diff --git a/AGENTS.md b/AGENTS.md index 4a96b82..e3849ab 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,6 +20,7 @@ Logs into the container registry, sets up SSH key for `docker-build.haven`, crea - `platforms` (default `linux/amd64,linux/arm64`) — target build platforms - `build_context` (default `.`) — Docker build context path - `build_dockerfile` (default `Dockerfile`) — Dockerfile path relative to context +- `build_args` (default empty) — build arguments, one `KEY=VALUE` per line; each becomes a `--build-arg` - `docker_host` (default `docker-build.haven`) — remote builder hostname - `docker_user` (default `root`) — SSH user for remote builder @@ -33,6 +34,19 @@ Validates `KUBE_CONFIG`, installs kubectl, and performs `rollout restart` of a K - `namespace` (default `default`) — Kubernetes namespace - `kube_version` (default `stable`) — kubectl version to download +### `kubectl-apply` (`kubectl-apply/action.yaml`) + +Validates `KUBE_CONFIG`, installs kubectl, and applies Kubernetes manifest(s) that live inside the repository. This is the in-repo, k8s analog of `ssh-deploy`'s `compose_files`, and the recommended way to deploy manifest specs committed to the consuming repo. Pair it with `deploy-restart` when a restart is also required (Deployments); use it alone for CronJobs, Services, Ingresses, Secrets, etc. + +**Inputs:** +- `kube_config` (required) — full kubeconfig YAML (use secrets) +- `manifest` (default empty) — single manifest path (relative to repo root) to apply +- `manifests` (default empty) — space-/comma-separated list of manifest paths; each applied with its own `kubectl apply -f` +- `namespace` (default empty) — adds `-n ` when non-empty (manifests may also self-declare their namespace) +- `kube_version` (default `stable`) — kubectl version to download + +> At least one of `manifest`/`manifests` must be set. A path that does not exist in the repo fails the step — the manifest must be committed to the repo. + ### `ssh-deploy` (`ssh-deploy/action.yaml`) SSH into a remote host, pull the latest images with `docker compose pull`, and recreate containers with `docker compose up -d --force-recreate`. Uses native `ssh`/`ssh-keyscan` — no third-party SSH action. @@ -80,6 +94,12 @@ jobs: runs-on: ubuntu-amd64 needs: build steps: + # Deployment specs live in the repo; apply them with kubectl-apply. + - uses: https://git.ivanch.me/ivanch/pipeline-actions/kubectl-apply@main + with: + kube_config: ${{ secrets.KUBE_CONFIG }} + manifest: deploy/.yaml + # Restart the Deployment so the new image is rolled out. - uses: https://git.ivanch.me/ivanch/pipeline-actions/deploy-restart@main with: kube_config: ${{ secrets.KUBE_CONFIG }} @@ -109,6 +129,7 @@ Consumer projects must set these secrets in Gitea repo settings (Settings → Ac - Always build `linux/amd64,linux/arm64` — the cluster has mixed arch (iris+vega=amd64, nebula+nexus=arm64). - Workflow files go in `.gitea/workflows/main.yaml` of the consuming project. - The consuming project must have a working `Dockerfile` at the repo root (or pass `build_dockerfile` input). +- Kubernetes deploy specs are committed to the consuming repo (e.g. under `*/deploy/*.yaml`) and applied with `kubectl-apply`. Pass their repo-relative path via `manifest`/`manifests`. Do **not** write deploy specs inline in the workflow — they belong in the repo so they can be reviewed and versioned. ## Do Not diff --git a/README.md b/README.md index 93c61b5..aac9022 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ jobs: | `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms | | `build_context` | ❌ | `.