Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
78 lines
3.1 KiB
YAML
78 lines
3.1 KiB
YAML
name: CI
|
|
# Runs on every PR and every push to main. The smoke-test job is the actual
|
|
# merge gate for this repo — it proves pack -> push -> publish -> apt-get
|
|
# works, not just that files parse. See tests/smoke-test.sh.
|
|
#
|
|
# paths-ignore + bot commits carrying [skip ci] (see release-image.yaml)
|
|
# exist to break the automation loop: an image release commits a new
|
|
# appVersion to main, which would otherwise re-trigger this workflow, which
|
|
# has nothing new to check.
|
|
on:
|
|
pull_request: {}
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'charts/aptly/Chart.yaml'
|
|
- 'CHANGELOG.md'
|
|
|
|
concurrency:
|
|
group: ci-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: hadolint (aptly-server)
|
|
uses: hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: images/aptly-server/Dockerfile
|
|
- name: hadolint (aptly-deb-builder)
|
|
uses: hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: images/aptly-deb-builder/Dockerfile
|
|
|
|
- name: shellcheck
|
|
run: |
|
|
docker run --rm -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x \
|
|
rootfs/usr/local/bin/aptly-* rootfs/usr/local/bin/lib/common.sh tests/smoke-test.sh
|
|
|
|
- uses: azure/setup-helm@v4.3.0
|
|
with:
|
|
version: ${{ vars.HELM_VERSION || '3.16.4' }}
|
|
- name: helm lint
|
|
run: helm lint charts/aptly
|
|
- name: helm template (every ci/*.yaml values file, plus defaults)
|
|
run: |
|
|
set -e
|
|
helm template test charts/aptly > /tmp/rendered-defaults.yaml
|
|
for f in charts/aptly/ci/*.yaml; do
|
|
helm template test charts/aptly -f "$f" > "/tmp/rendered-$(basename "$f" .yaml).yaml"
|
|
done
|
|
- name: kubeconform
|
|
run: |
|
|
docker run --rm -v /tmp:/tmp ghcr.io/yannh/kubeconform:latest \
|
|
-summary -strict -kubernetes-version 1.29.0 \
|
|
-schema-location default \
|
|
-schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
|
|
/tmp/rendered-*.yaml
|
|
- name: fail-guard regression check (proxy.enabled=false + Ingress/Gateway + non-open preset must abort)
|
|
run: |
|
|
if helm template test charts/aptly --set proxy.enabled=false --set ingress.enabled=true \
|
|
--set ingress.repo.host=x.example.com >/tmp/should-fail.yaml 2>&1; then
|
|
echo "::error::expected `helm template` to fail on proxy.enabled=false + ingress.enabled (fail-guard regression)"; exit 1
|
|
fi
|
|
if helm template test charts/aptly --set proxy.enabled=false --set gateway.enabled=true \
|
|
--set 'gateway.parentRefs[0].name=x' >/tmp/should-fail2.yaml 2>&1; then
|
|
echo "::error::expected `helm template` to fail on proxy.enabled=false + gateway.enabled (fail-guard regression)"; exit 1
|
|
fi
|
|
|
|
smoke-test:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Run the end-to-end smoke test
|
|
run: ./tests/smoke-test.sh
|