Grégoire Mureau
c8943cf7e2
Public READMEs now expose a single git.gregoiremureau.com clone URL. The Tailscale SSH form only works on the homelab network and leaked the NAS address. The language switcher sits right under the title so an English speaker landing on the French page can leave without reading French.
84 lines
3.1 KiB
YAML
84 lines
3.1 KiB
YAML
# CD — build/push image vers le registry OCI Forgejo (pilote Phase 6).
|
|
# Même syntaxe GitHub/Forgejo. Le job Docker ne tourne que sur Forgejo
|
|
# (le miroir GitHub n'existe pas encore ; Docker Hub = job ultérieur).
|
|
#
|
|
# Image job = node:22-bookworm. DinD = sidecar 8 Gio (MPC-ADR-052).
|
|
# Push via Tailscale (runner hostAlias git.gregoiremureau.com → NAS),
|
|
# pas Cloudflare (limite body 100 Mo).
|
|
|
|
name: CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "deployment/api/**"
|
|
- ".github/workflows/cd.yml"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
build-and-push:
|
|
if: contains(github.server_url, 'gregoiremureau.com')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Docker CLI (client only) + daemon DinD
|
|
run: |
|
|
set -eu
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends ca-certificates curl
|
|
curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
|
|
| tar -xz -C /tmp
|
|
install /tmp/docker/docker /usr/local/bin/docker
|
|
docker version
|
|
docker info
|
|
|
|
- name: Login registry Forgejo
|
|
run: |
|
|
set -eu
|
|
REGISTRY="${GITHUB_SERVER_URL#https://}"
|
|
# GITHUB_TOKEN : login OK mais push → unauthorized: reqPackageAccess
|
|
echo "${{ secrets.PACKAGE_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
|
|
|
|
- name: Build and push
|
|
run: |
|
|
set -eu
|
|
REGISTRY="${GITHUB_SERVER_URL#https://}"
|
|
IMAGE="${REGISTRY}/openclassroom-ai/oc-p07-sentiment-api"
|
|
SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
|
|
# Client docker statique sans plugin buildx → builder classique.
|
|
export DOCKER_BUILDKIT=0
|
|
docker build \
|
|
-t "${IMAGE}:${SHORT_SHA}" \
|
|
-t "${IMAGE}:latest" \
|
|
-f deployment/api/Dockerfile \
|
|
deployment/api
|
|
docker push "${IMAGE}:${SHORT_SHA}"
|
|
docker push "${IMAGE}:latest"
|
|
echo "pushed ${IMAGE}:${SHORT_SHA} and :latest"
|
|
|
|
- name: Push Docker Hub (si secrets présents)
|
|
env:
|
|
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
|
|
DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
if [ -z "${DOCKER_HUB_TOKEN:-}" ] || [ -z "${DOCKER_HUB_USER:-}" ]; then
|
|
echo "Pas de secrets DOCKER_HUB_* : skip (prod k3s reste sur l'image Docker Hub existante)."
|
|
exit 0
|
|
fi
|
|
echo "${DOCKER_HUB_TOKEN}" | docker login docker.io -u "${DOCKER_HUB_USER}" --password-stdin
|
|
SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
|
|
SRC="${GITHUB_SERVER_URL#https://}/openclassroom-ai/oc-p07-sentiment-api"
|
|
DST="docker.io/${DOCKER_HUB_USER}/sentiment_api"
|
|
docker tag "${SRC}:latest" "${DST}:latest"
|
|
docker tag "${SRC}:latest" "${DST}:${SHORT_SHA}"
|
|
docker push "${DST}:latest"
|
|
docker push "${DST}:${SHORT_SHA}"
|
|
echo "pushed ${DST}:latest"
|