From a8402a2127fc15de10d30fc763f7459cf9b4ea66 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sun, 5 Jul 2026 00:32:19 +0000 Subject: [PATCH] ci: build + push the fleet-manager image (join the CI-built serving images) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add .gitea/workflows/fleet-manager-image.yaml, modelled on dnsmasq-image.yaml: buildah bud of serving/fleet-manager (multi-stage SPA+Go→distroless) on a path filter, with the same branch/tag tagging scheme (semver on tags, main- + latest on main, - dev images). Wires it into the shared conventions: - gitea-main-ci.yaml paths-ignore: list the new workflow so a fleet-manager image change doesn't trigger the ~17-min UKI build (serving/** already covers the dir; the .gitea/ workflow file needed listing). - registry-gc.yaml IMAGES: add fleet-manager so its dev-branch builds are GC'd. --- .gitea/workflows/fleet-manager-image.yaml | 111 ++++++++++++++++++++++ .gitea/workflows/gitea-main-ci.yaml | 1 + .gitea/workflows/registry-gc.yaml | 2 +- 3 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 .gitea/workflows/fleet-manager-image.yaml diff --git a/.gitea/workflows/fleet-manager-image.yaml b/.gitea/workflows/fleet-manager-image.yaml new file mode 100644 index 0000000..0b1acd3 --- /dev/null +++ b/.gitea/workflows/fleet-manager-image.yaml @@ -0,0 +1,111 @@ +# +# .gitea/workflows/fleet-manager-image.yaml +# +# Builds the serving-stack fleet-manager image (serving/fleet-manager) and pushes +# it to the registry, so mgmt hosts `docker compose pull` it instead of building +# it at deploy time (matching the dnsmasq / SPDK / kiosk images). The multi-stage +# Dockerfile builds the Svelte SPA (node) → dist/, compiles the Go binary with the +# SPA embedded (`-tags embedspa`), and ships FROM distroless static (nonroot). The +# gRPC .pb.go stubs are committed, so no protoc is needed here. +# +# NOTE on base images: the build/ui stages pull the golang + node bases from the +# harbor mirror; the runtime is gcr.io/distroless/static-debian12:nonroot. The +# runner needs reach to harbor + gcr.io (mirror distroless through harbor too if +# egress is restricted). +# +# Tagging mirrors gitea-main-ci.yaml so every branch builds a uniquely tagged, +# pushed image you can test without clobbering main: +# - tag push (refs/tags/v1.2.3) -> "1.2.3" (+ :latest) +# - main push (refs/heads/main) -> "main-" (+ :latest) +# - branch push (refs/heads/) -> "-" (dev image, no :latest) +# Set FLEET_MANAGER_VERSION in serving/fleet-manager/.env to the tag you want to run. +# +# Runs only when the fleet-manager image inputs change (path filter) or on demand. +# +# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds). +# + +name: Build fleet-manager image +run-name: ${{ gitea.actor }} builds the fleet-manager control-plane image (${{ gitea.ref_name }}) +on: + push: + branches: + - "**" # every branch — dev branches get a branch-name+sha tag + tags: + - "v*" # tag push -> clean semver tag (v1.2.3 -> 1.2.3) + paths: + - "serving/fleet-manager/**" + - ".gitea/workflows/fleet-manager-image.yaml" + workflow_dispatch: + +# One build per ref at a time; a newer push to the same ref cancels the in-flight. +concurrency: + group: fleet-manager-image-${{ gitea.ref }} + cancel-in-progress: true + +env: + FLEET_MANAGER_IMAGE: "git.bitasylum.org/audiobuzz/fleet-manager" + +jobs: + fleet-manager-build: + name: Build & push fleet-manager image + runs-on: ubuntu-latest + container: + image: git.bitasylum.org/audiobuzz/ubuntu-act-runner-qemu:main + steps: + - + name: Checkout + uses: actions/checkout@v6 + + - + name: Derive image tag + id: vars + # Same scheme as gitea-main-ci.yaml: clean semver on a tag push, else + # "-" with the branch sanitized to the OCI tag charset. + run: | + short_sha="$(echo "${GITHUB_SHA}" | cut -c1-7)" + if [ "${GITHUB_REF#refs/tags/}" != "$GITHUB_REF" ]; then + version="${GITHUB_REF#refs/tags/}"; version="${version#v}" + else + branch="${GITHUB_REF#refs/heads/}" + safe_branch="$(printf '%s' "$branch" \ + | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-100)" + [ -n "$safe_branch" ] || safe_branch="branch" + version="${safe_branch}-${short_sha}" + fi + echo "version=${version}" >> "$GITHUB_OUTPUT" + echo "Building ${FLEET_MANAGER_IMAGE}:${version}" + + - + name: Install buildah + run: | + sudo apt-get update + sudo apt-get install -y --no-install-recommends buildah + + - + name: Registry login + run: | + buildah login \ + --username "${{ secrets.PACKAGE_USER }}" \ + --password "${{ secrets.PACKAGE_TOKEN }}" \ + git.bitasylum.org + + - + name: Build & push + # vfs storage: overlay-on-overlayfs is unsupported in-container. + env: + STORAGE_DRIVER: vfs + BUILDAH_ISOLATION: chroot + run: | + VER="${{ steps.vars.outputs.version }}" + buildah bud -t "${FLEET_MANAGER_IMAGE}:${VER}" serving/fleet-manager + buildah push "${FLEET_MANAGER_IMAGE}:${VER}" + # Only main / release tags move :latest, so dev branches never clobber it. + case "$GITHUB_REF" in + refs/heads/main|refs/tags/*) + buildah tag "${FLEET_MANAGER_IMAGE}:${VER}" "${FLEET_MANAGER_IMAGE}:latest" + buildah push "${FLEET_MANAGER_IMAGE}:latest" + echo "Updated ${FLEET_MANAGER_IMAGE}:latest" ;; + *) + echo "Dev branch build — :latest left untouched (run with FLEET_MANAGER_VERSION=${VER})" ;; + esac diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml index 37a80d8..4e4f007 100644 --- a/.gitea/workflows/gitea-main-ci.yaml +++ b/.gitea/workflows/gitea-main-ci.yaml @@ -58,6 +58,7 @@ on: - ".gitea/workflows/ipxe-image.yaml" - ".gitea/workflows/dnsmasq-image.yaml" - ".gitea/workflows/spdk-image.yaml" + - ".gitea/workflows/fleet-manager-image.yaml" # One build per ref at a time; a newer push to the same branch cancels the # in-flight build (each build is a ~17-min VM run, so don't stack them). diff --git a/.gitea/workflows/registry-gc.yaml b/.gitea/workflows/registry-gc.yaml index 66fadf2..8eb7bf7 100644 --- a/.gitea/workflows/registry-gc.yaml +++ b/.gitea/workflows/registry-gc.yaml @@ -64,7 +64,7 @@ jobs: DISPATCH_DRY: ${{ inputs.dry_run }} GC_ENABLE: ${{ vars.REGISTRY_GC_ENABLE }} # Only images built by THIS repo's workflows. - IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf" + IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf fleet-manager" steps: - name: Reconcile registry against live branches # The runner defaults `run:` to sh (dash); this script uses bashisms