Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
72 lines
3.2 KiB
YAML
72 lines
3.2 KiB
YAML
name: Weekly rebuild
|
|
# Bumps the image revision (1.6.3-1 -> 1.6.3-2) and tags it, which triggers
|
|
# release-image.yaml — the mechanism that pulls in Debian base-image security
|
|
# patches even between aptly releases. This is the "aptly keeps itself
|
|
# current" half that isn't a Renovate PR: it needs zero human action to land.
|
|
#
|
|
# Gitea's `schedule` trigger only fires from the default branch — a branch
|
|
# rename silently disables this. Because Gitea Actions only implements
|
|
# always() among the status-check expressions (not success()/failure()),
|
|
# failure handling below uses `continue-on-error` + a status file instead of
|
|
# `if: failure()`.
|
|
on:
|
|
schedule:
|
|
- cron: '17 3 * * 1'
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
bump-revision:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Find the latest image tag and compute the next revision
|
|
id: next
|
|
continue-on-error: true
|
|
run: |
|
|
set -euo pipefail
|
|
latest="$(git tag --list 'image/v*' --sort=-v:refname | head -1)"
|
|
if [[ -z "$latest" ]]; then
|
|
echo "::error::no existing image/v* tag found — cut one manually first (see docs/versioning.md)"
|
|
exit 1
|
|
fi
|
|
version_rev="${latest#image/v}"
|
|
version="${version_rev%-*}"
|
|
revision="${version_rev##*-}"
|
|
next_revision=$(( revision + 1 ))
|
|
echo "next_tag=image/v${version}-${next_revision}" >> "$GITEA_OUTPUT"
|
|
echo "latest_tag=${latest}" >> "$GITEA_OUTPUT"
|
|
|
|
- name: Stale-rebuild check (fires regardless of the step above)
|
|
if: always()
|
|
run: |
|
|
latest_epoch="$(git log -1 --format=%at "$(git tag --list 'image/v*' --sort=-v:refname | head -1)" 2>/dev/null || echo 0)"
|
|
now_epoch="$(date +%s)"
|
|
days=$(( (now_epoch - latest_epoch) / 86400 ))
|
|
threshold="${STALE_REBUILD_DAYS:-14}"
|
|
echo "days since last image tag: ${days} (threshold: ${threshold})"
|
|
if [[ "$days" -gt "$threshold" ]]; then
|
|
echo "::warning::no new image tag in ${days} days — check whether this workflow (or Renovate) is still running"
|
|
fi
|
|
|
|
- name: Tag and push
|
|
if: steps.next.outcome == 'success'
|
|
run: |
|
|
git config user.name "${{ gitea.actor }}"
|
|
git config user.email "${{ gitea.actor }}@noreply.git.morlana.online"
|
|
git tag "${{ steps.next.outputs.next_tag }}"
|
|
git push origin "${{ steps.next.outputs.next_tag }}"
|
|
echo "tagged ${{ steps.next.outputs.next_tag }} (rebuild of ${{ steps.next.outputs.latest_tag }}'s aptly version)"
|
|
|
|
- name: Report failure (opens an issue; the next successful run closes it)
|
|
if: always() && steps.next.outcome != 'success'
|
|
env:
|
|
GITEA_API: https://git.morlana.online/api/v1
|
|
TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
curl -fsS -X POST "${GITEA_API}/repos/${{ gitea.repository }}/issues" \
|
|
-H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
|
|
-d "{\"title\":\"rebuild.yaml failed on $(date -u +%F)\",\"body\":\"See the workflow run: ${{ gitea.server_url }}/${{ gitea.repository }}/actions\"}"
|