feat: adding multi-arch image builds and kubectl manifest deployment

AGENTS.md

@@ -20,6 +20,7 @@ Logs into the container registry, sets up SSH key for `docker-build.haven`, crea
 - `platforms` (default `linux/amd64,linux/arm64`) — target build platforms
 - `build_context` (default `.`) — Docker build context path
 - `build_dockerfile` (default `Dockerfile`) — Dockerfile path relative to context
+- `build_args` (default empty) — build arguments, one `KEY=VALUE` per line; each becomes a `--build-arg`
 - `docker_host` (default `docker-build.haven`) — remote builder hostname
 - `docker_user` (default `root`) — SSH user for remote builder
 
@@ -33,6 +34,19 @@ Validates `KUBE_CONFIG`, installs kubectl, and performs `rollout restart` of a K
 - `namespace` (default `default`) — Kubernetes namespace
 - `kube_version` (default `stable`) — kubectl version to download
 
+### `kubectl-apply` (`kubectl-apply/action.yaml`)
+
+Validates `KUBE_CONFIG`, installs kubectl, and applies Kubernetes manifest(s) that live inside the repository. This is the in-repo, k8s analog of `ssh-deploy`'s `compose_files`, and the recommended way to deploy manifest specs committed to the consuming repo. Pair it with `deploy-restart` when a restart is also required (Deployments); use it alone for CronJobs, Services, Ingresses, Secrets, etc.
+
+**Inputs:**
+- `kube_config` (required) — full kubeconfig YAML (use secrets)
+- `manifest` (default empty) — single manifest path (relative to repo root) to apply
+- `manifests` (default empty) — space-/comma-separated list of manifest paths; each applied with its own `kubectl apply -f`
+- `namespace` (default empty) — adds `-n <ns>` when non-empty (manifests may also self-declare their namespace)
+- `kube_version` (default `stable`) — kubectl version to download
+
+> At least one of `manifest`/`manifests` must be set. A path that does not exist in the repo fails the step — the manifest must be committed to the repo.
+
 ### `ssh-deploy` (`ssh-deploy/action.yaml`)
 
 SSH into a remote host, pull the latest images with `docker compose pull`, and recreate containers with `docker compose up -d --force-recreate`. Uses native `ssh`/`ssh-keyscan` — no third-party SSH action.
@@ -80,6 +94,12 @@ jobs:
     runs-on: ubuntu-amd64
     needs: build
     steps:
+      # Deployment specs live in the repo; apply them with kubectl-apply.
+      - uses: https://git.ivanch.me/ivanch/pipeline-actions/kubectl-apply@main
+        with:
+          kube_config: ${{ secrets.KUBE_CONFIG }}
+          manifest: deploy/<PROJECT_NAME>.yaml
+      # Restart the Deployment so the new image is rolled out.
       - uses: https://git.ivanch.me/ivanch/pipeline-actions/deploy-restart@main
         with:
           kube_config: ${{ secrets.KUBE_CONFIG }}
@@ -109,6 +129,7 @@ Consumer projects must set these secrets in Gitea repo settings (Settings → Ac
 - Always build `linux/amd64,linux/arm64` — the cluster has mixed arch (iris+vega=amd64, nebula+nexus=arm64).
 - Workflow files go in `.gitea/workflows/main.yaml` of the consuming project.
 - The consuming project must have a working `Dockerfile` at the repo root (or pass `build_dockerfile` input).
+- Kubernetes deploy specs are committed to the consuming repo (e.g. under `*/deploy/*.yaml`) and applied with `kubectl-apply`. Pass their repo-relative path via `manifest`/`manifests`. Do **not** write deploy specs inline in the workflow — they belong in the repo so they can be reviewed and versioned.
 
 ## Do Not
 

README.md

@@ -41,6 +41,7 @@ jobs:
 | `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms |
 | `build_context` | ❌ | `.` | Docker build context |
 | `build_dockerfile` | ❌ | `Dockerfile` | Dockerfile path |
+| `build_args` | ❌ | _(empty)_ | Build arguments, one `KEY=VALUE` per line; each becomes a `--build-arg` |
 | `docker_host` | ❌ | `docker-build.haven` | Remote builder hostname |
 | `docker_user` | ❌ | `root` | SSH user for remote builder |
 
@@ -72,6 +73,38 @@ jobs:
 | `namespace` | ❌ | `default` | Kubernetes namespace |
 | `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) |
 
