Public Access
Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
This commit is contained in:
@@ -0,0 +1,113 @@
|
||||
name: Release image
|
||||
# Triggered by `git tag image/vX.Y.Z-N && git push --tags`, independently of
|
||||
# chart releases (release-chart.yaml) — see docs/versioning.md. N is a
|
||||
# revision counter for rebuilds of the same aptly version (base-image CVE
|
||||
# patches — see rebuild.yaml), not a new aptly release.
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'image/v*'
|
||||
|
||||
concurrency:
|
||||
group: release-image
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
release:
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Parse tag and assert it matches the Dockerfile
|
||||
id: version
|
||||
run: |
|
||||
set -euo pipefail
|
||||
tag="${GITEA_REF_NAME#image/v}" # e.g. 1.6.3-1
|
||||
aptly_version="${tag%-*}" # 1.6.3
|
||||
revision="${tag##*-}" # 1
|
||||
minor="${aptly_version%.*}" # 1.6
|
||||
from_dockerfile="$(grep -oP '(?<=^ARG APTLY_VERSION=)\S+' images/aptly-server/Dockerfile)"
|
||||
if [[ "$from_dockerfile" != "$aptly_version" ]]; then
|
||||
echo "::error::tag ${GITEA_REF_NAME} implies aptly ${aptly_version}, but images/aptly-server/Dockerfile has ARG APTLY_VERSION=${from_dockerfile}. Bump the Dockerfile and re-tag."
|
||||
exit 1
|
||||
fi
|
||||
{
|
||||
echo "full=${tag}"
|
||||
echo "aptly_version=${aptly_version}"
|
||||
echo "revision=${revision}"
|
||||
echo "minor=${minor}"
|
||||
} >> "$GITEA_OUTPUT"
|
||||
env:
|
||||
GITEA_REF_NAME: ${{ gitea.ref_name }}
|
||||
|
||||
- name: Verify registry secrets are set
|
||||
run: |
|
||||
test -n "${{ secrets.REGISTRY_USER }}" || { echo "::error::REGISTRY_USER is not set"; exit 1; }
|
||||
test -n "${{ secrets.REGISTRY_TOKEN }}" || { echo "::error::REGISTRY_TOKEN is not set (needs write:package — GITEA_TOKEN cannot push packages on Gitea)"; exit 1; }
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: git.morlana.online
|
||||
username: ${{ secrets.REGISTRY_USER }}
|
||||
password: ${{ secrets.REGISTRY_TOKEN }}
|
||||
|
||||
- uses: docker/setup-qemu-action@v3
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
driver-opts: |
|
||||
image=moby/buildkit:latest
|
||||
|
||||
- name: Build & push aptly-server
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: images/aptly-server/Dockerfile
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
provenance: false
|
||||
sbom: false
|
||||
build-args: |
|
||||
APTLY_VERSION=${{ steps.version.outputs.aptly_version }}
|
||||
APTLY_REVISION=${{ steps.version.outputs.revision }}
|
||||
tags: |
|
||||
git.morlana.online/f.weber/aptly:${{ steps.version.outputs.full }}
|
||||
git.morlana.online/f.weber/aptly:${{ steps.version.outputs.aptly_version }}
|
||||
git.morlana.online/f.weber/aptly:${{ steps.version.outputs.minor }}
|
||||
git.morlana.online/f.weber/aptly:latest
|
||||
|
||||
- name: Build & push aptly-deb-builder
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: images/aptly-deb-builder/Dockerfile
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
provenance: false
|
||||
sbom: false
|
||||
tags: |
|
||||
git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.full }}
|
||||
git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.aptly_version }}
|
||||
git.morlana.online/f.weber/aptly-deb-builder:latest
|
||||
|
||||
- name: Create Gitea release
|
||||
uses: softprops/action-gh-release@v2
|
||||
with:
|
||||
tag_name: ${{ gitea.ref_name }}
|
||||
name: "aptly image ${{ steps.version.outputs.full }}"
|
||||
body: |
|
||||
Images pushed:
|
||||
- `git.morlana.online/f.weber/aptly:${{ steps.version.outputs.full }}` (+ `${{ steps.version.outputs.aptly_version }}`, `${{ steps.version.outputs.minor }}`, `latest`)
|
||||
- `git.morlana.online/f.weber/aptly-deb-builder:${{ steps.version.outputs.full }}`
|
||||
|
||||
- name: Bump chart appVersion (pins the last released image; never main-latest)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.full }}\"/" charts/aptly/Chart.yaml
|
||||
git config user.name "${{ gitea.actor }}"
|
||||
git config user.email "${{ gitea.actor }}@noreply.git.morlana.online"
|
||||
git add charts/aptly/Chart.yaml
|
||||
git diff --cached --quiet && exit 0
|
||||
git commit -m "chore: bump chart appVersion to ${{ steps.version.outputs.full }} [skip ci]"
|
||||
git push origin HEAD:main
|
||||
Reference in New Issue
Block a user