131 lines
4.7 KiB
YAML
131 lines
4.7 KiB
YAML
name: build-and-release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- high-performance
|
|
|
|
concurrency:
|
|
group: frontend-solid-build-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: docker-ready
|
|
env:
|
|
DOCKER_HOST: tcp://127.0.0.1:2375
|
|
DOCKER_BUILDKIT: "1"
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Docker Buildx
|
|
run: |
|
|
set -euo pipefail
|
|
for attempt in $(seq 1 30); do
|
|
if docker version >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
docker version
|
|
docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
|
|
docker buildx inspect --bootstrap
|
|
|
|
- name: Login to registry
|
|
env:
|
|
REGISTRY_HOST: ${{ secrets.REGISTRY_HOST || 'ci.nxtgauge.com' }}
|
|
REGISTRY_NAMESPACE: ${{ secrets.REGISTRY_NAMESPACE || 'ashwin' }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$REGISTRY_HOST"
|
|
printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
|
|
|
|
- name: Build and push image
|
|
env:
|
|
REGISTRY_HOST: ${{ secrets.REGISTRY_HOST || 'ci.nxtgauge.com' }}
|
|
REGISTRY_NAMESPACE: ${{ secrets.REGISTRY_NAMESPACE || 'ashwin' }}
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
metadata_file="/tmp/frontend-solid-metadata.json"
|
|
image_ref="$REGISTRY_HOST/$REGISTRY_NAMESPACE/nxtgauge-frontend-solid:$SHA"
|
|
|
|
docker buildx build --push \
|
|
--metadata-file "$metadata_file" \
|
|
-f Dockerfile \
|
|
-t "$image_ref" \
|
|
.
|
|
|
|
digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
|
|
test -n "$digest"
|
|
printf '%s@%s\n' "$REGISTRY_HOST/$REGISTRY_NAMESPACE/nxtgauge-frontend-solid" "$digest" > /tmp/frontend-solid-image-ref.txt
|
|
|
|
- name: Prune old SHA tags
|
|
if: success()
|
|
continue-on-error: true
|
|
env:
|
|
REGISTRY_HOST: ${{ secrets.REGISTRY_HOST || 'ci.nxtgauge.com' }}
|
|
REGISTRY_NAMESPACE: ${{ secrets.REGISTRY_NAMESPACE || 'ashwin' }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
python3 .forgejo/scripts/registry_prune.py \
|
|
--registry "$REGISTRY_HOST" \
|
|
--repo "$REGISTRY_NAMESPACE/nxtgauge-frontend-solid" \
|
|
--username "$REGISTRY_USERNAME" \
|
|
--password "$REGISTRY_PASSWORD" \
|
|
--keep 2
|
|
|
|
- name: Update GitOps release
|
|
env:
|
|
GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
|
|
GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
|
|
GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
|
|
GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
|
|
# The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub.
|
|
# GITEOPS_REPO/GITEOPS_SSH_KEY were never configured as repo
|
|
# secrets; use GITOPS_PAT instead, matching backend-rust.
|
|
GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
|
|
|
|
GITEOPS_DIR=$(mktemp -d)
|
|
git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITEOPS_DIR"
|
|
cd "$GITEOPS_DIR"
|
|
|
|
image_ref="$(cat /tmp/frontend-solid-image-ref.txt)"
|
|
|
|
for attempt in 1 2 3 4 5; do
|
|
git checkout "$GITOPS_BRANCH"
|
|
./scripts/set-app-release.sh frontend-solid "$image_ref"
|
|
|
|
if git diff --quiet; then
|
|
echo "GitOps repo already up to date."
|
|
exit 0
|
|
fi
|
|
|
|
git config user.name "forgejo-actions[bot]"
|
|
git config user.email "forgejo-actions@ci.nxtgauge.com"
|
|
git add apps scripts/set-app-release.sh
|
|
git commit -m "chore(gitops): deploy frontend-solid@${SHA}"
|
|
|
|
if git push origin "HEAD:$GITOPS_BRANCH"; then
|
|
exit 0
|
|
fi
|
|
|
|
echo "Push rejected (attempt $attempt), pulling latest and retrying..."
|
|
git fetch origin "$GITOPS_BRANCH"
|
|
git reset --hard "origin/$GITOPS_BRANCH"
|
|
done
|
|
|
|
echo "Failed to push GitOps update after retries" >&2
|
|
exit 1
|