+### `kubectl-apply`
+
+Validates a kubeconfig, installs kubectl, and applies Kubernetes manifest(s) that live inside the repository (the non-Docker, in-repo analog of `ssh-deploy`'s `compose_files`). Pair it with `deploy-restart` when you also want a rollout restart after the apply — or use it alone for resources that don't need a restart (CronJob, Service, Ingress, Secrets, etc.).
+
+```yaml
+jobs:
+  deploy:
+    runs-on: ubuntu-amd64
+    needs: build
+    steps:
+      - uses: https://git.ivanch.me/ivanch/pipeline-actions/kubectl-apply@main
+        with:
+          kube_config: ${{ secrets.KUBE_CONFIG }}
+          manifest: Mindforge.API/deploy/mindforge-api.yaml
+          # or apply several at once:
+          # manifests: deploy/svc.yaml,deploy/deployment.yaml
+          # optional:
+          # namespace: mindforge   # adds -n when set (manifests may also self-declare)
+```
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `kube_config` | ✅ | — | Full kubeconfig YAML (use secrets) |
+| `manifest` | ❌ | _(empty)_ | Single manifest path (relative to repo root) to apply |
+| `manifests` | ❌ | _(empty)_ | Space-/comma-separated list of manifest paths to apply (each gets its own `kubectl apply -f`) |
+| `namespace` | ❌ | _(empty)_ | Adds `-n <ns>` when non-empty; manifests may also declare their own namespace |
+| `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) |
+
+> At least one of `manifest` or `manifests` must be set; a missing file fails the step (the manifest must live in the repo).
+
+---
+
 ### `ssh-deploy`
 
 SSH into a remote host and run `docker compose pull` + `docker compose up -d --force-recreate` to deploy the latest images. No third-party SSH action — uses native `ssh` and `ssh-keyscan`.

build-and-push/action.yaml

@@ -32,6 +32,12 @@ inputs:
     description: Path to the Dockerfile (relative to context)
     required: false
     default: Dockerfile
+  build_args:
+    description: >-
+      Optional build arguments, one per line in KEY=VALUE form. Each line is
+      appended as a `--build-arg KEY=VALUE` to the build command.
+    required: false
+    default: ""
   ssh_key:
     description: SSH private key for the remote Docker builder host (pass via secrets)
     required: true
@@ -75,7 +81,7 @@ runs:
         # "context deadline exceeded" if the runner can't reach / auth to the
         # remote docker daemon over SSH. A hard `timeout` wrapper guarantees we
         # never hang: ConnectTimeout only bounds the TCP handshake.
-        echo "== probing ssh://${BUILDER_USER}@${BUILDER_HOST} =="
+        echo "== probing ssh://***@${BUILDER_HOST} =="
         if timeout 25 ssh \
              -o BatchMode=yes \
              -o ConnectTimeout=10 \
@@ -115,7 +121,7 @@ runs:
 
         docker context rm -f remote-builder 2>/dev/null || true
         docker context create remote-builder \
-          --docker "host=ssh://${BUILDER_USER}@${BUILDER_HOST}"
+          --docker "host=ssh://***@${BUILDER_HOST}"
 
         # Ensure qemu/binfmt is registered on the remote for cross-arch builds.
         # This registration lives in the kernel and is lost on daemon/host
@@ -147,6 +153,21 @@ runs:
         done
         echo "tag_args=${TAGS_ARGS}" >> "$GITHUB_OUTPUT"
 
+    - name: Generate build args
+      id: genbuildargs
+      shell: bash
+      env:
+        BUILD_ARGS_INPUT: ${{ inputs.build_args }}
+      run: |
+        ARGS=""
+        while IFS= read -r line; do
+          trimmed=$(echo "${line}" | xargs)
+          if [ -n "${trimmed}" ]; then
+            ARGS="${ARGS} --build-arg ${trimmed}"
+          fi
+        done <<< "${BUILD_ARGS_INPUT}"
+        echo "build_args=${ARGS}" >> "$GITHUB_OUTPUT"
+
     - name: Build and Push Multi-Arch Image
       shell: bash
       env:
@@ -154,6 +175,7 @@ runs:
         BUILD_DOCKERFILE: ${{ inputs.build_dockerfile }}
         PLATFORMS: ${{ inputs.platforms }}
         TAG_ARGS: ${{ steps.gentags.outputs.tag_args }}
+        BUILD_ARGS: ${{ steps.genbuildargs.outputs.build_args }}
       run: |
         unset DOCKER_HOST || true
         # Build on the remote daemon's default buildkit via the SSH context and
@@ -162,6 +184,7 @@ runs:
         docker --context remote-builder buildx build \
           --platform "${PLATFORMS}" \
           --file "${BUILD_CONTEXT}/${BUILD_DOCKERFILE}" \
+          ${BUILD_ARGS} \
           ${TAG_ARGS} \
           --push \
           "${BUILD_CONTEXT}"