` | Docker build context | | `build_dockerfile` | ❌ | `Dockerfile` | Dockerfile path | +| `build_args` | ❌ | _(empty)_ | Build arguments, one `KEY=VALUE` per line; each becomes a `--build-arg` | | `docker_host` | ❌ | `docker-build.haven` | Remote builder hostname | | `docker_user` | ❌ | `root` | SSH user for remote builder | @@ -72,6 +73,38 @@ jobs: | `namespace` | ❌ | `default` | Kubernetes namespace | | `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) | +### `kubectl-apply` + +Validates a kubeconfig, installs kubectl, and applies Kubernetes manifest(s) that live inside the repository (the non-Docker, in-repo analog of `ssh-deploy`'s `compose_files`). Pair it with `deploy-restart` when you also want a rollout restart after the apply — or use it alone for resources that don't need a restart (CronJob, Service, Ingress, Secrets, etc.). + +```yaml +jobs: + deploy: + runs-on: ubuntu-amd64 + needs: build + steps: + - uses: https://git.ivanch.me/ivanch/pipeline-actions/kubectl-apply@main + with: + kube_config: ${{ secrets.KUBE_CONFIG }} + manifest: Mindforge.API/deploy/mindforge-api.yaml + # or apply several at once: + # manifests: deploy/svc.yaml,deploy/deployment.yaml + # optional: + # namespace: mindforge # adds -n when set (manifests may also self-declare) +``` + +| Input | Required | Default | Description | +|---|---|---|---| +| `kube_config` | ✅ | — | Full kubeconfig YAML (use secrets) | +| `manifest` | ❌ | _(empty)_ | Single manifest path (relative to repo root) to apply | +| `manifests` | ❌ | _(empty)_ | Space-/comma-separated list of manifest paths to apply (each gets its own `kubectl apply -f`) | +| `namespace` | ❌ | _(empty)_ | Adds `-n ` when non-empty; manifests may also declare their own namespace | +| `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) | + +> At least one of `manifest` or `manifests` must be set; a missing file fails the step (the manifest must live in the repo). + +--- + ### `ssh-deploy` SSH into a remote host and run `docker compose pull` + `docker compose up -d --force-recreate` to deploy the latest images. No third-party SSH action — uses native `ssh` and `ssh-keyscan`. diff --git a/build-and-push/action.yaml b/build-and-push/action.yaml index f309e89..9b5d8f2 100644 --- a/build-and-push/action.yaml +++ b/build-and-push/action.yaml @@ -32,6 +32,12 @@ inputs: description: Path to the Dockerfile (relative to context) required: false default: Dockerfile + build_args: + description: >- + Optional build arguments, one per line in KEY=VALUE form. Each line is + appended as a `--build-arg KEY=VALUE` to the build command. + required: false + default: "" ssh_key: description: SSH private key for the remote Docker builder host (pass via secrets) required: true @@ -75,7 +81,7 @@ runs: # "context deadline exceeded" if the runner can't reach / auth to the # remote docker daemon over SSH. A hard `timeout` wrapper guarantees we # never hang: ConnectTimeout only bounds the TCP handshake. - echo "== probing ssh://${BUILDER_USER}@${BUILDER_HOST} ==" + echo "== probing ssh://***@${BUILDER_HOST} ==" if timeout 25 ssh \ -o BatchMode=yes \ -o ConnectTimeout=10 \ @@ -115,7 +121,7 @@ runs: docker context rm -f remote-builder 2>/dev/null || true docker context create remote-builder \ - --docker "host=ssh://${BUILDER_USER}@${BUILDER_HOST}" + --docker "host=ssh://***@${BUILDER_HOST}" # Ensure qemu/binfmt is registered on the remote for cross-arch builds. # This registration lives in the kernel and is lost on daemon/host @@ -147,6 +153,21 @@ runs: done echo "tag_args=${TAGS_ARGS}" >> "$GITHUB_OUTPUT" + - name: Generate build args + id: genbuildargs + shell: bash + env: + BUILD_ARGS_INPUT: ${{ inputs.build_args }} + run: | + ARGS="" + while IFS= read -r line; do + trimmed=$(echo "${line}" | xargs) + if [ -n "${trimmed}" ]; then + ARGS="${ARGS} --build-arg ${trimmed}" + fi + done <<< "${BUILD_ARGS_INPUT}" + echo "build_args=${ARGS}" >> "$GITHUB_OUTPUT" + - name: Build and Push Multi-Arch Image shell: bash env: @@ -154,6 +175,7 @@ runs: BUILD_DOCKERFILE: ${{ inputs.build_dockerfile }} PLATFORMS: ${{ inputs.platforms }} TAG_ARGS: ${{ steps.gentags.outputs.tag_args }} + BUILD_ARGS: ${{ steps.genbuildargs.outputs.build_args }} run: | unset DOCKER_HOST || true # Build on the remote daemon's default buildkit via the SSH context and @@ -162,6 +184,7 @@ runs: docker --context remote-builder buildx build \ --platform "${PLATFORMS}" \ --file "${BUILD_CONTEXT}/${BUILD_DOCKERFILE}" \ + ${BUILD_ARGS} \ ${TAG_ARGS} \ --push \ "${BUILD_CONTEXT}" diff --git a/kubectl-apply/action.yaml b/kubectl-apply/action.yaml new file mode 100644 index 0000000..c9e38a3 --- /dev/null +++ b/kubectl-apply/action.yaml @@ -0,0 +1,104 @@ +name: Kubectl Apply (in-repo manifests) +description: Validate KUBE_CONFIG, install kubectl, and apply Kubernetes manifest(s) that live inside the repository. + +inputs: + kube_config: + description: Full kubeconfig YAML content (pass via secrets) + required: true + manifest: + description: Path (relative to repo root) of a single manifest file to apply. Usable alongside `manifests`. + required: false + default: "" + manifests: + description: >- + Space- or comma-separated list of manifest file paths (relative to repo + root) to apply. Each is applied with its own `kubectl apply -f`. + required: false + default: "" + namespace: + description: >- + Optional namespace override applied with `-n`. Manifests may also declare + their own namespace in metadata; this only adds `-n` when non-empty. + required: false + default: "" + kube_version: + description: Kubernetes version to download (stable, or a specific version like v1.31.0) + required: false + default: stable + +runs: + using: composite + steps: + - name: Check KUBE_CONFIG validity + shell: bash + env: + KUBE_CONFIG: ${{ inputs.kube_config }} + run: | + if [ -z "${KUBE_CONFIG}" ] || [ "${KUBE_CONFIG// }" = "" ]; then + echo "KUBE_CONFIG is not set or is empty." + exit 1 + fi + + - name: Check out repository + uses: actions/checkout@v4 + + - name: Download and install kubectl + shell: bash + env: + KUBE_VERSION: ${{ inputs.kube_version }} + run: | + apt-get update -y + apt-get install -y curl + if [ "${KUBE_VERSION}" = "stable" ]; then + KUBE_VER="$(curl -L -s https://dl.k8s.io/release/stable.txt)" + else + KUBE_VER="${KUBE_VERSION}" + fi + curl -LO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/amd64/kubectl" + install -m 0755 kubectl /usr/local/bin/kubectl + kubectl version --client + + - name: Set up kubeconfig + shell: bash + env: + KUBE_CONFIG: ${{ inputs.kube_config }} + run: | + echo "${KUBE_CONFIG}" > kubeconfig.yaml + kubectl --kubeconfig=kubeconfig.yaml cluster-info + + - name: Apply manifests + shell: bash + env: + MANIFEST: ${{ inputs.manifest }} + MANIFESTS: ${{ inputs.manifests }} + NAMESPACE: ${{ inputs.namespace }} + run: | + NS_FLAG="" + if [ -n "${NAMESPACE}" ] && [ "${NAMESPACE// }" != "" ]; then + NS_FLAG="-n ${NAMESPACE}" + fi + + # Collect files from both inputs (manifests splits on comma or space). + FILES="" + if [ -n "${MANIFEST}" ] && [ "${MANIFEST// }" != "" ]; then + FILES="${FILES} ${MANIFEST}" + fi + if [ -n "${MANIFESTS}" ] && [ "${MANIFESTS// }" != "" ]; then + for f in $(echo "${MANIFESTS}" | tr ',' ' '); do + FILES="${FILES} ${f}" + done + fi + + if [ -z "${FILES// }" ]; then + echo "::error::No manifest provided. Set the \`manifest\` or \`manifests\` input." + exit 1 + fi + + for f in ${FILES}; do + if [ ! -f "${f}" ]; then + echo "::error::Manifest not found in repo: ${f}" + exit 1 + fi + echo "== applying ${f} ==" + kubectl --kubeconfig=kubeconfig.yaml apply -f "${f}" ${NS_FLAG} + done