Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate
|
4069a65ef3 | ||
|
renovate
|
b27c39aea5 | ||
 alessandrovitali
|
760b4cdcae | ||
|
alessandrovitali
|
5f0c3b1306 | ||
|
alessandrovitali
|
598259ae9b | ||
|
alessandrovitali
|
c8d0506315 | ||
|
alessandrovitali
|
43ad6c4033 | ||
|
alessandrovitali
|
ba56591416 | ||
|
alessandrovitali
|
c0399df117 | ||
|
alessandrovitali
|
d03a144566 | ||
|
alessandrovitali
|
18b1fdb6b4 | ||
|
alessandrovitali
|
c8186c43c3 | ||
|
alessandrovitali
|
44a841af2e |
No files matched your search
@@ -0,0 +1,30 @@
|
||||
name: build
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths:
|
||||
- 'images/**'
|
||||
- '.gitea/workflows/build.yml'
|
||||
schedule:
|
||||
- cron: '0 4 * * 0' ## weekly sunday 04:00 UTC rebuild
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
- uses: docker/login-action@v4
|
||||
with:
|
||||
registry: git.studiovita.li
|
||||
username: ${{ secrets.REGISTRY_USERNAME }}
|
||||
password: ${{ secrets.REGISTRY_TOKEN }}
|
||||
- uses: docker/build-push-action@v7
|
||||
with:
|
||||
context: images/act
|
||||
push: true
|
||||
tags: git.studiovita.li/studio/actions:ubuntu-latest
|
||||
@@ -0,0 +1,31 @@
|
||||
# studiovitali/actions
|
||||
|
||||
Shared Gitea Actions for studio CI workflows.
|
||||
|
||||
## Composite actions
|
||||
|
||||
- **[`sops`](sops/)** — install checksum-verified SOPS and decrypt `*.sops.*` files with an age key
|
||||
- **[`ssh-copy`](ssh-copy/)** — `rsync` a local directory to a remote host over SSH
|
||||
- **[`ssh-run`](ssh-run/)** — run a script on a remote host over SSH
|
||||
|
||||
Reference a local action from a workflow:
|
||||
|
||||
```yaml
|
||||
- uses: studio/actions/ssh-run@main
|
||||
with:
|
||||
host: ${{ secrets.HOST }}
|
||||
user: deploy
|
||||
key: ${{ secrets.SSH_KEY }}
|
||||
script: ./deploy.sh
|
||||
```
|
||||
|
||||
## Runner image
|
||||
|
||||
`images/act` builds `git.studiovita.li/studio/actions:ubuntu-latest` from the Gitea
|
||||
runner image, adding `rsync` and SOPS. Built weekly and on `images/**` changes via
|
||||
[`.gitea/workflows/build.yml`](.gitea/workflows/build.yml).
|
||||
|
||||
## Maintenance
|
||||
|
||||
Dependencies pinned in `action.yml` / `Dockerfile` are updated by [Renovate](renovate.json)
|
||||
using `## renovate:` annotations.
|
||||
@@ -1,13 +0,0 @@
|
||||
name: backup
|
||||
description: backup all postgres databases
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: dump databases
|
||||
shell: bash
|
||||
run: |
|
||||
docker ps
|
||||
|
||||
# - name: backup databases
|
||||
# run: |
|
||||
@@ -0,0 +1,22 @@
|
||||
## renovate: datasource=docker depName=docker.gitea.com/runner-images
|
||||
FROM docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521
|
||||
|
||||
RUN set -eux; \
|
||||
apt-get update; \
|
||||
apt-get install -y --no-install-recommends rsync; \
|
||||
rm -rf /var/lib/apt/lists/*; \
|
||||
rsync --version
|
||||
|
||||
## renovate: datasource=github-releases depName=getsops/sops
|
||||
ARG SOPS_VERSION=v3.13.3
|
||||
|
||||
RUN set -eux; \
|
||||
arch=$(dpkg --print-architecture); \
|
||||
asset="sops-${SOPS_VERSION}.linux.${arch}"; \
|
||||
url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"; \
|
||||
curl -fsSL -o "/tmp/$asset" "$url/$asset"; \
|
||||
curl -fsSL -o /tmp/checksums.txt "$url/sops-${SOPS_VERSION}.checksums.txt"; \
|
||||
(cd /tmp && grep " ${asset}$" checksums.txt | sha256sum -c -); \
|
||||
install -m 0755 "/tmp/$asset" /usr/local/bin/sops; \
|
||||
rm -f "/tmp/$asset" /tmp/checksums.txt; \
|
||||
sops --version
|
||||
@@ -0,0 +1,5 @@
|
||||
# act runner image
|
||||
|
||||
Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt.
