Prep kiosk-app for submodule split

2026-06-25 23:55:29 +00:00
parent c3507cda6e
commit 25d0cfff7c
6 changed files with 207 additions and 14 deletions
@@ -0,0 +1,94 @@
+#
+# .gitea/workflows/ci.yaml  (fleet-kiosk-app repo)
+#
+# Builds the kiosk SPA into its container image and pushes it, so the fleet
+# serving stack `docker compose pull`s it (consumed as a submodule there). The
+# Dockerfile compiles the Svelte/Vite bundle (`npm ci` + `npm run build`), so a
+# build/compile error fails this job.
+#
+# Tagging mirrors the fleet serving-image workflows — every branch builds a
+# uniquely tagged image you can test without clobbering main:
+#   - tag push    (refs/tags/v1.2.3) -> "1.2.3"        (+ :latest)
+#   - main push   (refs/heads/main)  -> "main-<sha7>"  (+ :latest)
+#   - branch push (refs/heads/<x>)   -> "<x>-<sha7>"   (dev image, no :latest)
+#
+# Required repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
+#
+
+name: Build fleet-kiosk image
+run-name: ${{ gitea.actor }} builds the kiosk SPA image (${{ gitea.ref_name }})
+on:
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: kiosk-image-${{ gitea.ref }}
+  cancel-in-progress: true
+
+env:
+  KIOSK_IMAGE: "git.bitasylum.org/audiobuzz/fleet-kiosk"
+
+jobs:
+  kiosk-build:
+    name: Build & push kiosk image
+    runs-on: ubuntu-latest
+    container:
+      image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+
+      -
+        name: Install buildah
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends buildah
+
+      -
+        name: Derive image tag
+        id: vars
+        run: |
+          short_sha="$(echo "${GITHUB_SHA}" | cut -c1-7)"
+          if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then
+            version="${GITHUB_REF#refs/tags/}"; version="${version#v}"
+          else
+            branch="${GITHUB_REF#refs/heads/}"
+            safe_branch="$(printf '%s' "$branch" \
+              | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-100)"
+            [ -n "$safe_branch" ] || safe_branch="branch"
+            version="${safe_branch}-${short_sha}"
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "Building ${KIOSK_IMAGE}:${version}"
+
+      -
+        name: Registry login
+        run: |
+          buildah login \
+            --username "${{ secrets.PACKAGE_USER }}" \
+            --password "${{ secrets.PACKAGE_TOKEN }}" \
+            git.bitasylum.org
+
+      -
+        name: Build & push
+        env:
+          STORAGE_DRIVER: vfs
+          BUILDAH_ISOLATION: chroot
+        run: |
+          VER="${{ steps.vars.outputs.version }}"
+          buildah bud -t "${KIOSK_IMAGE}:${VER}" .
+          buildah push "${KIOSK_IMAGE}:${VER}"
+          # Only main / release tags move :latest, so dev branches never clobber it.
+          case "$GITHUB_REF" in
+            refs/heads/main|refs/tags/*)
+              buildah tag  "${KIOSK_IMAGE}:${VER}" "${KIOSK_IMAGE}:latest"
+              buildah push "${KIOSK_IMAGE}:latest"
+              echo "Updated ${KIOSK_IMAGE}:latest" ;;
+            *)
+              echo "Dev branch build — :latest left untouched (run with KIOSK_VERSION=${VER})" ;;
+          esac