kubectl-apply/action.yaml

@@ -0,0 +1,104 @@
+name: Kubectl Apply (in-repo manifests)
+description: Validate KUBE_CONFIG, install kubectl, and apply Kubernetes manifest(s) that live inside the repository.
+
+inputs:
+  kube_config:
+    description: Full kubeconfig YAML content (pass via secrets)
+    required: true
+  manifest:
+    description: Path (relative to repo root) of a single manifest file to apply. Usable alongside `manifests`.
+    required: false
+    default: ""
+  manifests:
+    description: >-
+      Space- or comma-separated list of manifest file paths (relative to repo
+      root) to apply. Each is applied with its own `kubectl apply -f`.
+    required: false
+    default: ""
+  namespace:
+    description: >-
+      Optional namespace override applied with `-n`. Manifests may also declare
+      their own namespace in metadata; this only adds `-n` when non-empty.
+    required: false
+    default: ""
+  kube_version:
+    description: Kubernetes version to download (stable, or a specific version like v1.31.0)
+    required: false
+    default: stable
+
+runs:
+  using: composite
+  steps:
+    - name: Check KUBE_CONFIG validity
+      shell: bash
+      env:
+        KUBE_CONFIG: ${{ inputs.kube_config }}
+      run: |
+        if [ -z "${KUBE_CONFIG}" ] || [ "${KUBE_CONFIG// }" = "" ]; then
+          echo "KUBE_CONFIG is not set or is empty."
+          exit 1
+        fi
+
+    - name: Check out repository
+      uses: actions/checkout@v4
+
+    - name: Download and install kubectl
+      shell: bash
+      env:
+        KUBE_VERSION: ${{ inputs.kube_version }}
+      run: |
+        apt-get update -y
+        apt-get install -y curl
+        if [ "${KUBE_VERSION}" = "stable" ]; then
+          KUBE_VER="$(curl -L -s https://dl.k8s.io/release/stable.txt)"
+        else
+          KUBE_VER="${KUBE_VERSION}"
+        fi
+        curl -LO "https://dl.k8s.io/release/${KUBE_VER}/bin/linux/amd64/kubectl"
+        install -m 0755 kubectl /usr/local/bin/kubectl
+        kubectl version --client
+
+    - name: Set up kubeconfig
+      shell: bash
+      env:
+        KUBE_CONFIG: ${{ inputs.kube_config }}
+      run: |
+        echo "${KUBE_CONFIG}" > kubeconfig.yaml
+        kubectl --kubeconfig=kubeconfig.yaml cluster-info
+
+    - name: Apply manifests
+      shell: bash
+      env:
+        MANIFEST: ${{ inputs.manifest }}
+        MANIFESTS: ${{ inputs.manifests }}
+        NAMESPACE: ${{ inputs.namespace }}
+      run: |
+        NS_FLAG=""
+        if [ -n "${NAMESPACE}" ] && [ "${NAMESPACE// }" != "" ]; then
+          NS_FLAG="-n ${NAMESPACE}"
+        fi
+
+        # Collect files from both inputs (manifests splits on comma or space).
+        FILES=""
+        if [ -n "${MANIFEST}" ] && [ "${MANIFEST// }" != "" ]; then
+          FILES="${FILES} ${MANIFEST}"
+        fi
+        if [ -n "${MANIFESTS}" ] && [ "${MANIFESTS// }" != "" ]; then
+          for f in $(echo "${MANIFESTS}" | tr ',' ' '); do
+            FILES="${FILES} ${f}"
+          done
+        fi
+
+        if [ -z "${FILES// }" ]; then
+          echo "::error::No manifest provided. Set the \`manifest\` or \`manifests\` input."
+          exit 1
+        fi
+
+        for f in ${FILES}; do
+          if [ ! -f "${f}" ]; then
+            echo "::error::Manifest not found in repo: ${f}"
+            exit 1
+          fi
+          echo "== applying ${f} =="
+          kubectl --kubeconfig=kubeconfig.yaml apply -f "${f}" ${NS_FLAG}
+        done