diff --git a/.gitea/workflows/docker-build-base.yaml b/.gitea/workflows/docker-build-base.yaml index 880fd64..2d578b4 100644 --- a/.gitea/workflows/docker-build-base.yaml +++ b/.gitea/workflows/docker-build-base.yaml @@ -27,150 +27,10 @@ env: GITEA_REGISTRY_HOST: kankali.darkhelm.lan jobs: - registry-preflight: - name: Registry Push Preflight - runs-on: ubuntu-act - - steps: - - name: Audit trigger context - env: - EVENT_NAME: ${{ github.event_name }} - SOURCE_WORKFLOW: ${{ github.event.inputs.source_workflow }} - HEAD_SHA: ${{ github.sha }} - REF: ${{ github.ref }} - REF_NAME: ${{ github.ref_name }} - HEAD_REF: ${{ github.head_ref }} - FORCE_REBUILD: ${{ github.event.inputs.force_rebuild }} - run: | - echo "=== Dispatch Audit: CICD Base Image ===" - echo "event_name=${EVENT_NAME}" - echo "source_workflow=${SOURCE_WORKFLOW}" - echo "head_sha=${HEAD_SHA}" - echo "ref=${REF}" - echo "ref_name=${REF_NAME}" - echo "head_ref=${HEAD_REF}" - echo "force_rebuild=${FORCE_REBUILD}" - - - &write_registry_push_helpers - name: Write registry push helpers - run: | - cat > /tmp/registry-push-helpers.sh <<'EOF' - #!/bin/bash - - ensure_skopeo() { - if command -v skopeo >/dev/null 2>&1; then - return 0 - fi - - if command -v apt-get >/dev/null 2>&1; then - apt-get update && apt-get install -y skopeo - elif command -v apk >/dev/null 2>&1; then - apk add --no-cache skopeo - fi - - if ! command -v skopeo >/dev/null 2>&1; then - echo "❌ skopeo not available for fallback push" - return 1 - fi - } - - push_ref_with_fallback() { - ref="$1" - local_image="$2" - archive_path="$3" - registry_user="$4" - package_access_token="$5" - - for i in 1 2 3; do - echo "Docker push attempt ${i}/3 for ${ref}..." - if docker push "${ref}"; then - echo "✓ Docker push succeeded for ${ref}" - return 0 - fi - - if [ "${i}" -lt 3 ]; then - sleep 10 - fi - done - - echo "⚠ Docker push failed for ${ref}; trying skopeo fallback" - - if ! ensure_skopeo; then - return 1 - fi - - if [ ! -f "${archive_path}" ]; then - echo "Creating local image archive for fallback push..." - if ! docker save "${local_image}" -o "${archive_path}"; then - echo "❌ Failed to create docker archive for fallback push" - return 1 - fi - fi - - if skopeo copy \ - --dest-creds "${registry_user}:${package_access_token}" \ - --dest-tls-verify=false \ - "docker-archive:${archive_path}" \ - "docker://${ref}"; then - echo "✓ Skopeo fallback push succeeded for ${ref}" - return 0 - fi - - echo "❌ Skopeo fallback push failed for ${ref}" - return 1 - } - EOF - - chmod 700 /tmp/registry-push-helpers.sh - - - name: Verify registry login and minimal push - env: - PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }} - REGISTRY_USER: ${{ github.actor }} - GITHUB_SHA: ${{ github.sha }} - run: | - echo "=== Registry Push Preflight ===" - - if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then - echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts - fi - - if ! echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin; then - echo "❌ Registry login failed during preflight" - exit 1 - fi - - PREFLIGHT_TAG="${GITHUB_SHA:-manual}" - PREFLIGHT_REF="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-ci-preflight:${PREFLIGHT_TAG}" - - cat <<'EOF' > /tmp/Dockerfile.preflight - FROM scratch - LABEL org.opencontainers.image.title="plex-playlist