asciinema-deployment/.gitea/workflows/deploy.yml

name: Validate and deploy asciinema

on:
  push:
  pull_request:

env:
  KUBECTL_VERSION: v1.36.3
  KUBERNETES_API: https://host.containers.internal:6443
  KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
  NAMESPACE: asciinema

jobs:
  validate:
    name: Validate manifests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Validate scripts and Kubernetes resources
        run: bash test.sh

  deploy:
    name: Deploy to Kubernetes
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Install kubectl
        run: |
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/kubectl" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          curl --fail --silent --show-error --location \
            --output "${RUNNER_TEMP}/kubectl.sha256" \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
          chmod 0700 "${RUNNER_TEMP}/kubectl"

      - name: Configure Kubernetes access
        env:
          KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
        run: |
          test -n "${KUBE_CONFIG_BASE64}"
          printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
          chmod 0600 "${RUNNER_TEMP}/kubeconfig"
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" config set-cluster cluster \
            --server="${KUBERNETES_API}" \
            --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"

      - name: Validate desired state on the server
        run: |
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          "${RUNNER_TEMP}/kubectl" apply \
            --dry-run=server \
            --validate=false \
            --filename infrastructure.yaml
          "${RUNNER_TEMP}/kubectl" apply \
            --dry-run=server \
            --validate=false \
            --filename asciinema.yaml

      - name: Apply and verify
        run: |
          set -euo pipefail
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"

          "${RUNNER_TEMP}/kubectl" apply \
            --validate=false \
            --filename infrastructure.yaml

          for attempt in {1..120}; do
            IFS='|' read -r generation observed desired current ready updated <<< "$(
              "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" \
                get statefulset/postgresql \
                --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.currentReplicas}|{.status.readyReplicas}|{.status.updatedReplicas}'
            )"

            echo "PostgreSQL ${attempt}/120: generation ${observed}/${generation}, replicas ${updated}/${desired} updated, ${current}/${desired} current, ${ready}/${desired} ready"
            if [[ "${observed}" == "${generation}" \
                  && "${updated}" == "${desired}" \
                  && "${current}" == "${desired}" \
                  && "${ready}" == "${desired}" ]]; then
              break
            fi

            if [[ "${attempt}" == 120 ]]; then
              echo "PostgreSQL rollout did not complete within ten minutes" >&2
              exit 1
            fi
            sleep 5
          done

          "${RUNNER_TEMP}/kubectl" apply \
            --validate=false \
            --filename asciinema.yaml
          # ConfigMap and Secret-backed environment variables are read only at
          # process start, so every successful deployment recreates the sole pod.
          "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" \
            rollout restart deployment/asciinema

          for attempt in {1..120}; do
            IFS='|' read -r generation observed desired updated ready available unavailable image <<< "$(
              "${RUNNER_TEMP}/kubectl" --namespace "${NAMESPACE}" \
                get deployment/asciinema \
                --output=jsonpath='{.metadata.generation}|{.status.observedGeneration}|{.spec.replicas}|{.status.updatedReplicas}|{.status.readyReplicas}|{.status.availableReplicas}|{.status.unavailableReplicas}|{.spec.template.spec.containers[0].image}'
            )"

            echo "asciinema ${attempt}/120: generation ${observed}/${generation}, replicas ${updated}/${desired} updated, ${ready}/${desired} ready, ${available}/${desired} available, image ${image}"
            if [[ "${observed}" == "${generation}" \
                  && "${updated}" == "${desired}" \
                  && "${ready}" == "${desired}" \
                  && "${available}" == "${desired}" \
                  && ( -z "${unavailable}" || "${unavailable}" == "0" ) ]]; then
              break
            fi

            if [[ "${attempt}" == 120 ]]; then
              echo "asciinema rollout did not complete within ten minutes" >&2
              exit 1
            fi
            sleep 5
          done

          for attempt in {1..30}; do
            if curl --fail --silent --show-error --max-time 15 \
                https://asciinema.brunner.ninja/ >/dev/null; then
              echo "asciinema deployment is healthy"
              exit 0
            fi
            echo "Public health check ${attempt}/30 failed; retrying"
            sleep 5
          done

          echo "Public health check did not pass" >&2
          exit 1