use as gitea action

2026-06-29 16:01:01 +10:00
parent 4ee1b9e13c
commit 9adb5780f2
6 changed files with 236 additions and 248 deletions
@@ -1,146 +1,90 @@
 #!/bin/sh
 set -e

-# INPUT_FILE="$1"
-# OUTPUT_FILE="$2"
-# AUTO_DEPLOY="$3"
+COMMAND="${INPUT_COMMAND:-deploy}"
+CONFIG="${INPUT_CONFIG:-kforge.yml}"

-# ----------------------------------------------------------------
-# Registry login
-# ----------------------------------------------------------------
-if [ -n "$INPUT_REGISTRY_USERNAME" ] && [ -n "$INPUT_REGISTRY_PASSWORD" ]; then
-  echo "Logging in to $INPUT_REGISTRY..."
-  echo "$INPUT_REGISTRY_PASSWORD" | docker login "$INPUT_REGISTRY" \
-    -u "$INPUT_REGISTRY_USERNAME" --password-stdin
-fi
-
-# ----------------------------------------------------------------
-# Build and push image
-# ----------------------------------------------------------------
-cleanup_old_tags() {
-  IMAGE="$1"
-  KEEP="$2"
-
-  echo "Fetching tags for $IMAGE..."
-
-  TAGS=$(curl -s -u "$INPUT_REGISTRY_USERNAME:$INPUT_REGISTRY_PASSWORD" \
-    "https://$INPUT_REGISTRY/v2/$IMAGE/tags/list" \
-    | tr ',' '\n' \
-    | grep -o '"[a-f0-9]\{7\}"' \
-    | tr -d '"')
-
-  COUNT=$(echo "$TAGS" | grep -c .)
-  DELETE_COUNT=$((COUNT - KEEP))
-
-  if [ "$DELETE_COUNT" -le 0 ]; then
-    echo "Only $COUNT hash tags found, no cleanup needed."
-    return
-  fi
-
-  echo "Found $COUNT hash tags, deleting oldest $DELETE_COUNT..."
-
-  echo "$TAGS" | head -n "$DELETE_COUNT" | while read -r TAG; do
-    echo "Deleting tag: $TAG..."
-
-    DIGEST=$(curl -s -I \
-      -u "$INPUT_REGISTRY_USERNAME:$INPUT_REGISTRY_PASSWORD" \
-      -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
-      "https://$INPUT_REGISTRY/v2/$IMAGE/manifests/$TAG" \
-      | grep -i "docker-content-digest" \
-      | tr -d '\r' \
-      | awk '{print $2}')
-
-    if [ -n "$DIGEST" ]; then
-      curl -s -X DELETE \
-        -u "$INPUT_REGISTRY_USERNAME:$INPUT_REGISTRY_PASSWORD" \
-        "https://$INPUT_REGISTRY/v2/$IMAGE/manifests/$DIGEST"
-      echo "Deleted $TAG ($DIGEST)"
-    else
-      echo "Could not find digest for $TAG, skipping."
-    fi
-  done
+# Build a kubeconfig from the standard KUBE_* CI secrets.
+setup_kube() {
+  [ -z "$KUBE_HOST" ] && return
+  mkdir -p ~/.kube
+  cat > ~/.kube/config <<KUBEEOF
+apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    certificate-authority-data: ${KUBE_CERTIFICATE}
+    server: ${KUBE_HOST}
+  name: kforge
+contexts:
+- context:
+    cluster: kforge
+    user: kforge
+  name: kforge
+current-context: kforge
+users:
+- name: kforge
+  user:
+    token: ${KUBE_TOKEN}
+KUBEEOF
+  chmod 600 ~/.kube/config
 }

-if [ -n "$INPUT_IMAGE_NAME" ]; then
-  FULL_IMAGE="$INPUT_REGISTRY/$INPUT_IMAGE_NAME"
+cd "${GITHUB_WORKSPACE:-/github/workspace}"

-  if [ -n "$INPUT_IMAGE_TAG" ]; then
-    echo "Building image $FULL_IMAGE:$INPUT_IMAGE_TAG..."
-    docker build -t "$FULL_IMAGE:$INPUT_IMAGE_TAG" -f "$INPUT_DOCKERFILE" .
+case "$COMMAND" in
+  deploy)
+    export KFORGE_IMAGE_TAG="$(git rev-parse --short HEAD)"
+    setup_kube
+    kforge validate -c "$CONFIG"
+    if [ -n "$INPUT_ENV" ]; then
+      kforge secrets apply --env "$INPUT_ENV" -c "$CONFIG"
+      kforge generate --env "$INPUT_ENV" --output .kforge-out -c "$CONFIG"
+    else
+      kforge generate --output .kforge-out -c "$CONFIG"
+    fi
+    kubectl apply -f .kforge-out/ --insecure-skip-tls-verify
+    NAMESPACE="${INPUT_NAMESPACE:-${INPUT_ENV}}"
+    if [ -n "$NAMESPACE" ]; then
+      kubectl rollout restart deployment -n "$NAMESPACE" --insecure-skip-tls-verify || true
+    fi
+    ;;

