gramps-kubernetes/.gitea/workflows/ci.yml

name: Validate, publish and deploy Gramps Web

on:
  push:
  pull_request:

env:
  CHART_REGISTRY: oci://registry.brunner.ninja/feedc0de/charts
  POSTGRES_IMAGE: registry.brunner.ninja/feedc0de/postgres-with-locales
  POSTGRES_IMAGE_TAG: 18-locales
  HELM_VERSION: v4.2.2
  KUBECTL_VERSION: v1.36.3
  KUBERNETES_API: https://host.containers.internal:6443
  KUBERNETES_TLS_SERVER_NAME: 192.168.0.2

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install pinned Helm
        run: |
          curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
      - name: Validate chart and secret hygiene
        run: bash test.sh
      - name: Validate Kubernetes schemas
        run: |
          helm template gramps . --namespace gramps --values values-arschrock.yaml \
            | docker run --rm --interactive \
              ghcr.io/yannh/kubeconform:v0.7.0 \
              -strict -exit-on-error -ignore-missing-schemas -summary

  ensure-postgresql-image:
    if: gitea.event_name == 'push' && (gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v'))
    needs: validate
    # This trusted push-only job runs directly on the Podman-native runner.
    runs-on: linux_amd64
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Ensure locale-enabled PostgreSQL image exists
        env:
          BEFORE_SHA: ${{ gitea.event.before }}
          COMMIT_SHA: ${{ gitea.sha }}
          GIT_REF: ${{ gitea.ref }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          set -euo pipefail
          test -n "${QUAY_USERNAME}"
          test -n "${QUAY_TOKEN}"
          authfile="${RUNNER_TEMP}/quay-auth.json"
          trap 'rm -f "${authfile}"' EXIT
          printf '%s' "${QUAY_TOKEN}" | podman login registry.brunner.ninja \
            --authfile "${authfile}" --username "${QUAY_USERNAME}" --password-stdin

          build_required=false
          if ! podman manifest inspect --authfile "${authfile}" \
            "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}" >/dev/null 2>&1; then
            echo "PostgreSQL image is not published yet."
            build_required=true
          elif [[ "${GIT_REF}" == refs/heads/main ]] \
            && [[ "${BEFORE_SHA}" =~ ^[0-9a-f]{40}$ ]] \
            && [[ ! "${BEFORE_SHA}" =~ ^0+$ ]] \
            && ! git diff --quiet "${BEFORE_SHA}" "${COMMIT_SHA}" -- postgresql-image; then
            echo "PostgreSQL image recipe changed."
            build_required=true
          fi

          if [[ "${build_required}" == false ]]; then
            echo "PostgreSQL image already exists; skipping the build."
            exit 0
          fi

          podman build --pull=always \
            --label "org.opencontainers.image.revision=${COMMIT_SHA}" \
            --label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/gramps-kubernetes" \
            --tag "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}" \
            postgresql-image
          podman run --rm --entrypoint bash \
            "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}" -ec \
            'postgres --version | grep -E "PostgreSQL\) 18\."; locale -a | grep -Fx de_AT.utf8; locale -a | grep -Fx de_DE.utf8; locale -a | grep -Fx en_GB.utf8; locale -a | grep -Fx en_US.utf8'
          podman push --authfile "${authfile}" \
            "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}"

  publish:
    if: gitea.event_name == 'push' && (gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v'))
    needs: [validate, ensure-postgresql-image]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install pinned Helm
        run: |
          curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
      - name: Package and publish chart
        env:
          COMMIT_SHA: ${{ gitea.sha }}
          GIT_REF: ${{ gitea.ref }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          set -euo pipefail
          test -n "${QUAY_USERNAME}"
          test -n "${QUAY_TOKEN}"
          if [[ "${GIT_REF}" == refs/tags/v* ]]; then
            chart_version="${GIT_REF#refs/tags/v}"
          else
            chart_version="0.0.0-dev.sha${COMMIT_SHA:0:12}"
          fi

          helm dependency update .
          mkdir -p "${RUNNER_TEMP}/packages"
          helm package . --destination "${RUNNER_TEMP}/packages" \
            --version "${chart_version}" --app-version latest
          package="${RUNNER_TEMP}/packages/gramps-web-${chart_version}.tgz"
          test -f "${package}"
          helm template gramps "${package}" --namespace gramps \
            --values values-arschrock.yaml > "${RUNNER_TEMP}/rendered.yaml"

          printf '%s' "${QUAY_TOKEN}" | helm registry login registry.brunner.ninja \
            --username "${QUAY_USERNAME}" --password-stdin
          helm push "${package}" "${CHART_REGISTRY}"

  deploy:
    if: gitea.ref == 'refs/heads/main'
    needs: publish
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - name: Install pinned clients
        run: |
          curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
          curl -fsSL -o "${RUNNER_TEMP}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
          chmod 0700 "${RUNNER_TEMP}/helm" "${RUNNER_TEMP}/kubectl"
          echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
      - name: Configure registry and Kubernetes access
        env:
          KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: |
          test -n "${KUBE_CONFIG_BASE64}"
          printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
          chmod 0600 "${RUNNER_TEMP}/kubeconfig"
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          kubectl config set-cluster cluster --server="${KUBERNETES_API}" --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
          printf '%s' "${QUAY_TOKEN}" | helm registry login registry.brunner.ninja \
            --username "${QUAY_USERNAME}" --password-stdin
      - name: Deploy the published OCI chart
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
          chart_version="0.0.0-dev.sha${COMMIT_SHA:0:12}"
          CHART_VERSION="${chart_version}" ./deploy.sh
          kubectl --namespace gramps rollout restart deployment/grampsweb deployment/grampsweb-celery
          kubectl --namespace gramps rollout status deployment/grampsweb --timeout=10m
          kubectl --namespace gramps rollout status deployment/grampsweb-celery --timeout=10m
          kubectl --namespace gramps rollout status statefulset/postgresql --timeout=10m
          kubectl --namespace gramps rollout status statefulset/valkey-primary --timeout=10m