feat(actions): add bump-stacks and deploy-stack composite actions
bump-stacks: invoked by stack-repo CI after a successful image push. Clones libretech/gitops-sandbox, mutates stacks.yml to pin the new short sha for the named stack, commits + pushes back. Idempotent — exits 0 with a no-op notice when the sha is already pinned. Retries up to 3× on non-fast-forward to absorb concurrent bumps. deploy-stack: invoked by stack-repo deploy.yml (workflow_dispatch). SSHes to netcup with a stack-scoped key, writes a .env.deploy file pinning <STACK>_IMAGE, runs 'compose pull && compose up -d'. Writes /srv/<stack>/.deployed for drift checks.
This commit is contained in:
100
.gitea/actions/bump-stacks/action.yml
Normal file
100
.gitea/actions/bump-stacks/action.yml
Normal file
@@ -0,0 +1,100 @@
|
||||
name: bump-stacks
|
||||
description: |
|
||||
Push the new short sha for a stack into libretech/gitops-sandbox/stacks.yml.
|
||||
Idempotent: a no-op when the sha is already pinned.
|
||||
|
||||
inputs:
|
||||
stack:
|
||||
description: stack name (key under `stacks:` in stacks.yml)
|
||||
required: true
|
||||
sha:
|
||||
description: short git sha (7 chars) of the image tag just pushed
|
||||
required: true
|
||||
bot_token:
|
||||
description: PAT with write:repository on libretech/gitops-sandbox
|
||||
required: true
|
||||
run_number:
|
||||
description: optional Gitea Actions run_number (informational only)
|
||||
required: false
|
||||
default: "0"
|
||||
sandbox_repo:
|
||||
description: orchestrator repo slug
|
||||
required: false
|
||||
default: libretech/gitops-sandbox
|
||||
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- shell: bash
|
||||
env:
|
||||
STACK: ${{ inputs.stack }}
|
||||
SHA: ${{ inputs.sha }}
|
||||
RUN: ${{ inputs.run_number }}
|
||||
BOT_TOKEN: ${{ inputs.bot_token }}
|
||||
SANDBOX_REPO: ${{ inputs.sandbox_repo }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
WORK=$(mktemp -d)
|
||||
cd "$WORK"
|
||||
git config --global user.name "gitops-bot"
|
||||
git config --global user.email "gitops-bot@librete.ch"
|
||||
|
||||
REPO_URL="https://oauth2:${BOT_TOKEN}@git.librete.ch/${SANDBOX_REPO}.git"
|
||||
# Retry up to 3 times on non-fast-forward to absorb concurrent bumps.
|
||||
for attempt in 1 2 3; do
|
||||
rm -rf clone
|
||||
git clone --depth=2 "$REPO_URL" clone
|
||||
cd clone
|
||||
bun --version >/dev/null # baked into runner-image
|
||||
|
||||
# Bun-native edit: load yaml, mutate, write back. Preserves order
|
||||
# because the `yaml` package keeps key positions on round-trip.
|
||||
cat > /tmp/bump.js <<'JS'
|
||||
import { readFileSync, writeFileSync } from "node:fs";
|
||||
import { parseDocument } from "yaml";
|
||||
|
||||
const [, , stack, sha, run] = process.argv;
|
||||
const doc = parseDocument(readFileSync("stacks.yml", "utf8"));
|
||||
const stacks = doc.get("stacks");
|
||||
if (!stacks?.has(stack)) {
|
||||
console.error(`stack '${stack}' not in stacks.yml`);
|
||||
process.exit(2);
|
||||
}
|
||||
const node = stacks.get(stack);
|
||||
const oldSha = node.get("sha");
|
||||
if (String(oldSha) === String(sha)) {
|
||||
console.log(`no-op: ${stack} already at sha=${sha}`);
|
||||
process.exit(10); // sentinel for caller
|
||||
}
|
||||
node.set("sha", sha);
|
||||
node.set("run", Number(run));
|
||||
writeFileSync("stacks.yml", doc.toString());
|
||||
console.log(`bumped ${stack}: ${oldSha} → ${sha}`);
|
||||
JS
|
||||
|
||||
# Install deps inside clone (cached after first run).
|
||||
[ -f package.json ] || echo '{"type":"module","dependencies":{"yaml":"^2.6.1"}}' > package.json
|
||||
bun install --frozen-lockfile 2>/dev/null || bun install
|
||||
|
||||
set +e
|
||||
bun /tmp/bump.js "$STACK" "$SHA" "$RUN"
|
||||
rc=$?
