dev
9980dafc6d
Before committing and pushing, query the Gitea API for open PRs in the apps repo. If any open PR modifies the same kustomization.yaml path and its diff contains the target tag, exit 0 — the PR is the intended review gate and the direct push would bypass it. Fails open on API errors so an outage does not block all deploys. Fixes bug-nxhza9j2atqk
66 lines
2.7 KiB
Markdown
66 lines
2.7 KiB
Markdown
# action/image-deploy
|
|
|
|
Composite Gitea Action that pins an image tag in `fritzlab/apps` via
|
|
`kustomize edit set image`, validates the rendered manifests, and pushes
|
|
to apps-repo `main`. Retries on push conflict.
|
|
|
|
This is the standard "deploy" step for image producers (chrony, profiles,
|
|
runner). After `image-build` + `image-push`, this writes the new tag into
|
|
the GitOps target so ArgoCD can sync it.
|
|
|
|
## Usage
|
|
|
|
```yaml
|
|
- uses: actions/checkout@v4
|
|
- uses: https://code.fritzlab.net/action/image-build@v1
|
|
with:
|
|
image: code.fritzlab.net/fritzlab/chrony
|
|
smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v
|
|
- uses: https://code.fritzlab.net/action/image-push@v1
|
|
with:
|
|
image: code.fritzlab.net/fritzlab/chrony
|
|
token: ${{ secrets.CI_BOT_TOKEN }}
|
|
org: fritzlab
|
|
name: chrony
|
|
- uses: https://code.fritzlab.net/action/image-deploy@v1
|
|
with:
|
|
image: code.fritzlab.net/fritzlab/chrony
|
|
path: sjc001/infra/chrony/manifests
|
|
token: ${{ secrets.CI_BOT_TOKEN }}
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Name | Required | Default | Description |
|
|
|---|---|---|---|
|
|
| `image` | yes | — | Full image name without tag. Must match an entry already in the target `kustomization.yaml` `images:` block. |
|
|
| `tag` | no | `github.run_number` | Tag to pin. |
|
|
| `path` | yes | — | Path inside `fritzlab/apps` to the manifests dir (e.g. `sjc001/infra/chrony/manifests`). |
|
|
| `token` | yes | — | `CI_BOT_TOKEN` with write access to `fritzlab/apps`. |
|
|
| `apps-repo` | no | `code.fritzlab.net/fritzlab/apps` | Apps repo URL without protocol. |
|
|
| `message` | no | `deploy <name> #<tag>` | Commit message override. |
|
|
|
|
## Behavior
|
|
|
|
1. Shallow-clone `fritzlab/apps` to a temp dir.
|
|
2. `cd <path>` and run `kustomize edit set image <image>=<image>:<tag>`.
|
|
3. Run `kustomize build .` to validate the manifests still render. **Fails the
|
|
workflow if validation breaks** — apps repo is left untouched.
|
|
4. If no diff (apps repo already on this tag): exit 0 silently.
|
|
5. Query the Gitea API for open PRs in the apps repo. If any open PR modifies
|
|
the same `kustomization.yaml` and its patch contains the target tag, exit 0
|
|
— the PR is the intended control gate and the direct push is skipped. Fails
|
|
open on API errors (push proceeds) to avoid blocking deploys during an
|
|
outage.
|
|
6. Otherwise commit + push to `main`. On push rejection (concurrent CI race),
|
|
`git pull --rebase` and retry up to 3 times with linear backoff.
|
|
|
|
## Notes
|
|
|
|
- The image entry must already exist in `kustomization.yaml`. This action only
|
|
updates the tag; it does not add or remove image entries. To switch image
|
|
registry paths, edit `kustomization.yaml` by hand once, commit, then let CI
|
|
resume.
|
|
- `git diff --quiet` skip means re-running the same CI run (or an earlier run)
|
|
is idempotent.
|