Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
2026-08-12 12:21:08 +02:00
commit 103ad311b7
71 changed files with 4843 additions and 0 deletions
@@ -0,0 +1,105 @@
+name: Preflight
+# Manual, one-shot verification that the runner can actually do everything
+# the release workflows assume: build a container image, emulate a foreign
+# architecture, push to this Gitea instance's registry, push a Helm chart via
+# OCI, and reach the Issues API. None of the four existing Gitea Actions
+# workflows in this org build a container image before this repo — so none
+# of that is proven, only assumed. Run this BEFORE relying on release-image.yaml
+# or rebuild.yaml, and again after any Gitea/runner upgrade.
+#
+# See docs/operations.md for the escalation ladder if any job here fails.
+on:
+  workflow_dispatch: {}
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Build aptly-server for the native arch only (no push)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: images/aptly-server/Dockerfile
+          push: false
+          tags: preflight/aptly-server:local
+
+  qemu-multiarch:
+    runs-on: ubuntu-22.04
+    needs: docker-build
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Build for linux/amd64,linux/arm64 (no push)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: images/aptly-server/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: false
+
+  registry-push:
+    runs-on: ubuntu-22.04
+    needs: qemu-multiarch
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify registry secrets are set
+        run: |
+          test -n "${{ secrets.REGISTRY_USER }}" || { echo "::error::REGISTRY_USER is not set"; exit 1; }
+          test -n "${{ secrets.REGISTRY_TOKEN }}" || { echo "::error::REGISTRY_TOKEN (a Personal Access Token with write:package) is not set. GITEA_TOKEN cannot authorize package pushes on Gitea — see docs/operations.md."; exit 1; }
+      - uses: docker/login-action@v3
+        with:
+          registry: git.morlana.online
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Push a throwaway multi-arch tag
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: images/aptly-server/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: git.morlana.online/f.weber/aptly:preflight-${{ gitea.sha }}
+      - name: Verify the manifest list has both platforms
+        run: |
+          docker buildx imagetools inspect git.morlana.online/f.weber/aptly:preflight-${{ gitea.sha }}
+
+  helm-oci-push:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4.3.0
+        with:
+          version: ${{ vars.HELM_VERSION || '3.16.4' }}
+      - name: helm registry login
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | helm registry login git.morlana.online \
+            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
+      - name: Package and push a throwaway chart version
+        run: |
+          helm package charts/aptly --version 0.0.0-preflight --app-version preflight
+          helm push aptly-0.0.0-preflight.tgz oci://git.morlana.online/f.weber
+      - name: Verify it is pullable
+        run: |
+          helm show chart oci://git.morlana.online/f.weber/aptly --version 0.0.0-preflight
+
+  issues-api:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Open and close a test issue (proves rebuild.yaml's failure alert path)
+        env:
+          GITEA_API: https://git.morlana.online/api/v1
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          issue_number=$(curl -fsS -X POST "${GITEA_API}/repos/${{ gitea.repository }}/issues" \
+            -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
+            -d '{"title":"[preflight] issues API check","body":"Created by preflight.yaml — safe to close/delete."}' \
+            | jq -r '.number')
+          curl -fsS -X PATCH "${GITEA_API}/repos/${{ gitea.repository }}/issues/${issue_number}" \
+            -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
+            -d '{"state":"closed"}' >/dev/null
+          echo "opened and closed issue #${issue_number}"