# pipeline-actions — Agent Guide

## Overview

This repo provides reusable Gitea composite actions for homelab CI/CD pipelines. Actions are consumed by other projects via `uses: ivanch/pipeline-actions/<action>@main`.

## Actions

### `build-and-push` (`build-and-push/action.yaml`)

Logs into the container registry, sets up SSH key for `docker-build.haven`, creates a remote Buildx context over SSH, and builds + pushes a multi-arch Docker image.

**Inputs:**
- `image` (required) — full image ref without tag (`:latest` appended)
- `registry_password` (required) — registry password/token (use secrets)
- `ssh_key` (required) — SSH private key for remote builder (use secrets)
- `registry_host` (default `git.ivanch.me`) — container registry hostname
- `registry_username` (default `ivanch`) — registry username
- `platforms` (default `linux/amd64,linux/arm64`) — target build platforms
- `build_context` (default `.`) — Docker build context path
- `build_dockerfile` (default `Dockerfile`) — Dockerfile path relative to context
- `docker_host` (default `docker-build.haven`) — remote builder hostname
- `docker_user` (default `root`) — SSH user for remote builder

### `deploy-restart` (`deploy-restart/action.yaml`)

Validates `KUBE_CONFIG`, installs kubectl, and performs `rollout restart` of a Kubernetes Deployment.

**Inputs:**
- `kube_config` (required) — full kubeconfig YAML (use secrets)
- `deployment_name` (required) — Deployment name to restart
- `namespace` (default `default`) — Kubernetes namespace
- `kube_version` (default `stable`) — kubectl version to download

## Workflow Template for New Projects

When wiring up CI/CD for a new homelab project, create `.gitea/workflows/main.yaml`:

```yaml
name: Build and Deploy (internal)

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

env:
  IMAGE: git.ivanch.me/ivanch/<PROJECT_NAME>

jobs:
  build:
    name: Build Image
    runs-on: ubuntu-amd64
    steps:
      - uses: actions/checkout@v4
      - uses: ivanch/pipeline-actions/build-and-push@main
        with:
          image: ${{ env.IMAGE }}
          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}

  deploy:
    name: Deploy (internal)
    runs-on: ubuntu-amd64
    needs: build
    steps:
      - uses: ivanch/pipeline-actions/deploy-restart@main
        with:
          kube_config: ${{ secrets.KUBE_CONFIG }}
          deployment_name: <DEPLOYMENT_NAME>
          namespace: <NAMESPACE>
```

## Required Secrets

Consumer projects must set these secrets in Gitea repo settings (Settings → Actions → Secrets):

| Secret | Purpose |
|---|---|
| `REGISTRY_PASSWORD` | Container registry password/token for `git.ivanch.me` |
| `SSH_KEY_DOCKERBUILD` | SSH private key for `root@docker-build.haven` |
| `KUBE_CONFIG` | Full kubeconfig YAML for k8s cluster access |

## Rules

- Pin composite action refs to `@main` until version tags are created.
- Always use `runs-on: ubuntu-amd64` (homelab Gitea runner label).
- Always build `linux/amd64,linux/arm64` — the cluster has mixed arch (iris+vega=amd64, nebula+nexus=arm64).
- Workflow files go in `.gitea/workflows/main.yaml` of the consuming project.
- The consuming project must have a working `Dockerfile` at the repo root (or pass `build_dockerfile` input).

## Do Not

- Do not add GitHub Actions workflows — these are Gitea composite actions only.
- Do not hardcode secrets in workflow files — always use `${{ secrets.* }}`.
- Do not override `platforms` to a single arch unless there's a specific reason.
- Do not vendor dependencies — consumers reference this repo via `uses:`.