \
            --load \
            --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/30-birthday" \
            --tag "${IMAGE}:${COMMIT_SHA}" \
            .

      - name: Push commit tag
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: docker push "${IMAGE}:${COMMIT_SHA}"

      - name: Push latest tag
        if: gitea.ref == 'refs/heads/main'
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          docker tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
          docker push "${IMAGE}:latest"

  deploy:
    name: Deploy to Kubernetes
    if: gitea.ref == 'refs/heads/main'
    needs: publish
    runs-on: ubuntu-latest
    steps:
      - name: Install kubectl
        env:
          KUBECTL_VERSION: v1.36.4
        run: |
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/kubectl" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/kubectl.sha256" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
          chmod 0700 "${RUNNER_TEMP}/kubectl"

      - name: Configure Kubernetes access
        env:
          KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
        run: |
          test -n "${KUBE_CONFIG_BASE64}"
          printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
          chmod 0600 "${RUNNER_TEMP}/kubeconfig"
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" config set-cluster cluster \
            --server="${KUBERNETES_API}" \
            --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"

      - name: Deploy commit image
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" --namespace default set image \
            deployment/30-birthday \
            "30-birthday=${IMAGE}:${COMMIT_SHA}"

          for attempt in {1..60}; do
            IFS='|' read -r generation observed desired updated available unavailable <<< "$(
              "${RUNNER_TEMP}/kubectl" --namespace default get deployment/30-birthday \
                --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.updatedReplicas}|{.status.availableReplicas}|{.status.unavailableReplicas}'
            )"

            echo "Rollout ${attempt}/60: generation ${observed}/${generation}, replicas ${updated}/${desired} updated, ${available}/${desired} available"
            if [[ "${observed}" == "${generation}" \
                  && "${updated}" == "${desired}" \
                  && "${available}" == "${desired}" \
                  && ( -z "${unavailable}" || "${unavailable}" == "0" ) ]]; then
              echo "Deployment successfully rolled out"
              exit 0
            fi

            sleep 5
          done

          "${RUNNER_TEMP}/kubectl" --namespace default describe deployment/30-birthday
          exit 1