# pipeline-actions

Reusable composite actions for Gitea Actions CI/CD pipelines in the homelab.

## Actions

### `build-and-push`

Builds and pushes a multi-architecture Docker image using a remote Buildx builder over SSH.

```yaml
jobs:
  build:
    runs-on: ubuntu-amd64
    steps:
      - uses: actions/checkout@v4
      - uses: ivanch/pipeline-actions/build-and-push@main
        with:
          image: git.ivanch.me/ivanch/my-app
          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}
          # optional — these have sensible defaults:
          # registry_host: git.ivanch.me
          # registry_username: ivanch
          # platforms: linux/amd64,linux/arm64
          # build_context: .
          # build_dockerfile: Dockerfile
          # docker_host: docker-build.haven
          # docker_user: root
```

| Input | Required | Default | Description |
|---|---|---|---|
| `image` | ✅ | — | Full image reference without tag (`:latest` is appended) |
| `registry_password` | ✅ | — | Registry password/token (use secrets) |
| `ssh_key` | ✅ | — | SSH private key for the remote builder (use secrets) |
| `registry_host` | ❌ | `git.ivanch.me` | Container registry hostname |
| `registry_username` | ❌ | `ivanch` | Registry username |
| `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms |
| `build_context` | ❌ | `.` | Docker build context |
| `build_dockerfile` | ❌ | `Dockerfile` | Dockerfile path |
| `docker_host` | ❌ | `docker-build.haven` | Remote builder hostname |
| `docker_user` | ❌ | `root` | SSH user for remote builder |

---

### `deploy-restart`

Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a Kubernetes Deployment.

```yaml
jobs:
  deploy:
    runs-on: ubuntu-amd64
    needs: build
    steps:
      - uses: ivanch/pipeline-actions/deploy-restart@main
        with:
          kube_config: ${{ secrets.KUBE_CONFIG }}
          deployment_name: my-app
          # optional:
          # namespace: default
          # kube_version: stable
```

| Input | Required | Default | Description |
|---|---|---|---|
| `kube_config` | ✅ | — | Full kubeconfig YAML (use secrets) |
| `deployment_name` | ✅ | — | Deployment name to restart |
| `namespace` | ❌ | `default` | Kubernetes namespace |
| `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) |

## Required Secrets

Consumer repositories need these secrets configured in Gitea:

| Secret | Used by | Purpose |
|---|---|---|
| `REGISTRY_PASSWORD` | `build-and-push` | Container registry password/token |
| `SSH_KEY_DOCKERBUILD` | `build-and-push` | SSH private key for `docker-build.haven` |
| `KUBE_CONFIG` | `deploy-restart` | Full kubeconfig YAML for cluster access |