138 lines
6.9 KiB
YAML
138 lines
6.9 KiB
YAML
name: Validate, publish and deploy Gramps Web
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CHART_REGISTRY: oci://registry.brunner.ninja/feedc0de/charts
|
|
POSTGRES_IMAGE: registry.brunner.ninja/feedc0de/postgres-with-locales
|
|
POSTGRES_IMAGE_TAG: 18-locales
|
|
HELM_VERSION: v4.2.2
|
|
HELM_SHA256: 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6
|
|
KUBECTL_VERSION: v1.36.3
|
|
KUBERNETES_API: https://host.containers.internal:6443
|
|
KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pinned Helm
|
|
run: |
|
|
curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
|
|
printf '%s %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tgz" | sha256sum --check
|
|
tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
|
|
echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
|
|
- name: Validate chart and secret hygiene
|
|
run: bash test.sh
|
|
- name: Validate Kubernetes schemas
|
|
run: |
|
|
helm template gramps . --namespace gramps --values values-arschrock.yaml \
|
|
| docker run --rm --interactive \
|
|
ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c \
|
|
-strict -exit-on-error -ignore-missing-schemas -summary
|
|
- name: Build and test locale-enabled PostgreSQL
|
|
run: |
|
|
set -euo pipefail
|
|
base_version=$(docker run --rm docker.io/bitnami/postgresql:latest postgres --version)
|
|
[[ "${base_version}" == *"PostgreSQL) 18."* ]]
|
|
docker build --pull --tag "${POSTGRES_IMAGE}:ci" postgresql-image
|
|
docker run --rm --entrypoint bash "${POSTGRES_IMAGE}:ci" -ec \
|
|
'postgres --version | grep -E "PostgreSQL\) 18\."; locale -a | grep -Fx de_AT.utf8; locale -a | grep -Fx de_DE.utf8; locale -a | grep -Fx en_GB.utf8; locale -a | grep -Fx en_US.utf8'
|
|
|
|
publish:
|
|
if: gitea.event_name == 'push' && (gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v'))
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pinned Helm
|
|
run: |
|
|
curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
|
|
printf '%s %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tgz" | sha256sum --check
|
|
tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
|
|
echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
|
|
- name: Build and publish image and chart
|
|
env:
|
|
COMMIT_SHA: ${{ gitea.sha }}
|
|
GIT_REF: ${{ gitea.ref }}
|
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
|
QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "${QUAY_USERNAME}"
|
|
test -n "${QUAY_TOKEN}"
|
|
if [[ "${GIT_REF}" == refs/tags/v* ]]; then
|
|
chart_version="${GIT_REF#refs/tags/v}"
|
|
else
|
|
chart_version="0.0.0-dev.sha${COMMIT_SHA:0:12}"
|
|
fi
|
|
|
|
base_version=$(docker run --rm docker.io/bitnami/postgresql:latest postgres --version)
|
|
[[ "${base_version}" == *"PostgreSQL) 18."* ]]
|
|
docker build --pull \
|
|
--label "org.opencontainers.image.revision=${COMMIT_SHA}" \
|
|
--label "org.opencontainers.image.source=https://code.brunner.ninja/feedc0de/gramps-web-deployment" \
|
|
--tag "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}" postgresql-image
|
|
|
|
helm dependency update .
|
|
mkdir -p "${RUNNER_TEMP}/packages"
|
|
helm package . --destination "${RUNNER_TEMP}/packages" \
|
|
--version "${chart_version}" --app-version latest
|
|
package="${RUNNER_TEMP}/packages/gramps-web-${chart_version}.tgz"
|
|
test -f "${package}"
|
|
helm template gramps "${package}" --namespace gramps \
|
|
--values values-arschrock.yaml > "${RUNNER_TEMP}/rendered.yaml"
|
|
|
|
printf '%s' "${QUAY_TOKEN}" | docker login registry.brunner.ninja \
|
|
--username "${QUAY_USERNAME}" --password-stdin
|
|
printf '%s' "${QUAY_TOKEN}" | helm registry login registry.brunner.ninja \
|
|
--username "${QUAY_USERNAME}" --password-stdin
|
|
docker push "${POSTGRES_IMAGE}:${POSTGRES_IMAGE_TAG}"
|
|
helm push "${package}" "${CHART_REGISTRY}"
|
|
|
|
deploy:
|
|
if: gitea.ref == 'refs/heads/main'
|
|
needs: publish
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pinned clients
|
|
run: |
|
|
curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
|
|
printf '%s %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tgz" | sha256sum --check
|
|
tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
|
|
curl -fsSL -o "${RUNNER_TEMP}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
|
|
curl -fsSL -o "${RUNNER_TEMP}/kubectl.sha256" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
|
|
printf '%s %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
|
|
chmod 0700 "${RUNNER_TEMP}/helm" "${RUNNER_TEMP}/kubectl"
|
|
echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
|
|
- name: Configure registry and Kubernetes access
|
|
env:
|
|
KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG_BASE64 }}
|
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
|
QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
|
|
run: |
|
|
test -n "${KUBE_CONFIG_BASE64}"
|
|
printf '%s' "${KUBE_CONFIG_BASE64}" | base64 --decode > "${RUNNER_TEMP}/kubeconfig"
|
|
chmod 0600 "${RUNNER_TEMP}/kubeconfig"
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
kubectl config set-cluster cluster --server="${KUBERNETES_API}" --tls-server-name="${KUBERNETES_TLS_SERVER_NAME}"
|
|
printf '%s' "${QUAY_TOKEN}" | helm registry login registry.brunner.ninja \
|
|
--username "${QUAY_USERNAME}" --password-stdin
|
|
- name: Deploy the published OCI chart
|
|
env:
|
|
COMMIT_SHA: ${{ gitea.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
export KUBECONFIG="${RUNNER_TEMP}/kubeconfig"
|
|
chart_version="0.0.0-dev.sha${COMMIT_SHA:0:12}"
|
|
CHART_VERSION="${chart_version}" ./deploy.sh
|
|
kubectl --namespace gramps rollout restart deployment/grampsweb deployment/grampsweb-celery
|
|
kubectl --namespace gramps rollout status deployment/grampsweb --timeout=10m
|
|
kubectl --namespace gramps rollout status deployment/grampsweb-celery --timeout=10m
|
|
kubectl --namespace gramps rollout status statefulset/postgresql --timeout=10m
|
|
kubectl --namespace gramps rollout status statefulset/valkey-primary --timeout=10m
|