-    echo "Scanning image for vulnerabilities..."
-    trivy image \
-      --exit-code 1 \
-      --severity "$INPUT_SCAN_SEVERITY" \
-      --no-progress \
-      "$FULL_IMAGE:$INPUT_IMAGE_TAG"
+  preview-up)
+    [ -z "$INPUT_PR_NUMBER" ] && echo "::error::pr_number input is required for preview-up" && exit 1
+    setup_kube
+    kforge secrets apply --pr-number "$INPUT_PR_NUMBER" -c "$CONFIG"
+    kforge generate --pr-number "$INPUT_PR_NUMBER" --output .kforge-out -c "$CONFIG"
+    kubectl apply -f .kforge-out/ --insecure-skip-tls-verify
+    NS="${INPUT_NAMESPACE_PREFIX:-preview-pr}-${INPUT_PR_NUMBER}"
+    kubectl rollout status deployment -n "$NS" --timeout=120s --insecure-skip-tls-verify || true
+    ;;

-    echo "Scan passed, pushing image..."
-    docker push "$FULL_IMAGE:$INPUT_IMAGE_TAG"
-  else
-    SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
-    echo "Building image $FULL_IMAGE:latest and $FULL_IMAGE:$SHA..."
-    docker build \
-      -t "$FULL_IMAGE:latest" \
-      -t "$FULL_IMAGE:$SHA" \
-      -f "$INPUT_DOCKERFILE" .
+  preview-down)
+    [ -z "$INPUT_PR_NUMBER" ] && echo "::error::pr_number input is required for preview-down" && exit 1
+    setup_kube
+    NS="${INPUT_NAMESPACE_PREFIX:-preview-pr}-${INPUT_PR_NUMBER}"
+    kubectl delete namespace "$NS" --ignore-not-found --insecure-skip-tls-verify
+    ;;

-    echo "Scanning image for vulnerabilities..."
-    trivy image \
-      --exit-code 1 \
-      --severity "$INPUT_SCAN_SEVERITY" \
-      --no-progress \
-      "$FULL_IMAGE:latest"
+  validate)
+    kforge validate -c "$CONFIG"
+    ;;

-    echo "Scan passed, pushing image..."
-    docker push "$FULL_IMAGE:latest"
-    docker push "$FULL_IMAGE:$SHA"
+  secrets)
+    setup_kube
+    if [ -n "$INPUT_PR_NUMBER" ]; then
+      kforge secrets apply --pr-number "$INPUT_PR_NUMBER" -c "$CONFIG"
+    elif [ -n "$INPUT_ENV" ]; then
+      kforge secrets apply --env "$INPUT_ENV" -c "$CONFIG"
+    else
+      echo "::error::env or pr_number input is required for the secrets command"
+      exit 1
+    fi
+    ;;

-    cleanup_old_tags "$INPUT_IMAGE_NAME" "${INPUT_MAX_TAGS:-5}"
-  fi
-fi
-
-# ----------------------------------------------------------------
-# Generate Kubernetes YAML
-# ----------------------------------------------------------------
-echo "Generating Kubernetes YAML from .kforge.yml"
-/usr/local/bin/kforge generate
-
-# ----------------------------------------------------------------
-# Deploy to Kubernetes
-# ----------------------------------------------------------------
-# Build kubeconfig from token-based credentials
-echo "Configuring kubectl..."
-
-# Try writing the cert and check if it worked
-echo "$INPUT_KUBE_CERTIFICATE" | base64 -d > /tmp/kube-ca.crt 2>&1
-echo "Cert file size: $(wc -c < /tmp/kube-ca.crt)"
-echo "Cert file contents: $(cat /tmp/kube-ca.crt | head -1)"
-
-kubectl config set-cluster default \
--server="$INPUT_KUBE_HOST" \
--certificate-authority=/tmp/kube-ca.crt
-
-kubectl config set-credentials default \
--token="$INPUT_KUBE_TOKEN"
-
-kubectl config set-context default \
--cluster=default \
--user=default
-
-kubectl config use-context default
-
-
-# Create/update regcred secret idempotently
-# echo "Creating regcred secret..."
-# kubectl create secret docker-registry regcred \
-# --docker-server="$INPUT_REGISTRY" \
-# --docker-username="$INPUT_REGISTRY_USERNAME" \
-# --docker-password="$INPUT_REGISTRY_PASSWORD" \
-# --dry-run=client -o yaml | kubectl apply -f - --insecure-skip-tls-verify --validate=false
-
-echo "Deploying to Kubernetes..."
-kubectl apply --insecure-skip-tls-verify  --validate=false  -f ./.kforge-out/
-echo "Deploy complete."
-echo "Cleanup"
-rm -f /tmp/kube-ca.crt
+  *)
+    echo "::error::Unknown command '$COMMAND'. Valid: deploy, preview-up, preview-down, validate, secrets"
+    exit 1
+    ;;
+esac