Erich Blume
1bc2b421a8
All checks were successful
Build Container / build (push) Successful in 13s
## Summary - Add Dagger Python module (`.dagger/`) with `build` and `publish` functions for container images - Replace Docker buildx + skopeo composite action with `dagger call publish` in `build-container.yaml` - BuildKit's native push is compatible with Zot — **skopeo workaround eliminated** - Add Dagger CLI (v0.19.11) to forgejo-runner Dockerfile, bump runner to v2.6.0 - Bootstrap step in workflow curl-installs dagger if not in runner (for first build on v2.5.1 runner) - Delete old `.forgejo/actions/build-push-image/` composite action - Add GPLv3 LICENSE ## Verified locally - `dagger call build --src=. --container-name=nettest` — builds ✓ - `dagger call publish --src=. --container-name=nettest --version=dagger-test` — pushed to Zot ✓ - `dagger call build --src=. --container-name=forgejo-runner` — new runner image builds ✓ - Dagger CLI accessible inside built runner image ✓ ## Deployment sequence (after merge) 1. `mise run container-tag-and-release forgejo-runner v2.6.0` — old runner bootstraps dagger via curl, builds new runner 2. `argocd app sync forgejo-runner` — runner restarts with v2.6.0 (dagger baked in) 3. `mise run container-tag-and-release nettest v0.13.0` — end-to-end test of new pipeline 4. `mise run container-list` — verify tags ## Not included (future phases) - Phase 2: docs build + Forgejo packages migration - Phase 3: runner simplification (remove skopeo, Node.js, etc.) - Phase 4: future workflows Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/156
34 lines
994 B
YAML
34 lines
994 B
YAML
# ExternalSecret for Forgejo Runner environment
|
|
#
|
|
# Replaces the manual op inject workflow from secret.yaml.tpl
|
|
#
|
|
# 1Password item: "Forgejo Secrets" in blumeops vault
|
|
# Field: runner_reg (runner registration token)
|
|
#
|
|
# Note: Static values (FORGEJO_URL, RUNNER_NAME, RUNNER_LABELS) are included
|
|
# via template since they don't need to be in 1Password.
|
|
#
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: forgejo-runner-env
|
|
namespace: forgejo-runner
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-blumeops
|
|
target:
|
|
name: forgejo-runner-env
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
FORGEJO_URL: "https://forge.ops.eblu.me"
|
|
RUNNER_NAME: "k8s-runner"
|
|
RUNNER_LABELS: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v2.6.0"
|
|
RUNNER_TOKEN: "{{ .runner_token }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: Forgejo Secrets
|
|
property: runner_reg
|