Public Access
copilotcoder
b6f4a3eaf6
CICD Start / Sanity and Base Decision (pull_request) Successful in 1m0s
Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>
245 lines
8.8 KiB
YAML
245 lines
8.8 KiB
YAML
name: CICD Start
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, develop, feature/* ]
|
|
pull_request:
|
|
branches: [ main, develop ]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
GITEA_SSH_HOST: kankali.darkhelm.lan
|
|
GITEA_SSH_PORT: "2222"
|
|
GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
|
|
GITEA_REGISTRY: kankali.darkhelm.lan:3001
|
|
GITEA_REGISTRY_IP: 10.18.75.2
|
|
GITEA_REGISTRY_HOST: kankali.darkhelm.lan
|
|
|
|
concurrency:
|
|
group: start-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
sanity-and-routing:
|
|
name: Sanity and Base Decision
|
|
runs-on: ubuntu-act
|
|
outputs:
|
|
base_needed: ${{ steps.base-decision.outputs.base_needed }}
|
|
head_sha: ${{ steps.base-decision.outputs.head_sha }}
|
|
base_hash: ${{ steps.base-decision.outputs.base_hash }}
|
|
|
|
steps:
|
|
- name: Audit trigger context
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
ACTOR: ${{ github.actor }}
|
|
REF: ${{ github.ref }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
HEAD_REF: ${{ github.head_ref }}
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
echo "=== Dispatch Audit: CICD Start ==="
|
|
echo "event_name=${EVENT_NAME}"
|
|
echo "repository=${REPOSITORY}"
|
|
echo "actor=${ACTOR}"
|
|
echo "ref=${REF}"
|
|
echo "ref_name=${REF_NAME}"
|
|
echo "head_ref=${HEAD_REF}"
|
|
echo "sha=${SHA}"
|
|
|
|
- name: Configure registry host resolution
|
|
run: |
|
|
if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
|
|
echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
|
|
fi
|
|
|
|
- name: Registry sanity login
|
|
env:
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
run: |
|
|
echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
- name: Registry sanity push and pull
|
|
env:
|
|
REGISTRY_USER: ${{ github.actor }}
|
|
run: |
|
|
PREFLIGHT_TAG="${GITHUB_SHA:-manual}"
|
|
PREFLIGHT_REF="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-ci-preflight:${PREFLIGHT_TAG}"
|
|
|
|
cat <<'EOF' > /tmp/Dockerfile.preflight
|
|
FROM scratch
|
|
LABEL org.opencontainers.image.title="plex-playlist registry preflight"
|
|
LABEL org.opencontainers.image.description="Minimal image used to verify registry push/pull access"
|
|
EOF
|
|
|
|
docker build -f /tmp/Dockerfile.preflight -t registry-preflight:latest /tmp
|
|
docker tag registry-preflight:latest "${PREFLIGHT_REF}"
|
|
docker push "${PREFLIGHT_REF}"
|
|
docker pull "${PREFLIGHT_REF}"
|
|
|
|
- name: Compute base hash and base-needed signal
|
|
id: base-decision
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -e
|
|
|
|
compute_hash() {
|
|
local file1="$1"
|
|
local file2="$2"
|
|
sha256sum "${file1}" "${file2}" | sha256sum | cut -c1-16
|
|
}
|
|
|
|
if [ -f "Dockerfile.cicd-base" ] && [ -f ".dockerignore" ]; then
|
|
BASE_HASH=$(compute_hash "Dockerfile.cicd-base" ".dockerignore")
|
|
else
|
|
umask 077
|
|
trap 'rm -f ~/.ssh/id_rsa' EXIT
|
|
|
|
if [ -z "${SSH_PRIVATE_KEY}" ]; then
|
|
echo "❌ SSH_PRIVATE_KEY is empty"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p ~/.ssh /tmp/base-hash-repo
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
cd /tmp/base-hash-repo
|
|
git init -q
|
|
git remote add origin "${GITEA_REPO_SSH_URL}"
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
|
|
git fetch --depth 1 origin "${GITHUB_SHA}"
|
|
|
|
git show FETCH_HEAD:Dockerfile.cicd-base > /tmp/Dockerfile.cicd-base
|
|
git show FETCH_HEAD:.dockerignore > /tmp/.dockerignore
|
|
|
|
BASE_HASH=$(compute_hash "/tmp/Dockerfile.cicd-base" "/tmp/.dockerignore")
|
|
fi
|
|
|
|
BASE_REF_HASH="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
|
|
|
|
echo "Base hash: ${BASE_HASH}"
|
|
echo "Base ref: ${BASE_REF_HASH}"
|
|
|
|
echo "head_sha=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
|
|
echo "base_hash=${BASE_HASH}" >> "$GITHUB_OUTPUT"
|
|
|
|
for i in 1 2 3; do
|
|
echo "Base availability check ${i}/3 for ${BASE_REF_HASH}"
|
|
|
|
# Manifest inspect is unreliable on some runners; use pull as truth.
|
|
if timeout 900 docker pull "${BASE_REF_HASH}" >/tmp/start-base-pull.log 2>&1; then
|
|
echo "pull_check=ok"
|
|
echo "Base rebuild needed: false"
|
|
echo "base_needed=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
else
|
|
pull_exit=$?
