timka123
2aaa58af0b
tests / backend (push) Successful in 37s
tests / desktop (push) Successful in 21s
lint / ruff (push) Successful in 1m0s
tests / web (push) Successful in 32s
docker / image (push) Failing after 1m34s
tests / android-core (push) Successful in 7m13s
android / apk (push) Successful in 12m36s
99 lines
4.0 KiB
YAML
99 lines
4.0 KiB
YAML
# Build the backend + web image and push it to this Gitea's own registry.
|
|
#
|
|
# The image is the same one `docker compose` builds locally — one Dockerfile,
|
|
# two stages, Vite's output baked in and served from the same origin as the API.
|
|
# Tagged twice: `latest` for the deploy script to pull, and the short commit for
|
|
# every build to be nameable after the fact.
|
|
#
|
|
# Needs a runner that can reach a docker daemon. The compose service in
|
|
# `docker-compose.ci.yml` mounts the host's socket into the job container, which
|
|
# is the usual arrangement for a single-machine Gitea.
|
|
name: docker
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
tags: ["v*"]
|
|
|
|
# The built-in job token (`secrets.GITEA_TOKEN`) **cannot** publish packages on
|
|
# Gitea — `permissions:` has no effect on container pushes, and the job token is
|
|
# read-only there by design. Publishing therefore needs a personal access token
|
|
# with `package:write`, stored as REGISTRY_TOKEN. Without it the image is still
|
|
# built and smoke-tested, but not pushed; that keeps the build honest without
|
|
# failing every push on a repository that has not minted a token yet.
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
REGISTRY: git.timka.su
|
|
IMAGE: git.timka.su/timka123/kadence
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Check the daemon is reachable
|
|
run: docker version
|
|
|
|
- name: Log in to the Gitea registry
|
|
id: login
|
|
env:
|
|
# The username is only needed to pair with the token. Default it to the
|
|
# repository owner — the same account the image namespace belongs to —
|
|
# so a missing REGISTRY_USER secret does not fail the job with docker's
|
|
# unhelpful "username is empty".
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
|
|
# A personal access token with `package:write`. The built-in job token
|
|
# is not usable here: Gitea's job token is read-only for packages (its
|
|
# `permissions:` support does not cover the container registry yet),
|
|
# so falling back to it only produces a confusing 401.
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
|
|
echo "::warning::No REGISTRY_TOKEN (a personal access token with package:write) — the image will be built and smoke-tested but not pushed. Add it under Settings → Actions → Secrets to publish."
|
|
echo "push=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
printf '%s' "$REGISTRY_TOKEN" \
|
|
| docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
|
|
echo "push=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build
|
|
run: |
|
|
SHORT="$(git rev-parse --short HEAD)"
|
|
echo "SHORT=$SHORT" >> "$GITHUB_ENV"
|
|
docker build -t "$IMAGE:$SHORT" -t "$IMAGE:latest" .
|
|
|
|
- name: Smoke-test the image before it is published
|
|
run: |
|
|
# A tag nobody can run is worse than no tag. SQLite keeps this to one
|
|
# container: no database service, no network, no .env.
|
|
docker run -d --name kadence-smoke \
|
|
-e DATABASE_URL="sqlite:///./kadence.db" \
|
|
-e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
|
|
-p 18000:8000 "$IMAGE:$SHORT"
|
|
for _ in $(seq 1 30); do
|
|
if curl -fsS http://127.0.0.1:18000/api/health >/dev/null 2>&1; then
|
|
echo "healthy"; break
|
|
fi
|
|
sleep 2
|
|
done
|
|
curl -fsS http://127.0.0.1:18000/api/health
|
|
docker logs kadence-smoke | tail -20
|
|
docker rm -f kadence-smoke
|
|
|
|
- name: Push
|
|
if: steps.login.outputs.push == 'true'
|
|
run: |
|
|
docker push "$IMAGE:$SHORT"
|
|
docker push "$IMAGE:latest"
|
|
|
|
- name: Push the tag, when there is one
|
|
if: steps.login.outputs.push == 'true' && startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
VERSION="${GITHUB_REF#refs/tags/}"
|
|
docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"
|
|
docker push "$IMAGE:$VERSION"
|