|
||||
|
||||
Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever `runner-images:ubuntu-latest` changes; update `SOPS_VERSION` in `Dockerfile` to bump SOPS (both tracked in renovate.json).
|
||||
@@ -13,6 +13,14 @@
|
||||
"#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+[A-Z0-9_]+\\s*:\\s*[\"']?(?<currentValue>[^\\s\"'#]+)[\"']?"
|
||||
],
|
||||
"description": "match any pinned dependency using SCREAMING_SNAKE_CASE naming as ENV"
|
||||
},
|
||||
{
|
||||
"customType": "regex",
|
||||
"managerFilePatterns": ["**/Dockerfile"],
|
||||
"matchStrings": [
|
||||
"#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)[ \\t]*\\n[ \\t]*ARG\\s+[A-Z0-9_]+=(?<currentValue>[^\\s\"'#]+)"
|
||||
],
|
||||
"description": "match pinned ARG deps in Dockerfiles"
|
||||
}
|
||||
]
|
||||
}
|
||||
+1
-1
@@ -2,4 +2,4 @@
|
||||
|
||||
generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`.
|
||||
|
||||
the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
|
||||
the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch (skipping the download when `sops` is already on `PATH`, e.g. on the custom `studio/actions:ubuntu-latest` runner image) and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
|
||||
+3
-5
@@ -1,5 +1,5 @@
|
||||
name: decrypt SOPS secrets
|
||||
description: installs SOPS and decrypts all *.sops.* files using an age key
|
||||
description: installs SOPS if missing and decrypts all *.sops.* files using an age key
|
||||
|
||||
inputs:
|
||||
sops-age-key:
|
||||
@@ -17,6 +17,8 @@ runs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
command -v sops >/dev/null && exit 0
|
||||
|
||||
os=$(uname -s | tr '[:upper:]' '[:lower:]')
|
||||
arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
|
||||
asset="sops-${SOPS_VERSION}.${os}.${arch}"
|
||||
@@ -38,7 +40,6 @@ runs:
|
||||
SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "searching for SOPS files to decrypt..."
|
||||
|
||||
while IFS= read -r -d '' file; do
|
||||
@@ -46,9 +47,7 @@ runs:
|
||||
output_file="$dir/${base/.sops/}"
|
||||
|
||||
echo "decrypting '$file' to '$output_file'"
|
||||
|
||||
tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")
|
||||
|
||||
if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
|
||||
echo "decryption of '$file' failed or produced empty output" >&2
|
||||
rm -f "$tmp"
|
||||
@@ -58,5 +57,4 @@ runs:
|
||||
chmod 600 "$tmp"
|
||||
mv "$tmp" "$output_file"
|
||||
done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)
|
||||
|
||||
echo "SOPS decryption complete."
|
||||
@@ -24,6 +24,15 @@ inputs:
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: install rsync
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
command -v rsync >/dev/null && exit 0
|
||||
|
||||
sudo apt-get -qq update
|
||||
sudo apt-get -yqq install rsync
|
||||
|
||||
- name: setup ssh
|
||||
shell: bash
|
||||
env:
|
||||
@@ -33,8 +42,10 @@ runs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
|
||||
printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
|
||||
ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts
|
||||
chmod 600 ~/.ssh/known_hosts
|
||||
|
||||
|
||||
@@ -30,8 +30,10 @@ runs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p ~/.ssh
|
||||
|
||||
printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
|
||||
ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts
|
||||
chmod 600 ~/.ssh/known_hosts
|
||||
|
||||
|
||||
Reference in new issue
Block a user