more updates

2026-06-29 15:14:55 +10:00
parent 01223c176f
commit 4ee1b9e13c
15 changed files with 1155 additions and 832 deletions
@@ -23,9 +23,8 @@ type GiteaActionsOptions struct {
 // that builds the Docker image and deploys to each environment
 // using kforge generate + kubectl apply.
 //
-// The generated file is designed to replace your existing
-// hand-written workflow. It assumes kforge is available in the
-// PATH (either pre-installed on the runner or fetched as a step).
+// DNS is handled by external-dns via Ingress annotations — no
+// separate DNS step is needed in the workflow.
 func GenerateGiteaActions(cfg *config.KforgeConfig, opts GiteaActionsOptions) (string, error) {
 	if opts.Branch == "" {
 		opts.Branch = "main"
@@ -39,20 +38,19 @@ func GenerateGiteaActions(cfg *config.KforgeConfig, opts GiteaActionsOptions) (s

 	var b strings.Builder

-	writeGiteaHeader(&b, cfg, opts)
-	writeGiteaJobs(&b, cfg, opts)
+	writeDeployHeader(&b, cfg, opts)
+	writeDeployJobs(&b, cfg, opts)

 	return b.String(), nil
 }

-func writeGiteaHeader(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
+func writeDeployHeader(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
 	fmt.Fprintf(b, "# Generated by kforge — do not edit manually.\n")
 	fmt.Fprintf(b, "# Re-generate: kforge gitea-actions > .gitea/workflows/deploy.yml\n")
 	fmt.Fprintf(b, "#\n")
 	fmt.Fprintf(b, "# Required Gitea org secrets:\n")
-	fmt.Fprintf(b, "#   DOCKER_USERNAME, DOCKER_PASSWORD, KFORGE_NODE_IP\n")
-	fmt.Fprintf(b, "#   CLOUDFLARE_API_TOKEN, CF_ZONE_ID_* (per zone)\n")
-	fmt.Fprintf(b, "#   SOPS_AGE_KEY\n")
+	fmt.Fprintf(b, "#   DOCKER_USERNAME, DOCKER_PASSWORD\n")
+	fmt.Fprintf(b, "#   KFORGE_NODE_IP  (external-dns annotation target)\n")
 	fmt.Fprintf(b, "# Required Gitea repo secrets:\n")
 	fmt.Fprintf(b, "#   KUBE_HOST, KUBE_TOKEN, KUBE_CERTIFICATE\n")
 	fmt.Fprintf(b, "\n")
@@ -65,30 +63,21 @@ func writeGiteaHeader(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAc
 	fmt.Fprintf(b, "\n")
 }

-func writeGiteaJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
+func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
 	fmt.Fprintf(b, "jobs:\n")
 	fmt.Fprintf(b, "  build-and-deploy:\n")
 	fmt.Fprintf(b, "    runs-on: ubuntu-latest\n")
 	fmt.Fprintf(b, "    steps:\n")

-	// Checkout
 	writeStep(b, "Checkout", map[string]any{
 		"uses": "actions/checkout@v4",
 		"with": map[string]any{"fetch-depth": 0},
 	})

-	// Node (optional — only if package.json exists)
-	writeStep(b, "Setup Node", map[string]any{
-		"uses": "actions/setup-node@v4",
-		"with": map[string]any{"node-version": opts.NodeVersion},
-	})
-
-	// Short SHA
 	writeStep(b, "Create short commit hash", map[string]any{
 		"run": `echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV`,
 	})

-	// Docker login
 	writeStep(b, "Login to registry", map[string]any{
 		"uses": "docker/login-action@v2",
 		"with": map[string]any{
@@ -98,7 +87,6 @@ func writeGiteaJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActi
 		},
 	})

-	// Docker build + push
 	fullRepo := cfg.Registry.URL + "/" + cfg.Meta.Tenant + "/" + cfg.Meta.Name
 	writeStep(b, "Build and push image", map[string]any{
 		"uses": "docker/build-push-action@v5",
@@ -113,12 +101,10 @@ func writeGiteaJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActi
 		},
 	})

