3c835e950a
Some checks failed
CI / lint (push) Successful in 1m5s
Deploy / notebooks (push) Has been skipped
Deploy / zotero (push) Has been skipped
Deploy / docs (push) Has been skipped
Deploy / api (push) Has been skipped
Deploy / mc (push) Has been skipped
Infra CI / notebooks (push) Failing after 2m44s
Infra CI / zotero (push) Successful in 1m12s
Infra CI / docs (push) Successful in 1m40s
Infra CI / api (push) Successful in 16s
Infra CI / mc (push) Successful in 22s
Deploy / report (push) Successful in 16s
CI / test (push) Failing after 16m27s
Harden / build-scan-report (push) Failing after 2m17s
Renovate / renovate (push) Successful in 16s
Package Supply Chain / pkg-supply-chain (push) Failing after 45s
Two scheduled pipelines were failing on every run and spamming Gitea issues
(30 open): 26 from Package Supply Chain (daily), 4 from Harden (weekly).
- Package Supply Chain: pkg-manifest.json was stale — markdown-it-py and
mdit-py-plugins were in source but not the manifest, failing "Check
manifest freshness" and "Drift detection". Regenerated via pkg_inventory.py.
- Harden: "Build notebooks" failed with `"/infra/marimo/theme": not found`.
notebooks.Dockerfile COPYs infra/marimo/theme (a repo-root path), but
stack.toml built it with context notebooks/. The .dockerignore was already
set up for repo-root context (it carves out infra/marimo/theme/**); the
per-image context was a stale leftover from the notebooks content/config
split. Switched notebooks and zotero to context "." like docs/api.
- This also unblocks the zotero desktop-bridge change (225ce01): its new
COPY infra/images/zotero/* only resolves under repo-root context. Added a
.dockerignore carve-out (!infra/images/zotero/**) so the scripts ride along.
Verified: pkg_inventory --check + pkg_drift now pass; a probe build confirms
all COPY sources resolve under repo-root context + the real .dockerignore.
274 lines
10 KiB
YAML
274 lines
10 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
notebooks:
|
|
runs-on: ubuntu-latest
|
|
if: >-
|
|
contains(github.event.head_commit.modified, 'notebooks') ||
|
|
contains(github.event.head_commit.modified, 'infra/marimo') ||
|
|
contains(github.event.head_commit.modified, 'infra/images/notebooks.Dockerfile')
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Scan notebooks
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build notebooks
|
|
run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
|
|
|
|
- name: Push notebooks
|
|
run: |
|
|
docker save local/notebooks:build -o /tmp/notebooks.tar
|
|
crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "notebooks" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
zotero:
|
|
runs-on: ubuntu-latest
|
|
if: >-
|
|
contains(github.event.head_commit.modified, 'infra/images/zotero.Dockerfile') ||
|
|
contains(github.event.head_commit.modified, 'infra/images/zotero')
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Scan zotero
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build zotero
|
|
run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
|
|
|
|
- name: Push zotero
|
|
run: |
|
|
docker save local/zotero:build -o /tmp/zotero.tar
|
|
crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "zotero" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
docs:
|
|
runs-on: ubuntu-latest
|
|
if: >-
|
|
contains(github.event.head_commit.modified, 'docs') ||
|
|
contains(github.event.head_commit.modified, 'infra/images/docs.Dockerfile')
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Scan docs
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build docs
|
|
run: docker build -f infra/images/docs.Dockerfile -t local/docs:build .
|
|
|
|
- name: Push docs
|
|
run: |
|
|
docker save local/docs:build -o /tmp/docs.tar
|
|
crane push /tmp/docs.tar git:3000/homelab/stack/docs:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/docs.tar git:3000/homelab/stack/docs:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "docs" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
api:
|
|
runs-on: ubuntu-latest
|
|
if: >-
|
|
contains(github.event.head_commit.modified, 'infra/images/api.Dockerfile') ||
|
|
contains(github.event.head_commit.modified, 'src') ||
|
|
contains(github.event.head_commit.modified, 'pyproject.toml')
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Scan api
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build api
|
|
run: docker build -f infra/images/api.Dockerfile -t local/api:build .
|
|
|
|
- name: Push api
|
|
run: |
|
|
docker save local/api:build -o /tmp/api.tar
|
|
crane push /tmp/api.tar git:3000/homelab/stack/api:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/api.tar git:3000/homelab/stack/api:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "api" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
mc:
|
|
runs-on: ubuntu-latest
|
|
if: >-
|
|
contains(github.event.head_commit.modified, 'infra/rustfs') ||
|
|
contains(github.event.head_commit.modified, 'infra/images/mc.Dockerfile')
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build mc
|
|
run: docker build -f infra/images/mc.Dockerfile -t local/mc:build infra/rustfs/
|
|
|
|
- name: Push mc
|
|
run: |
|
|
docker save local/mc:build -o /tmp/mc.tar
|
|
crane push /tmp/mc.tar git:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "mc" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
report:
|
|
runs-on: ubuntu-latest
|
|
needs: [notebooks, zotero, docs, api, mc]
|
|
if: always() && !cancelled()
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Report
|
|
# Only file an issue if at least one upstream build job failed.
|
|
# Without this gate api.diag.ci runs unconditionally and files
|
|
# a fake "failed" issue on every successful Deploy run.
|
|
if: contains(needs.*.result, 'failure')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "report" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|