|
||||
set -e
|
||||
if [ "$rc" = "10" ]; then
|
||||
echo "::notice::stacks.yml already at sha=$SHA, no commit"
|
||||
exit 0
|
||||
fi
|
||||
[ "$rc" = "0" ] || exit "$rc"
|
||||
|
||||
git add stacks.yml
|
||||
git commit -m "bump(${STACK}): sha=${SHA} run=${RUN}"
|
||||
if git push origin main; then
|
||||
echo "::notice::pushed bump for ${STACK} to ${SANDBOX_REPO}"
|
||||
exit 0
|
||||
fi
|
||||
echo "push rejected, attempt ${attempt}/3"
|
||||
cd ..
|
||||
sleep $((attempt * 3))
|
||||
done
|
||||
echo "::error::could not push bump after 3 attempts"
|
||||
exit 1
|
||||
76
.gitea/actions/deploy-stack/action.yml
Normal file
76
.gitea/actions/deploy-stack/action.yml
Normal file
@@ -0,0 +1,76 @@
|
||||
name: deploy-stack
|
||||
description: |
|
||||
SSH to netcup, pull the pinned image, restart the stack via docker compose.
|
||||
Each stack repo holds its own SSH key; the netcup `authorized_keys` line
|
||||
is forced-command-locked to that stack's directory.
|
||||
|
||||
inputs:
|
||||
stack:
|
||||
description: stack name (cosmetic, used in deploy-marker file)
|
||||
required: true
|
||||
target:
|
||||
description: absolute path on netcup, e.g. /srv/gitops-hello
|
||||
required: true
|
||||
image:
|
||||
description: full image ref including tag, e.g. git.librete.ch/libretech/gitops-hello:sha-abc1234
|
||||
required: true
|
||||
ssh_key:
|
||||
description: private SSH key (PEM, multi-line ok)
|
||||
required: true
|
||||
ssh_host:
|
||||
description: netcup hostname, e.g. cloud.librete.ch
|
||||
required: true
|
||||
ssh_user:
|
||||
description: netcup user, e.g. tengo
|
||||
required: true
|
||||
registry:
|
||||
description: registry hostname for docker login
|
||||
required: true
|
||||
registry_user:
|
||||
description: registry username
|
||||
required: true
|
||||
registry_pass:
|
||||
description: registry PAT
|
||||
required: true
|
||||
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- shell: bash
|
||||
env:
|
||||
STACK: ${{ inputs.stack }}
|
||||
TARGET: ${{ inputs.target }}
|
||||
IMAGE: ${{ inputs.image }}
|
||||
SSH_KEY: ${{ inputs.ssh_key }}
|
||||
SSH_HOST: ${{ inputs.ssh_host }}
|
||||
SSH_USER: ${{ inputs.ssh_user }}
|
||||
REGISTRY: ${{ inputs.registry }}
|
||||
REGISTRY_USER: ${{ inputs.registry_user }}
|
||||
REGISTRY_PASS: ${{ inputs.registry_pass }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
umask 077
|
||||
mkdir -p ~/.ssh
|
||||
printf '%s\n' "$SSH_KEY" > ~/.ssh/id_deploy
|
||||
chmod 600 ~/.ssh/id_deploy
|
||||
ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
||||
|
||||
SSH="ssh -i ~/.ssh/id_deploy -o BatchMode=yes ${SSH_USER}@${SSH_HOST}"
|
||||
|
||||
# The forced-command on netcup's side is parameterised by the
|
||||
# original command, so we send a single-line script via stdin.
|
||||
$SSH bash -s <<EOF
|
||||
set -euo pipefail
|
||||
cd "$TARGET"
|
||||
echo "$REGISTRY_PASS" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
|
||||
# Pin the image for compose via a stack-local .env file.
|
||||
# HELLO_IMAGE / <STACK_UPPER>_IMAGE etc. — generic env name pattern.
|
||||
STACK_UPPER=\$(echo "$STACK" | tr a-z A-Z)
|
||||
printf '%s_IMAGE=%s\n' "\$STACK_UPPER" "$IMAGE" > .env.deploy
|
||||
docker compose --env-file .env.deploy pull
|
||||
docker compose --env-file .env.deploy up -d
|
||||
# Write deploy marker — read by drift checks + observability.
|
||||
printf '%s\n' "image=$IMAGE" "deployed_at=\$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .deployed
|
||||
EOF
|
||||
|
||||
echo "::notice::deployed ${STACK}: ${IMAGE}"
|
||||
Reference in New Issue
Block a user