CodeGit
f62dac1b7c
ImageUpdateAutomation's Setters strategy never actually commits despite a verified-correct $imagepolicy marker, correct ImagePolicy resolution, and a from-scratch Flux bootstrap against a fresh controller - root cause unresolved after extensive investigation. Add a second job that commits the built tag straight to deployment.yaml using git (the kaniko image has no git/node, hence the separate alpine/git container), passing the tag via job outputs from the build step. ImageRepository/ImagePolicy stay in place for visibility into available tags even though nothing consumes their resolution anymore. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y4YNpuC2bgT224suQLLJ7B
84 lines
3.9 KiB
YAML
84 lines
3.9 KiB
YAML
name: build-hello-app
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "apps/hello-app/src/**"
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: docker
|
|
# kaniko builds the image itself with no daemon and no special host
|
|
# privileges, so the runner host only ever needs a rootless Podman
|
|
# socket to launch this container — never docker.sock, never sudo.
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:debug
|
|
options: --entrypoint ""
|
|
outputs:
|
|
tag: ${{ steps.build.outputs.tag }}
|
|
steps:
|
|
# actions/checkout@v4 needs a Node.js runtime, which this minimal
|
|
# kaniko image doesn't have (no package manager to add it either) -
|
|
# fetch the repo as a plain tarball from Forgejo's archive endpoint
|
|
# instead, using the tools that are actually present (wget, tar).
|
|
- name: Checkout (manual - no git/node in this image)
|
|
run: |
|
|
echo "workspace is: ${{ github.workspace }}"
|
|
mkdir -p "${{ github.workspace }}"
|
|
wget --header="Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
|
|
-O "${{ github.workspace }}/source.tar.gz" \
|
|
"https://git.boglabob.com/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
|
|
tar -xzf "${{ github.workspace }}/source.tar.gz" --strip-components=1 -C "${{ github.workspace }}"
|
|
rm "${{ github.workspace }}/source.tar.gz"
|
|
|
|
- name: Write registry auth
|
|
run: |
|
|
mkdir -p /kaniko/.docker
|
|
AUTH=$(printf '%s:%s' "${{ vars.FORGEJO_USER }}" "${{ secrets.FORGEJO_TOKEN }}" | base64 -w0)
|
|
printf '{"auths":{"git.boglabob.com":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
|
|
|
|
- name: Inject build info
|
|
run: |
|
|
SHORT_SHA="${GITHUB_SHA::7}"
|
|
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
sed -i "s/__GIT_SHA__/$SHORT_SHA/; s/__BUILD_TIME__/$BUILD_TIME/" apps/hello-app/src/index.html
|
|
|
|
- name: Build and push
|
|
id: build
|
|
run: |
|
|
TAG="main-${GITHUB_SHA::7}-$(date +%s)"
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
/kaniko/executor \
|
|
--context="${{ github.workspace }}/apps/hello-app/src" \
|
|
--dockerfile="${{ github.workspace }}/apps/hello-app/src/Dockerfile" \
|
|
--destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:$TAG" \
|
|
--destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:latest"
|
|
|
|
# Flux's ImageUpdateAutomation (image-automation.yaml) should be doing this
|
|
# commit-back step instead - its $imagepolicy Setters marker in
|
|
# deployment.yaml is correctly formatted and verified against Flux's own
|
|
# docs, ImagePolicy correctly resolves each new tag, and every other part
|
|
# of the chain works, but it never actually commits (always reports
|
|
# "repository up-to-date" with nothing to change) for reasons that
|
|
# resisted a lengthy investigation - even a from-scratch Flux bootstrap
|
|
# against a fresh controller instance didn't change the behavior.
|
|
# ImageRepository/ImagePolicy are kept for visibility into what tag is
|
|
# available; this job does the actual commit as a working substitute.
|
|
update-deployment-tag:
|
|
needs: build-and-push
|
|
runs-on: docker
|
|
container:
|
|
image: alpine/git
|
|
steps:
|
|
- name: Commit new image tag to deployment.yaml
|
|
run: |
|
|
git config --global user.email "flux@boglabob.com"
|
|
git config --global user.name "fluxcdbot"
|
|
git clone "https://${{ vars.FORGEJO_USER }}:${{ secrets.FORGEJO_TOKEN }}@git.boglabob.com/${{ github.repository }}.git" repo
|
|
cd repo
|
|
TAG="${{ needs.build-and-push.outputs.tag }}"
|
|
sed -i "s|\(image: git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:\)[^ ]*|\1$TAG|" apps/hello-app/deployment.yaml
|
|
git add apps/hello-app/deployment.yaml
|
|
git diff --cached --quiet || git commit -m "chore(hello-app): auto-update image to $TAG"
|
|
git push
|