homelab-updaterandClaude Opus 5.5
136f9d2fb0
A deploy workflow, started only by hand (or through the API) and only from master, pulls the chosen image (release tag, sha or latest) and runs that image's own update.sh against VM103's compose directory through the Docker socket. update.sh now copies the database through the running server first, installs the image's compose.yaml and update.sh with --install, and restores the previous compose file together with the previous image when the new version does not come up. CI also builds release tags v*. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
2.7 KiB
YAML
56 lines
2.7 KiB
YAML
# CI: `npm run check` on every push; on master/foundations and on release tags (v…) also build the image and push it to
|
|
# the Gitea registry. It does not deploy: that is the deploy workflow, started by hand (docs/DEPLOY.md).
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
# Job containers cannot reach Gitea through traefik (its ipwhitelist does not cover the runner networks),
|
|
# so checkout goes straight to the port Gitea publishes on VM103.
|
|
GITEA_INTERNAL_URL: http://192.168.0.139:13080
|
|
REGISTRY: git.mariuszpacek.pl
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:24-bookworm@sha256:6dac556d980b7f0e5498d08f08cee0ca67798b4ad6c23964a9214920e67758d0
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
github-server-url: ${{ env.GITEA_INTERNAL_URL }}
|
|
# The function-runtime sandbox tests need bubblewrap; the runtime refuses to run functions without it.
|
|
- run: apt-get update -qq && apt-get install -y -qq --no-install-recommends bubblewrap >/dev/null && bwrap --version
|
|
- run: npm ci
|
|
- run: npm run check
|
|
|
|
publish:
|
|
needs: check
|
|
if: github.ref_name == 'master' || github.ref_name == 'foundations' || startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
github-server-url: ${{ env.GITEA_INTERNAL_URL }}
|
|
- name: Docker CLI available (talks to the VM daemon through the mounted socket)
|
|
run: command -v docker >/dev/null || (apt-get update -qq && apt-get install -y -qq docker.io >/dev/null); docker version --format '{{.Client.Version}} -> {{.Server.Version}}'
|
|
- name: Build and push
|
|
env:
|
|
REGISTRY_USER: ${{ github.repository_owner }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
BUILD_NUMBER: ${{ github.run_number }}
|
|
run: |
|
|
set -euo pipefail
|
|
image="${REGISTRY}/${GITHUB_REPOSITORY_OWNER}/homelab-upgrade"
|
|
branch="${GITHUB_REF_NAME//\//-}"
|
|
refs=("${image}:${GITHUB_SHA}" "${image}:${branch}")
|
|
[ "${GITHUB_REF_NAME}" = master ] && refs+=("${image}:latest")
|
|
printf '%s' "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
tag_args=(); for ref in "${refs[@]}"; do tag_args+=(-t "${ref}"); done
|
|
docker build --build-arg "REVISION=${GITHUB_SHA}" --build-arg "BRANCH=${GITHUB_REF_NAME}" --build-arg "BUILD_NUMBER=${BUILD_NUMBER}" "${tag_args[@]}" .
|
|
# Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
|
|
for ref in "${refs[@]}"; do docker push "${ref}"; done
|
|
docker logout "${REGISTRY}"
|