-	// Install kforge on runner
 	writeStep(b, "Install kforge", map[string]any{
 		"run": "KFORGE_VERSION=\"latest\"\ncurl -fsSL \"https://kforge/releases/download/${KFORGE_VERSION}/kforge-linux-amd64\" -o /usr/local/bin/kforge\nchmod +x /usr/local/bin/kforge",
 	})

-	// Per-environment deploy steps
 	for _, envKey := range opts.Environments {
 		env, err := config.ResolveEnvironment(cfg, envKey)
 		if err != nil {
@@ -129,45 +115,26 @@ func writeGiteaJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActi
 }

 func writeEnvDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, env *config.ResolvedEnvironment, envKey string) {
-	label := strings.Title(envKey) //nolint:staticcheck // simple capitalisation
+	label := strings.Title(envKey) //nolint:staticcheck

-	// Validate kforge config before doing anything destructive.
 	writeStep(b, fmt.Sprintf("Validate kforge config (%s)", label), map[string]any{
 		"run": "kforge validate",
-		"env": giteaSecretEnv(),
+		"env": giteaNodeIPEnv(),
 	})

-	// Apply cluster secrets (only creates if missing — idempotent).
 	writeStep(b, fmt.Sprintf("Apply cluster secrets (%s)", label), map[string]any{
 		"run": fmt.Sprintf("kforge secrets apply --env %s", envKey),
 		"env": giteaKubeEnv(),
 	})

-	// DNS records
-	hasDNSHosts := false
-	for _, h := range env.Ingress.Hosts {
-		if h.DNSRecord {
-			hasDNSHosts = true
-			break
-		}
-	}
-	if hasDNSHosts && !cfg.DNS.SkipDNS {
-		writeStep(b, fmt.Sprintf("Ensure DNS records (%s)", label), map[string]any{
-			"run": fmt.Sprintf("kforge dns ensure --env %s", envKey),
-			"env": mergeMaps(giteaSecretEnv(), giteaKubeEnv()),
-		})
-	}
-
-	// Generate manifests
 	writeStep(b, fmt.Sprintf("Generate manifests (%s)", label), map[string]any{
 		"run": fmt.Sprintf(
 			"kforge generate --env %s --output .kforge-out --set image_tag=${{ env.SHORT_SHA }}",
 			envKey,
 		),
-		"env": giteaSecretEnv(),
+		"env": giteaNodeIPEnv(),
 	})

-	// kubectl apply
 	writeStep(b, fmt.Sprintf("Apply manifests (%s)", label), map[string]any{
 		"uses": "actions-hub/kubectl@master",
 		"env":  giteaKubeEnv(),
@@ -179,7 +146,6 @@ func writeEnvDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, env *conf
 		},
 	})

-	// Apply infra manifests if any infrastructure is enabled
 	infra := env.Infrastructure
 	if infra.Database != nil || infra.Cache != nil || infra.Storage != nil ||
 		infra.Queue != nil || infra.Search != nil || infra.Monitoring != nil {
@@ -195,7 +161,6 @@ func writeEnvDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, env *conf
 		})
 	}

-	// Rollout restart
 	writeStep(b, fmt.Sprintf("Rollout restart (%s)", label), map[string]any{
 		"uses": "actions-hub/kubectl@master",
 		"env":  giteaKubeEnv(),
@@ -208,11 +173,143 @@ func writeEnvDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, env *conf
 	})
 }