registry preflight" - LABEL org.opencontainers.image.description="Minimal image used to verify registry push access before expensive CI steps" - EOF - - if ! docker build -f /tmp/Dockerfile.preflight -t registry-preflight:latest /tmp; then - echo "❌ Failed to build minimal preflight image" - exit 1 - fi - - docker tag registry-preflight:latest "${PREFLIGHT_REF}" - - ARCHIVE_PATH="/tmp/registry-preflight.tar" - source /tmp/registry-push-helpers.sh - - if push_ref_with_fallback "${PREFLIGHT_REF}" "registry-preflight:latest" "${ARCHIVE_PATH}" "${REGISTRY_USER}" "${PACKAGE_ACCESS_TOKEN}"; then - echo "✓ Registry preflight push succeeded: ${PREFLIGHT_REF}" - else - echo "❌ Registry preflight push failed: ${PREFLIGHT_REF}" - exit 1 - fi - publish-base: name: Build and Publish CICD Base Image # Heavy Docker build: schedule only on 8GB Pi runners. runs-on: ubuntu-act-8gb - needs: registry-preflight outputs: base_hash: ${{ steps.base-state.outputs.base_hash }} head_sha: ${{ steps.meta.outputs.head_sha }} @@ -283,7 +143,76 @@ jobs: echo "ℹ Immutable base image missing or not yet pullable: ${BASE_REF_HASH}" echo "needs_build=true" >> $GITHUB_OUTPUT - - *write_registry_push_helpers + - name: Write registry push helpers + run: | + cat > /tmp/registry-push-helpers.sh <<'EOF' + #!/bin/bash + + ensure_skopeo() { + if command -v skopeo >/dev/null 2>&1; then + return 0 + fi + + if command -v apt-get >/dev/null 2>&1; then + apt-get update && apt-get install -y skopeo + elif command -v apk >/dev/null 2>&1; then + apk add --no-cache skopeo + fi + + if ! command -v skopeo >/dev/null 2>&1; then + echo "❌ skopeo not available for fallback push" + return 1 + fi + } + + push_ref_with_fallback() { + ref="$1" + local_image="$2" + archive_path="$3" + registry_user="$4" + package_access_token="$5" + + for i in 1 2 3; do + echo "Docker push attempt ${i}/3 for ${ref}..." + if docker push "${ref}"; then + echo "✓ Docker push succeeded for ${ref}" + return 0 + fi + + if [ "${i}" -lt 3 ]; then + sleep 10 + fi + done + + echo "⚠ Docker push failed for ${ref}; trying skopeo fallback" + + if ! ensure_skopeo; then + return 1 + fi + + if [ ! -f "${archive_path}" ]; then + echo "Creating local image archive for fallback push..." + if ! docker save "${local_image}" -o "${archive_path}"; then + echo "❌ Failed to create docker archive for fallback push" + return 1 + fi + fi + + if skopeo copy \ + --dest-creds "${registry_user}:${package_access_token}" \ + --dest-tls-verify=false \ + "docker-archive:${archive_path}" \ + "docker://${ref}"; then + echo "✓ Skopeo fallback push succeeded for ${ref}" + return 0 + fi + + echo "❌ Skopeo fallback push failed for ${ref}" + return 1 + } + EOF + + chmod 700 /tmp/registry-push-helpers.sh - name: Build and push base image if: steps.base-state.outputs.needs_build == 'true' @@ -354,7 +283,7 @@ jobs: dispatch-main-build: name: Dispatch CICD Main Build - runs-on: ubuntu-act + runs-on: ubuntu-latest needs: publish-base if: needs.publish-base.result == 'success' steps: @@ -386,6 +315,12 @@ jobs: REPO_NAME="${REPO_FULL#*/}" TARGET_REF="${HEAD_REF:-${REF_NAME}}" + if ! command -v curl >/dev/null 2>&1; then + export DEBIAN_FRONTEND=noninteractive + apt-get update -qq + apt-get install -y -qq curl ca-certificates + fi + payload=$(cat <