Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
name: 'aptly publish-deb'
|
|
description: >-
|
|
Package a source tree (nfpm.yaml or a debian/ directory) and push the
|
|
result into an aptly repository, in one step. Wraps the same aptly-release
|
|
script the aptly-deb-builder image ships, so behaviour is identical to
|
|
running that image directly (see docs/packaging.md for the direct-run
|
|
fallback, which is the more robust option if this action's resolution
|
|
ever misbehaves on your Gitea instance).
|
|
#
|
|
# IMPORTANT: lives at the repo ROOT deliberately, not under actions/ or
|
|
# .gitea/actions/ — cross-repo `uses:` references WITH a subpath
|
|
# (owner/repo/path/action@ref) are not reliable on Gitea; only local
|
|
# (./.gitea/actions/x) and repo-root references resolve consistently.
|
|
inputs:
|
|
image:
|
|
description: 'aptly-deb-builder image to run (pin to a released tag in production)'
|
|
required: false
|
|
default: 'git.morlana.online/f.weber/aptly-deb-builder:latest'
|
|
source-dir:
|
|
description: 'Directory containing nfpm.yaml or a debian/ directory'
|
|
required: false
|
|
default: '.'
|
|
config:
|
|
description: 'nfpm config file name, relative to source-dir'
|
|
required: false
|
|
default: 'nfpm.yaml'
|
|
url:
|
|
description: 'aptly API URL (e.g. https://apt.example.com)'
|
|
required: true
|
|
repo:
|
|
description: 'Target local repo name'
|
|
required: true
|
|
distribution:
|
|
description: 'Distribution to publish/refresh after pushing'
|
|
required: false
|
|
default: ''
|
|
prefix:
|
|
description: 'Publish prefix ("" = repo root)'
|
|
required: false
|
|
default: ''
|
|
username:
|
|
description: 'Basic auth username (omit for an open/unauthenticated repo)'
|
|
required: false
|
|
default: ''
|
|
password:
|
|
description: 'Basic auth password'
|
|
required: false
|
|
default: ''
|
|
no-sign:
|
|
description: '"true" if the target repo is unsigned (aptly.gpg.enabled=false)'
|
|
required: false
|
|
default: 'false'
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
args=(--source-dir "${{ inputs.source-dir }}" --config "${{ inputs.config }}" --)
|
|
args+=(--repo "${{ inputs.repo }}")
|
|
[[ -n "${{ inputs.distribution }}" ]] && args+=(--distribution "${{ inputs.distribution }}")
|
|
args+=(--prefix "${{ inputs.prefix }}")
|
|
[[ "${{ inputs.no-sign }}" == "true" ]] && args+=(--no-sign)
|
|
|
|
docker run --rm \
|
|
-v "${{ github.workspace }}:/work" -w /work \
|
|
-e "APTLY_URL=${{ inputs.url }}" \
|
|
-e "APTLY_USER=${{ inputs.username }}" \
|
|
-e "APTLY_PASSWORD=${{ inputs.password }}" \
|
|
"${{ inputs.image }}" \
|
|
aptly-release "${args[@]}"
|