+// ------------------------------------------------------------
+//  Preview workflow
+// ------------------------------------------------------------
+
+// GeneratePreviewActions produces a Gitea Actions workflow YAML
+// that deploys an ephemeral environment per pull request.
+//
+// On PR open/sync: builds a PR-tagged image, applies secrets,
+// generates manifests (including Namespace), and deploys.
+// On PR close: deletes the preview namespace, removing all resources.
+func GeneratePreviewActions(cfg *config.KforgeConfig) (string, error) {
+	if !cfg.Preview.Enabled {
+		return "", fmt.Errorf("preview is not enabled in kforge.yml (set preview.enabled: true)")
+	}
+
+	nsPrefix := cfg.Preview.NamespacePrefix
+	if nsPrefix == "" {
+		nsPrefix = config.DefaultPreviewNamespacePrefix
+	}
+
+	fullRepo := cfg.Registry.URL + "/" + cfg.Meta.Tenant + "/" + cfg.Meta.Name
+
+	var b strings.Builder
+
+	fmt.Fprintf(&b, "# Generated by kforge — do not edit manually.\n")
+	fmt.Fprintf(&b, "# Re-generate: kforge gitea-preview > .gitea/workflows/preview.yml\n")
+	fmt.Fprintf(&b, "#\n")
+	fmt.Fprintf(&b, "# Required secrets (same as deploy workflow):\n")
+	fmt.Fprintf(&b, "#   DOCKER_USERNAME, DOCKER_PASSWORD\n")
+	fmt.Fprintf(&b, "#   KFORGE_NODE_IP, KUBE_HOST, KUBE_TOKEN, KUBE_CERTIFICATE\n")
+	fmt.Fprintf(&b, "\n")
+	fmt.Fprintf(&b, "name: Preview Environment\n")
+	fmt.Fprintf(&b, "\n")
+	fmt.Fprintf(&b, "on:\n")
+	fmt.Fprintf(&b, "  pull_request:\n")
+	fmt.Fprintf(&b, "    types: [opened, synchronize, reopened, closed]\n")
+	fmt.Fprintf(&b, "\n")
+	fmt.Fprintf(&b, "jobs:\n")
+	fmt.Fprintf(&b, "  preview:\n")
+	fmt.Fprintf(&b, "    runs-on: ubuntu-latest\n")
+	fmt.Fprintf(&b, "    steps:\n")
+
+	writeStep(&b, "Checkout", map[string]any{
+		"uses": "actions/checkout@v4",
+		"with": map[string]any{"fetch-depth": 0},
+	})
+
+	writeStep(&b, "Login to registry", map[string]any{
+		"if":   "${{ github.event.action != 'closed' }}",
+		"uses": "docker/login-action@v2",
+		"with": map[string]any{
+			"registry": cfg.Registry.URL,
+			"username": "${{ secrets.DOCKER_USERNAME }}",
+			"password": "${{ secrets.DOCKER_PASSWORD }}",
+		},
+	})
+
+	writeStep(&b, "Build and push preview image", map[string]any{
+		"if":   "${{ github.event.action != 'closed' }}",
+		"uses": "docker/build-push-action@v5",
+		"with": map[string]any{
+			"context":    ".",
+			"platforms":  "linux/amd64",
+			"file":       cfg.Defaults.Dockerfile,
+			"push":       true,
+			"tags":       fmt.Sprintf("%s:pr-${{ github.event.number }}", fullRepo),
+			"provenance": false,
+			"sbom":       false,
+		},
+	})
+
+	writeStep(&b, "Install kforge", map[string]any{
+		"if":  "${{ github.event.action != 'closed' }}",
+		"run": "KFORGE_VERSION=\"latest\"\ncurl -fsSL \"https://kforge/releases/download/${KFORGE_VERSION}/kforge-linux-amd64\" -o /usr/local/bin/kforge\nchmod +x /usr/local/bin/kforge",
+	})
+
+	writeStep(&b, "Apply preview secrets", map[string]any{
+		"if":  "${{ github.event.action != 'closed' }}",
+		"run": "kforge secrets apply --pr-number ${{ github.event.number }}",
+		"env": giteaKubeEnv(),
+	})
+
+	writeStep(&b, "Generate preview manifests", map[string]any{
+		"if":  "${{ github.event.action != 'closed' }}",
+		"run": "kforge generate --pr-number ${{ github.event.number }} --output .kforge-out",
+		"env": map[string]any{
+			"KFORGE_NODE_IP": "${{ secrets.KFORGE_NODE_IP }}",
+			"PR_NUMBER":      "${{ github.event.number }}",
+		},
+	})
+
+	writeStep(&b, "Apply preview manifests", map[string]any{
+		"if":   "${{ github.event.action != 'closed' }}",
+		"uses": "actions-hub/kubectl@master",
+		"env":  giteaKubeEnv(),
+		"with": map[string]any{
+			"args": fmt.Sprintf(
+				"apply -f .kforge-out/ --insecure-skip-tls-verify",
+			),
+		},
+	})
+
+	writeStep(&b, "Wait for preview rollout", map[string]any{
+		"if":   "${{ github.event.action != 'closed' }}",
+		"uses": "actions-hub/kubectl@master",
+		"env":  giteaKubeEnv(),
+		"with": map[string]any{
+			"args": fmt.Sprintf(
+				"rollout status deployment -n %s-${{ github.event.number }} --timeout=120s --insecure-skip-tls-verify",
+				nsPrefix,
+			),
+		},
+	})
+
+	writeStep(&b, "Destroy preview namespace", map[string]any{
+		"if":   "${{ github.event.action == 'closed' }}",
+		"uses": "actions-hub/kubectl@master",
+		"env":  giteaKubeEnv(),
+		"with": map[string]any{
+			"args": fmt.Sprintf(
+				"delete namespace %s-${{ github.event.number }} --ignore-not-found --insecure-skip-tls-verify",
+				nsPrefix,
+			),
+		},
+	})
+
+	return b.String(), nil
+}
+
+// ------------------------------------------------------------
+//  Shared step helpers
+// ------------------------------------------------------------
+
 // writeStep writes a single step in the jobs.steps list.
 func writeStep(b *strings.Builder, name string, fields map[string]any) {
 	fmt.Fprintf(b, "\n      - name: %s\n", name)
-	// Emit fields in a stable order.
-	order := []string{"uses", "run", "with", "env"}
+	order := []string{"if", "uses", "run", "with", "env"}
 	for _, k := range order {
 		v, ok := fields[k]
 		if !ok {
@@ -240,7 +337,6 @@ func writeStep(b *strings.Builder, name string, fields map[string]any) {
 }

