Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
2026-08-12 12:21:08 +02:00
commit 103ad311b7
71 changed files with 4843 additions and 0 deletions
@@ -0,0 +1,99 @@
+name: Release chart
+# Triggered by `git tag chart/vX.Y.Z && git push --tags`, independently of
+# image releases — see docs/versioning.md. Never bumps the image: Chart.yaml's
+# committed appVersion (last set by release-image.yaml) is what gets packaged,
+# so a chart-only release always pins the last released image, never `latest`.
+#
+# Chart version is pure SemVer, deliberately WITHOUT the `+up<aptly>` build
+# metadata bookstack-chart uses: Helm rewrites `+` to `_` on OCI push (and
+# back on pull), which breaks listing in some third-party tooling (e.g.
+# Rancher). The aptly version lives in appVersion instead.
+on:
+  push:
+    tags:
+      - 'chart/v*'
+
+concurrency:
+  group: release-chart
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse chart version from tag
+        id: version
+        run: echo "version=${GITEA_REF_NAME#chart/v}" >> "$GITEA_OUTPUT"
+        env:
+          GITEA_REF_NAME: ${{ gitea.ref_name }}
+
+      - uses: azure/setup-helm@v4.3.0
+        with:
+          version: ${{ vars.HELM_VERSION || '3.16.4' }}
+
+      - name: Quality gate
+        run: |
+          set -e
+          helm lint charts/aptly
+          for f in charts/aptly/ci/*.yaml; do
+            helm template test charts/aptly -f "$f" > /dev/null
+          done
+
+      - name: Idempotency check — refuse to overwrite an existing chart version
+        run: |
+          if helm show chart "oci://git.morlana.online/f.weber/aptly" --version "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
+            echo "::error::chart version ${{ steps.version.outputs.version }} already exists in the registry. Bump the version and re-tag — this workflow never overwrites a published chart."
+            exit 1
+          fi
+
+      - name: Import GPG signing key
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          trust_level: 5
+
+      - name: Build legacy secret keyring (helm package --sign wants gpg1-style secring.gpg)
+        run: |
+          mkdir -p /tmp/gpgring
+          gpg --batch --pinentry-mode loopback --passphrase "${{ secrets.GPG_PASSPHRASE }}" \
+            --export-secret-keys > /tmp/gpgring/secring.gpg
+          printf '%s' "${{ secrets.GPG_PASSPHRASE }}" > /tmp/gpgring/passphrase.txt
+          chmod 600 /tmp/gpgring/*
+
+      # secrets.GPG_KEY_ID/GPG_PRIVATE_KEY must be an RSA (or other classic,
+      # non-EdDSA) key — Helm's sign/verify uses the deprecated
+      # golang.org/x/crypto/openpgp library, which cannot read Ed25519 keys at
+      # all (fails with "private key not found"). See pubkeys/README.md.
+      - name: Package & sign
+        run: |
+          helm package charts/aptly \
+            --version "${{ steps.version.outputs.version }}" \
+            --dependency-update \
+            --sign --key "${{ secrets.GPG_KEY_ID }}" \
+            --keyring /tmp/gpgring/secring.gpg \
+            --passphrase-file /tmp/gpgring/passphrase.txt
+
+      - name: helm registry login & push
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | helm registry login git.morlana.online \
+            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
+          helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber
+
+      - name: Create Gitea release with chart artifacts
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ gitea.ref_name }}
+          name: "aptly chart ${{ steps.version.outputs.version }}"
+          body: |
+            `helm pull oci://git.morlana.online/f.weber/aptly --version ${{ steps.version.outputs.version }}`
+          files: |
+            aptly-${{ steps.version.outputs.version }}.tgz
+            aptly-${{ steps.version.outputs.version }}.tgz.prov
+            pubkeys/chart-signing.asc
+
+      - name: Clean up key material
+        if: always()
+        run: rm -rf /tmp/gpgring