54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
# One job on purpose. The checks (eslint, vue-tsc, cargo test) live in the
|
|
# Dockerfile stages, so this workflow needs a single job image — one that has
|
|
# docker, git and node. Splitting the checks into their own jobs would mean
|
|
# `container: rust:...`, and a JavaScript action like `actions/checkout` needs
|
|
# node inside the job container, which the rust image does not have.
|
|
#
|
|
# Deliberately no third-party actions beyond `checkout`: a self-hosted Forgejo
|
|
# runner resolves `uses:` against its own mirror, and `docker/*` is usually not
|
|
# there. Plain docker commands work everywhere.
|
|
name: build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
IMAGE: registry.tibiscuit.ch/vm-selector
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# Secrets are read into the environment here, not interpolated into the
|
|
# shell commands below: `${{ secrets.X }}` inside a `run:` ends up in the
|
|
# process arguments, and the `secrets` context is not usable in `if:`.
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
PORTAINER_WEBHOOK: ${{ secrets.PORTAINER_WEBHOOK }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Turns itself on as soon as the registry has authentication and the two
|
|
# secrets exist; skipped while the registry is open.
|
|
- name: Log in to the registry
|
|
if: env.REGISTRY_USERNAME != ''
|
|
run: echo "$REGISTRY_PASSWORD" | docker login registry.tibiscuit.ch -u "$REGISTRY_USERNAME" --password-stdin
|
|
|
|
- name: Build and push
|
|
run: |
|
|
set -eu
|
|
docker build \
|
|
--build-arg GIT_HASH="${{ github.sha }}" \
|
|
--tag "$IMAGE:${{ github.sha }}" \
|
|
--tag "$IMAGE:latest" \
|
|
.
|
|
docker push "$IMAGE:${{ github.sha }}"
|
|
docker push "$IMAGE:latest"
|
|
|
|
# Portainer re-pulls the image and recreates the stack. Enable
|
|
# "Re-pull image" on the webhook, otherwise :latest stays the old layer.
|
|
- name: Redeploy on Portainer
|
|
if: env.PORTAINER_WEBHOOK != ''
|
|
run: curl -fsS -X POST "$PORTAINER_WEBHOOK"
|