sops: add cache

Add GH runner caching for ephemeral runners

.gitea/workflows/build.yml

@@ -1,30 +0,0 @@
-name: build
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'images/**'
-      - '.gitea/workflows/build.yml'
-  schedule:
-    - cron: '0 4 * * 0' ## weekly sunday 04:00 UTC rebuild
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    container:
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-    steps:
-      - uses: actions/checkout@v7
-      - uses: docker/login-action@v4
-        with:
-          registry: git.studiovita.li
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v7
-        with:
-          context: images/act
-          push: true
-          tags: git.studiovita.li/studio/actions:ubuntu-latest

README.md

@@ -1,31 +0,0 @@
-# studiovitali/actions
-
-Shared Gitea Actions for studio CI workflows.
-
-## Composite actions
-
-- **[`sops`](sops/)** — install checksum-verified SOPS and decrypt `*.sops.*` files with an age key
-- **[`ssh-copy`](ssh-copy/)** — `rsync` a local directory to a remote host over SSH
-- **[`ssh-run`](ssh-run/)** — run a script on a remote host over SSH
-
-Reference a local action from a workflow:
-
-```yaml
-- uses: studio/actions/ssh-run@main
-  with:
-    host: ${{ secrets.HOST }}
-    user: deploy
-    key: ${{ secrets.SSH_KEY }}
-    script: ./deploy.sh
-```
-
-## Runner image
-
-`images/act` builds `git.studiovita.li/studio/actions:ubuntu-latest` from the Gitea
-runner image, adding `rsync` and SOPS. Built weekly and on `images/**` changes via
-[`.gitea/workflows/build.yml`](.gitea/workflows/build.yml).
-
-## Maintenance
-
-Dependencies pinned in `action.yml` / `Dockerfile` are updated by [Renovate](renovate.json)
-using `## renovate:` annotations.

backup/action.yml

@@ -0,0 +1,13 @@
+name: backup
+description: backup all postgres databases
+
+runs:
+  using: "composite"
+  steps:
+    - name: dump databases
+      shell: bash
+      run: |
+        docker ps
+
+    # - name: backup databases
+    #   run: |

images/act/Dockerfile

@@ -1,22 +0,0 @@
-## renovate: datasource=docker depName=docker.gitea.com/runner-images
-FROM docker.gitea.com/runner-images:ubuntu-latest@sha256:0e62e56b382ebf485bff1e51a05cbe27c708545a2e91425467fd31eb3e249521
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends rsync; \
-    rm -rf /var/lib/apt/lists/*; \
-    rsync --version
-
-## renovate: datasource=github-releases depName=getsops/sops
-ARG SOPS_VERSION=v3.13.3
-
-RUN set -eux; \
-    arch=$(dpkg --print-architecture); \
-    asset="sops-${SOPS_VERSION}.linux.${arch}"; \
-    url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"; \
-    curl -fsSL -o "/tmp/$asset" "$url/$asset"; \
-    curl -fsSL -o /tmp/checksums.txt "$url/sops-${SOPS_VERSION}.checksums.txt"; \
-    (cd /tmp && grep " ${asset}$" checksums.txt | sha256sum -c -); \
-    install -m 0755 "/tmp/$asset" /usr/local/bin/sops; \
-    rm -f "/tmp/$asset" /tmp/checksums.txt; \
-    sops --version

images/act/README.md

@@ -1,5 +0,0 @@
-# act runner image
-
-Gitea / Forgejo Actions runner image based on `runner-images:ubuntu-latest` with the pinned, checksum-verified SOPS build installed, plus `rsync` from apt.
-
-Built and pushed to `git.studiovita.li/studio/actions:ubuntu-latest` by the `build` workflow on push to `main`, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever `runner-images:ubuntu-latest` changes; update `SOPS_VERSION` in `Dockerfile` to bump SOPS (both tracked in renovate.json).

renovate.json

@@ -13,14 +13,6 @@
         "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)\\s+[A-Z0-9_]+\\s*:\\s*[\"']?(?<currentValue>[^\\s\"'#]+)[\"']?"
       ],
       "description": "match any pinned dependency using SCREAMING_SNAKE_CASE naming as ENV"
-    },
-    {
-      "customType": "regex",
-      "managerFilePatterns": ["**/Dockerfile"],
-      "matchStrings": [
-        "#+\\s*renovate:\\s*datasource=(?<datasource>[^\\s]+)\\s+depName=(?<depName>[^\\s]+)[ \\t]*\\n[ \\t]*ARG\\s+[A-Z0-9_]+=(?<currentValue>[^\\s\"'#]+)"
-      ],
-      "description": "match pinned ARG deps in Dockerfiles"
     }
   ]
 }

sops/README.md

@@ -2,4 +2,4 @@
 
 generate new age keys with `age-keygen -o ~/.config/sops/age/key-name.txt`. encrypt local secrets with `sops -e service-name/.env > service-name/.sops.env`.
 
