0xWheatyz
98807884b1
Validate Flux manifests / kustomize-build (pull_request) Successful in 22s
The auto GITEA_TOKEN has no package-registry scope, so docker login to gitea.leeworks.dev returned 'unauthorized'. Use a dedicated PAT (REGISTRY_TOKEN, write:package) with the token-owner username. Helper script now mints both SIBLING_REPOS_TOKEN and REGISTRY_TOKEN from one password prompt.
124 lines
4.8 KiB
YAML
124 lines
4.8 KiB
YAML
# Gitea Actions: Aggregate openapi.yaml specs + trigger docs-site build
|
|
# Closes leeworks-agents/api-company#10
|
|
|
|
name: Build Docs Site
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
schedule:
|
|
# Re-build daily at 02:00 UTC to pick up spec changes
|
|
- cron: '0 2 * * *'
|
|
|
|
jobs:
|
|
aggregate-specs:
|
|
name: Aggregate OpenAPI Specs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout api-company
|
|
uses: actions/checkout@v4
|
|
with:
|
|
path: api-company
|
|
|
|
# NOTE: cross-repo checkouts use SIBLING_REPOS_TOKEN, NOT the auto-injected
|
|
# GITEA_TOKEN. Gitea's automatic GITEA_TOKEN is scoped to THIS repo only,
|
|
# so checking out other repos fails with
|
|
# "Determining the default branch → not found". GITEA_TOKEN is also a
|
|
# reserved secret name that cannot be overridden, hence a separate secret.
|
|
# SIBLING_REPOS_TOKEN must be a PAT with read access to the API repos.
|
|
- name: Checkout zip-enrichment
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: leeworks-agents/zip-enrichment
|
|
token: ${{ secrets.SIBLING_REPOS_TOKEN }}
|
|
path: zip-enrichment
|
|
|
|
- name: Checkout holidays
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: leeworks-agents/holidays
|
|
token: ${{ secrets.SIBLING_REPOS_TOKEN }}
|
|
path: holidays
|
|
|
|
- name: Checkout air-quality
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: leeworks-agents/air-quality
|
|
token: ${{ secrets.SIBLING_REPOS_TOKEN }}
|
|
path: air-quality
|
|
|
|
- name: Checkout vin-decoder
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: leeworks-agents/vin-decoder
|
|
token: ${{ secrets.SIBLING_REPOS_TOKEN }}
|
|
path: vin-decoder
|
|
|
|
- name: Copy openapi.yaml specs into docs-site
|
|
run: |
|
|
mkdir -p api-company/docs-site/public/specs
|
|
cp zip-enrichment/openapi.yaml api-company/docs-site/public/specs/zip-enrichment.yaml
|
|
cp holidays/openapi.yaml api-company/docs-site/public/specs/holidays.yaml
|
|
cp air-quality/openapi.yaml api-company/docs-site/public/specs/air-quality.yaml
|
|
cp vin-decoder/openapi.yaml api-company/docs-site/public/specs/vin-decoder.yaml
|
|
echo "Specs copied:"
|
|
ls -la api-company/docs-site/public/specs/
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install docs-site dependencies
|
|
working-directory: api-company/docs-site
|
|
run: npm ci
|
|
|
|
- name: Build docs-site
|
|
working-directory: api-company/docs-site
|
|
run: npm run build
|
|
|
|
- name: Install Docker CLI
|
|
# The job container (node:20) ships no `docker` binary. The runner has a
|
|
# dind daemon (dind.enabled in the runner HelmRelease), reachable via
|
|
# DOCKER_HOST, so we only need the client. Install the static binary.
|
|
env:
|
|
DOCKER_CLI_VERSION: "27.3.1"
|
|
run: |
|
|
set -euxo pipefail
|
|
curl -fSL --retry 5 --retry-delay 3 --retry-all-errors \
|
|
-o /tmp/docker.tgz \
|
|
"https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_CLI_VERSION}.tgz"
|
|
tar -xzf /tmp/docker.tgz -C /tmp
|
|
install -m 0755 /tmp/docker/docker /usr/local/bin/docker
|
|
docker version --format '{{.Client.Version}}'
|
|
docker info >/dev/null # confirms the dind daemon is reachable
|
|
|
|
- name: Log in to container registry
|
|
# Use Gitea's built-in container registry (gitea.leeworks.dev), which
|
|
# has a valid Let's Encrypt cert. The standalone registry.leeworks.dev
|
|
# serves Traefik's default self-signed cert and fails TLS verification.
|
|
#
|
|
# Auth uses REGISTRY_TOKEN, NOT the auto GITEA_TOKEN: the auto token has
|
|
# no package-registry scope, and the registry requires the username to
|
|
# match the token owner. REGISTRY_TOKEN must be a PAT (owner: 0xWheatyz)
|
|
# with write:package + read:package scope.
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.leeworks.dev \
|
|
-u 0xWheatyz --password-stdin
|
|
|
|
- name: Build and push docs-site image
|
|
working-directory: api-company/docs-site
|
|
run: |
|
|
IMAGE="gitea.leeworks.dev/leeworks-agents/docs-site"
|
|
SHA="${{ gitea.sha }}"
|
|
docker build -t "$IMAGE:$SHA" -t "$IMAGE:latest" .
|
|
docker push "$IMAGE:$SHA"
|
|
docker push "$IMAGE:latest"
|
|
echo "Pushed $IMAGE:$SHA"
|
|
|
|
- name: Trigger Flux reconcile (optional)
|
|
run: |
|
|
echo "Image pushed. Flux will detect new tag via image automation and re-deploy docs-site."
|
|
echo "If image automation is not configured, manually run: flux reconcile helmrelease docs-site -n docs-site"
|