homelab-updaterandClaude Opus 5.5
7131ca9b12
Every CI build and deploy left a 1.2 GB image of this app on the VM and the build cache kept growing, until the root disk was full and apt in CI failed. After a good deploy update.sh keeps the running image, the previous one and the three newest; the publish job prunes build cache older than two days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.8 KiB
YAML
58 lines
2.8 KiB
YAML
# CI: `npm run check` on every push; on master/foundations and on release tags (v…) also build the image and push it to
|
|
# the Gitea registry. It does not deploy: that is the deploy workflow, started by hand (docs/DEPLOY.md).
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
# Job containers cannot reach Gitea through traefik (its ipwhitelist does not cover the runner networks),
|
|
# so checkout goes straight to the port Gitea publishes on VM103.
|
|
GITEA_INTERNAL_URL: http://192.168.0.139:13080
|
|
REGISTRY: git.mariuszpacek.pl
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:24-bookworm@sha256:6dac556d980b7f0e5498d08f08cee0ca67798b4ad6c23964a9214920e67758d0
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
github-server-url: ${{ env.GITEA_INTERNAL_URL }}
|
|
# The function-runtime sandbox tests need bubblewrap; the runtime refuses to run functions without it.
|
|
- run: apt-get update -qq && apt-get install -y -qq --no-install-recommends bubblewrap >/dev/null && bwrap --version
|
|
- run: npm ci
|
|
- run: npm run check
|
|
|
|
publish:
|
|
needs: check
|
|
if: github.ref_name == 'master' || github.ref_name == 'foundations' || startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
github-server-url: ${{ env.GITEA_INTERNAL_URL }}
|
|
- name: Docker CLI available (talks to the VM daemon through the mounted socket)
|
|
run: command -v docker >/dev/null || (apt-get update -qq && apt-get install -y -qq docker.io >/dev/null); docker version --format '{{.Client.Version}} -> {{.Server.Version}}'
|
|
- name: Build and push
|
|
env:
|
|
REGISTRY_USER: ${{ github.repository_owner }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
BUILD_NUMBER: ${{ github.run_number }}
|
|
run: |
|
|
set -euo pipefail
|
|
image="${REGISTRY}/${GITHUB_REPOSITORY_OWNER}/homelab-upgrade"
|
|
branch="${GITHUB_REF_NAME//\//-}"
|
|
refs=("${image}:${GITHUB_SHA}" "${image}:${branch}")
|
|
[ "${GITHUB_REF_NAME}" = master ] && refs+=("${image}:latest")
|
|
printf '%s' "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
tag_args=(); for ref in "${refs[@]}"; do tag_args+=(-t "${ref}"); done
|
|
docker build --build-arg "REVISION=${GITHUB_SHA}" --build-arg "BRANCH=${GITHUB_REF_NAME}" --build-arg "BUILD_NUMBER=${BUILD_NUMBER}" "${tag_args[@]}" .
|
|
# Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
|
|
for ref in "${refs[@]}"; do docker push "${ref}"; done
|
|
docker logout "${REGISTRY}"
|
|
# Builds run on the VM's daemon: without this its build cache grows until the disk is full.
|
|
docker builder prune -f --filter until=48h >/dev/null 2>&1 || true
|