-the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch (skipping the download when `sops` is already on `PATH`, e.g. on the custom `studio/actions:ubuntu-latest` runner image) and decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.
+the action installs the pinned, checksum-verified SOPS build for the runner's OS/arch, caching it under `$RUNNER_TEMP/sops` keyed on the version and runner platform so later runs skip the download. it then decrypts every `*.sops.*` file except `.sops.yaml`, writing `service-name/.sops.env` back to `service-name/.env` via a temp file and atomic move.

sops/action.yml

@@ -1,5 +1,5 @@
 name: decrypt SOPS secrets
-description: installs SOPS if missing and decrypts all *.sops.* files using an age key
+description: installs SOPS and decrypts all *.sops.* files using an age key
 
 inputs:
   sops-age-key:
@@ -9,7 +9,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: install SOPS
+    - name: resolve SOPS target
       shell: bash
       env:
         ## renovate: datasource=github-releases depName=getsops/sops
@@ -17,11 +17,29 @@ runs:
       run: |
         set -euo pipefail
 
-        command -v sops >/dev/null && exit 0
-
         os=$(uname -s | tr '[:upper:]' '[:lower:]')
         arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
-        asset="sops-${SOPS_VERSION}.${os}.${arch}"
+
+        {
+          echo "SOPS_VERSION=$SOPS_VERSION"
+          echo "SOPS_OS=$os"
+          echo "SOPS_ARCH=$arch"
+        } >> "$GITHUB_ENV"
+
+    - name: restore cached SOPS
+      id: sops-cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ runner.temp }}/sops
+        key: sops-${{ runner.os }}-${{ runner.arch }}-${{ env.SOPS_VERSION }}
+
+    - name: install SOPS
+      if: steps.sops-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        asset="sops-${SOPS_VERSION}.${SOPS_OS}.${SOPS_ARCH}"
         url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"
 
         tmp=$(mktemp -d)
@@ -31,8 +49,17 @@ runs:
           -o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
         (cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)
 
+        mkdir -p "$RUNNER_TEMP/sops"
         chmod +x "$tmp/$asset"
-        sudo mv "$tmp/$asset" /usr/local/bin/sops
+        mv "$tmp/$asset" "$RUNNER_TEMP/sops/sops"
+
+    - name: add SOPS to PATH
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        chmod +x "$RUNNER_TEMP/sops/sops"
+        echo "$RUNNER_TEMP/sops" >> "$GITHUB_PATH"
 
     - name: decrypt .sops files
       shell: bash
@@ -40,6 +67,7 @@ runs:
         SOPS_AGE_KEY: ${{ inputs.sops-age-key }}
       run: |
         set -euo pipefail
+
         echo "searching for SOPS files to decrypt..."
 
         while IFS= read -r -d '' file; do
@@ -47,7 +75,9 @@ runs:
           output_file="$dir/${base/.sops/}"
 
           echo "decrypting '$file' to '$output_file'"
+
           tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")
+
           if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
             echo "decryption of '$file' failed or produced empty output" >&2
             rm -f "$tmp"
@@ -57,4 +87,5 @@ runs:
           chmod 600 "$tmp"
           mv "$tmp" "$output_file"
         done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)
+
         echo "SOPS decryption complete."

ssh-copy/action.yml

@@ -24,15 +24,6 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: install rsync
-      shell: bash
-      run: |
-        set -euo pipefail
-        command -v rsync >/dev/null && exit 0
-
-        sudo apt-get -qq update
-        sudo apt-get -yqq install rsync
-
     - name: setup ssh
       shell: bash
       env:
@@ -42,10 +33,8 @@ runs:
       run: |
         set -euo pipefail
         mkdir -p ~/.ssh
-
         printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
-
         ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts
         chmod 600 ~/.ssh/known_hosts
 

ssh-run/action.yml

@@ -30,10 +30,8 @@ runs:
       run: |
         set -euo pipefail
         mkdir -p ~/.ssh
-
         printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
-
         ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts
         chmod 600 ~/.ssh/known_hosts