|
|
echo "pull_check=failed exit_code=${pull_exit}"
|
|
if [ "${pull_exit}" -eq 124 ]; then
|
|
echo "Base pull timed out after 900s"
|
|
fi
|
|
if [ -s /tmp/start-base-pull.log ]; then
|
|
tail -n 20 /tmp/start-base-pull.log || true
|
|
fi
|
|
fi
|
|
if [ "${i}" -lt 3 ]; then
|
|
sleep 10
|
|
fi
|
|
done
|
|
|
|
echo "Base rebuild needed: true"
|
|
echo "base_needed=true" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Dispatch downstream workflow
|
|
if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
|
|
env:
|
|
ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
|
|
PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
|
|
BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
|
|
HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
|
|
BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
|
|
REPO_FULL: ${{ github.repository }}
|
|
HEAD_REF: ${{ github.head_ref }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
run: |
|
|
set -e
|
|
|
|
DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"
|
|
|
|
if [ -z "${DISPATCH_TOKEN}" ]; then
|
|
echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
|
|
exit 1
|
|
fi
|
|
|
|
REPO_OWNER="${REPO_FULL%/*}"
|
|
REPO_NAME="${REPO_FULL#*/}"
|
|
TARGET_REF="${HEAD_REF:-${REF_NAME}}"
|
|
|
|
if [ "${BASE_NEEDED}" = "true" ]; then
|
|
TARGET_WORKFLOW="docker-build-base.yaml"
|
|
else
|
|
TARGET_WORKFLOW="docker-build-main.yaml"
|
|
fi
|
|
|
|
payload=$(cat <<EOF
|
|
{
|
|
"ref": "${TARGET_REF}",
|
|
"inputs": {
|
|
"head_sha": "${HEAD_SHA}",
|
|
"base_hash": "${BASE_HASH}",
|
|
"source_workflow": "CICD Start",
|
|
"base_needed": "${BASE_NEEDED}"
|
|
}
|
|
}
|
|
EOF
|
|
)
|
|
|
|
CANDIDATE_API_BASES=()
|
|
if [ -n "${GITHUB_SERVER_URL:-}" ]; then
|
|
CANDIDATE_API_BASES+=("${GITHUB_SERVER_URL%/}/api/v1")
|
|
fi
|
|
if [ -n "${GITEA_SSH_HOST:-}" ]; then
|
|
CANDIDATE_API_BASES+=("http://${GITEA_SSH_HOST}:3001/api/v1")
|
|
fi
|
|
if [ -n "${GITEA_REGISTRY_HOST:-}" ]; then
|
|
CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_HOST}:3001/api/v1")
|
|
fi
|
|
if [ -n "${GITEA_REGISTRY_IP:-}" ]; then
|
|
CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_IP}:3001/api/v1")
|
|
fi
|
|
|
|
dispatched=false
|
|
for API_BASE in "${CANDIDATE_API_BASES[@]}"; do
|
|
DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/${TARGET_WORKFLOW}/dispatches"
|
|
RESPONSE_FILE="/tmp/dispatch-response.txt"
|
|
: > "${RESPONSE_FILE}"
|
|
|
|
HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
|
|
-H "Authorization: token ${DISPATCH_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
"${DISPATCH_URL}" \
|
|
-d "${payload}" || true)
|
|
|
|
if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
|
|
echo "✓ Dispatch succeeded via ${API_BASE}"
|
|
dispatched=true
|
|
break
|
|
fi
|
|
|
|
echo "Dispatch attempt failed via ${API_BASE} (HTTP ${HTTP_CODE})"
|
|
if [ -s "${RESPONSE_FILE}" ]; then
|
|
echo "Response body:"
|
|
cat "${RESPONSE_FILE}"
|
|
fi
|
|
done
|
|
|
|
if [ "${dispatched}" != "true" ]; then
|
|
echo "❌ Dispatch failed on all candidate API endpoints"
|
|
exit 1
|
|
fi
|