ahmza
b7145e1323
The deploy pipeline works end-to-end now (Gimli deploys successfully), so the diagnostic step used to trace the WireGuard/TUN issue is no longer needed. RPIC continue-on-error is kept until the cluster returns.
87 lines
2.8 KiB
YAML
87 lines
2.8 KiB
YAML
name: Build Hugo
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
REGISTRY: tea.ahmza.com
|
|
IMAGE_NAME: ${{ gitea.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.GITEATOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64, linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
# Registry-backed build cache. The GitHub-hosted 'gha' cache is not
|
|
# reachable from self-hosted Gitea runners, so store the cache as a
|
|
# dedicated tag in the same registry instead.
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
|
|
steps:
|
|
- name: Netbird Connect
|
|
uses: Alemiz112/netbird-connect@v1
|
|
with:
|
|
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
hostname: 'gitea-actions-blog'
|
|
management-url: ${{ secrets.NETBIRD_URL }}
|
|
|
|
- name: Deploy to RPIC-Cluster
|
|
# RPIC cluster is temporarily out of service. Don't let its failure
|
|
# block the Gimli deploy or fail the whole job. Remove this line once
|
|
# the cluster is back.
|
|
continue-on-error: true
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.RPIC_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.RPIC_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
|
|
|
|
- name: Deploy to Gimli
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.GIMLI_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.GIMLI_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'docker compose down && docker compose pull && docker compose up -d'
|