116 lines
4.2 KiB
YAML
116 lines
4.2 KiB
YAML
name: Build Hugo
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
REGISTRY: tea.ahmza.com
|
|
IMAGE_NAME: ${{ gitea.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.GITEATOKEN }}
|
|
|
|
# QEMU deliberately omitted.
|
|
#
|
|
# Hugo runs on BUILDPLATFORM in the Dockerfile, so the static site is
|
|
# built natively on the runner. The final amd64/arm64 stages only copy
|
|
# the resulting static files into the target-platform SWS image.
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64, linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
|
|
steps:
|
|
- name: Pre-flight - verify VPN prerequisites
|
|
# NetBird brings up a WireGuard interface, which needs a TUN device and
|
|
# NET_ADMIN inside the job container. Without them, `netbird up` hangs
|
|
# ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
|
|
# failure is obvious and points at the fix (runner config.yaml).
|
|
run: |
|
|
echo "::group::NetBird prerequisites"
|
|
if [ -e /dev/net/tun ]; then
|
|
echo "OK: /dev/net/tun present"
|
|
else
|
|
echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
|
|
exit 1
|
|
fi
|
|
if command -v capsh >/dev/null 2>&1; then
|
|
capsh --print | grep -q 'cap_net_admin' \
|
|
&& echo "OK: NET_ADMIN present" \
|
|
|| echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
|
|
else
|
|
echo "note: capsh unavailable, skipping NET_ADMIN check"
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
- name: Netbird Connect
|
|
id: netbird
|
|
timeout-minutes: 3
|
|
uses: Alemiz112/netbird-connect@v1
|
|
with:
|
|
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
hostname: 'gitea-actions-blog'
|
|
management-url: ${{ secrets.NETBIRD_URL }}
|
|
|
|
- name: NetBird status
|
|
# Surface the actual peer/route state in the log and hard-assert that
|
|
# the management connection is up before attempting any deploys.
|
|
run: |
|
|
echo "::group::netbird status"
|
|
sudo netbird status --detail || true
|
|
echo "::endgroup::"
|
|
sudo netbird status | grep -q 'Management: Connected' \
|
|
&& echo "NetBird management connected." \
|
|
|| { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
|
|
|
|
- name: Deploy to talos-prod
|
|
uses: actions-hub/kubectl@v1.36.2
|
|
env:
|
|
KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
|
|
with:
|
|
args: get pods
|
|
|
|
- name: NetBird diagnostics & disconnect
|
|
# Runs even on failure: captures final state for debugging and tears the
|
|
# peer down so stale 'gitea-actions-blog' peers don't pile up.
|
|
if: always()
|
|
run: |
|
|
echo "::group::final netbird status"
|
|
sudo netbird status --detail || echo "netbird unavailable"
|
|
echo "::endgroup::"
|
|
sudo netbird down || true
|