peetandClaude Fable 5
0807dc6434
- podman-build-publish: reverted to pure build+push (v8 behavior) — the Trivy gate briefly embedded in v10 moves to an explicit action instead. - trivy-scan (new): scans a registry image ref, fails on fixable HIGH/CRITICAL findings; jobs pin it to amd64 runners. - podman-promote (new): server-side retag via skopeo copy --all — releases promote the scanned sha-<commit> candidate instead of rebuilding. - deploy-prod (new): shared deploy body for the *.podman repos (with the BatchMode/IdentitiesOnly ssh flags only two of the four copies had). - README: documents the standard build.yml/release.yml pipeline; refs standardized on public/actions. Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
67 lines
2.2 KiB
YAML
67 lines
2.2 KiB
YAML
name: Deploy Prod
|
|
description: >
|
|
Deploy a commit of a *.podman infrastructure repo on its production host.
|
|
Runs on that host's dedicated deploy runner (gitea-runner-deploy image):
|
|
installs the deployment SSH key, reads the mounted deploy-target env file,
|
|
and pipes the runner image's deploy-prod.sh to the host over SSH. Host key
|
|
verification uses the known_hosts file mounted into the deploy runner.
|
|
|
|
inputs:
|
|
deploy-target-file:
|
|
description: >
|
|
Path of the mounted deploy target env file, for example
|
|
/run/noctrl/prod-deploy-target.env. Must define REPO_DIR, PROD_HOST,
|
|
PROD_USER, PROD_PORT.
|
|
required: true
|
|
ssh-key-b64:
|
|
description: Base64-encoded private SSH deploy key (PROD_DEPLOY_SSH_KEY secret).
|
|
required: true
|
|
target-sha:
|
|
description: Commit SHA to deploy (normally github.sha).
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: install-key
|
|
shell: bash
|
|
env:
|
|
SSH_KEY_B64: ${{ inputs.ssh-key-b64 }}
|
|
run: |
|
|
set -euo pipefail
|
|
: "${SSH_KEY_B64:?missing ssh-key-b64 input (PROD_DEPLOY_SSH_KEY secret)}"
|
|
install -d -m 0700 ~/.ssh
|
|
printf '%s' "${SSH_KEY_B64}" | base64 -d > ~/.ssh/id_ed25519
|
|
chmod 0600 ~/.ssh/id_ed25519
|
|
ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
|
|
|
|
- id: deploy
|
|
shell: bash
|
|
env:
|
|
TARGET_SHA: ${{ inputs.target-sha }}
|
|
DEPLOY_TARGET_FILE: ${{ inputs.deploy-target-file }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [[ ! -f "${DEPLOY_TARGET_FILE}" ]]; then
|
|
echo "missing mounted deploy target file: ${DEPLOY_TARGET_FILE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
set -a
|
|
. "${DEPLOY_TARGET_FILE}"
|
|
set +a
|
|
|
|
: "${REPO_DIR:?missing REPO_DIR in ${DEPLOY_TARGET_FILE}}"
|
|
: "${PROD_HOST:?missing PROD_HOST in ${DEPLOY_TARGET_FILE}}"
|
|
: "${PROD_USER:?missing PROD_USER in ${DEPLOY_TARGET_FILE}}"
|
|
: "${PROD_PORT:?missing PROD_PORT in ${DEPLOY_TARGET_FILE}}"
|
|
|
|
ssh \
|
|
-o BatchMode=yes \
|
|
-o IdentitiesOnly=yes \
|
|
-i ~/.ssh/id_ed25519 \
|
|
-p "${PROD_PORT}" "${PROD_USER}@${PROD_HOST}" \
|
|
"REPO_DIR='${REPO_DIR}' bash -s -- '${TARGET_SHA}'" \
|
|
< /usr/local/bin/deploy-prod.sh
|