 func writeMapFields(b *strings.Builder, m map[string]any, indent string) {
-	// Sort keys for stable output.
 	keys := make([]string, 0, len(m))
 	for k := range m {
 		keys = append(keys, k)
@@ -270,13 +366,11 @@ func writeMapFields(b *strings.Builder, m map[string]any, indent string) {
 	}
 }

-// giteaSecretEnv returns the env block referencing Gitea secrets
-// needed for kforge itself (DNS, registry tokens, etc.).
-func giteaSecretEnv() map[string]any {
+// giteaNodeIPEnv returns env vars needed for kforge commands that
+// resolve ${KFORGE_NODE_IP} tokens (validate, generate).
+func giteaNodeIPEnv() map[string]any {
 	return map[string]any{
-		"CLOUDFLARE_API_TOKEN": "${{ secrets.CLOUDFLARE_API_TOKEN }}",
-		"KFORGE_NODE_IP":       "${{ secrets.KFORGE_NODE_IP }}",
-		"SOPS_AGE_KEY":         "${{ secrets.SOPS_AGE_KEY }}",
+		"KFORGE_NODE_IP": "${{ secrets.KFORGE_NODE_IP }}",
 	}
 }

@@ -301,8 +395,6 @@ func mergeMaps(maps ...map[string]any) map[string]any {

 func sortedEnvKeys(cfg *config.KforgeConfig) []string {
 	keys := config.EnvironmentKeys(cfg)
-	// Put staging/dev before production — a simple heuristic that
-	// matches the most common deploy order.
 	priority := map[string]int{"dev": 0, "development": 0, "staging": 1, "production": 2, "prod": 2}
 	sort.Slice(keys, func(i, j int) bool {
 		pi, pj := priority[keys[i]], priority[keys[j]]