84 lines
3 KiB
YAML
84 lines
3 KiB
YAML
# CD — build/push image vers le registry OCI Forgejo (pilote Phase 6).
|
|
# Même syntaxe GitHub/Forgejo. Le job Docker ne tourne que sur Forgejo
|
|
# (le miroir GitHub n'existe pas encore ; Docker Hub = job ultérieur).
|
|
#
|
|
# Image job = node:22-bookworm. DinD = sidecar 8 Gio (MPC-ADR-052).
|
|
# Push via Tailscale (hostAlias git.gregoiremureau.com → NAS),
|
|
# pas Cloudflare (limite body 100 Mo).
|
|
|
|
name: CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "deployment/api/**"
|
|
- ".github/workflows/cd.yml"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
build-and-push:
|
|
if: contains(github.server_url, 'gregoiremureau.com')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Docker CLI (client only) + daemon DinD
|
|
run: |
|
|
set -eu
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends ca-certificates curl
|
|
curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
|
|
| tar -xz -C /tmp
|
|
install /tmp/docker/docker /usr/local/bin/docker
|
|
docker version
|
|
docker info
|
|
|
|
- name: Login registry Forgejo
|
|
run: |
|
|
set -eu
|
|
REGISTRY="${GITHUB_SERVER_URL#https://}"
|
|
# GITHUB_TOKEN : login OK mais push → unauthorized: reqPackageAccess
|
|
echo "${{ secrets.PACKAGE_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
|
|
|
|
- name: Build and push
|
|
run: |
|
|
set -eu
|
|
REGISTRY="${GITHUB_SERVER_URL#https://}"
|
|
IMAGE="${REGISTRY}/grgmro/oc-p07-sentiment-api"
|
|
SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
|
|
# Client docker statique sans plugin buildx → builder classique.
|
|
export DOCKER_BUILDKIT=0
|
|
docker build \
|
|
-t "${IMAGE}:${SHORT_SHA}" \
|
|
-t "${IMAGE}:latest" \
|
|
-f deployment/api/Dockerfile \
|
|
deployment/api
|
|
docker push "${IMAGE}:${SHORT_SHA}"
|
|
docker push "${IMAGE}:latest"
|
|
echo "pushed ${IMAGE}:${SHORT_SHA} and :latest"
|
|
|
|
- name: Push Docker Hub (si secrets présents)
|
|
env:
|
|
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
|
|
DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
if [ -z "${DOCKER_HUB_TOKEN:-}" ] || [ -z "${DOCKER_HUB_USER:-}" ]; then
|
|
echo "Pas de secrets DOCKER_HUB_* : skip (prod k3s reste sur l'image Docker Hub existante)."
|
|
exit 0
|
|
fi
|
|
echo "${DOCKER_HUB_TOKEN}" | docker login docker.io -u "${DOCKER_HUB_USER}" --password-stdin
|
|
SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
|
|
SRC="${GITHUB_SERVER_URL#https://}/grgmro/oc-p07-sentiment-api"
|
|
DST="docker.io/${DOCKER_HUB_USER}/sentiment_api"
|
|
docker tag "${SRC}:latest" "${DST}:latest"
|
|
docker tag "${SRC}:latest" "${DST}:${SHORT_SHA}"
|
|
docker push "${DST}:latest"
|
|
docker push "${DST}:${SHORT_SHA}"
|
|
echo "pushed ${DST}:latest"
|