scott
faf73c8be5
The workout, the protein, the calories, the water, and three lines of gratitude. One page per day, a card of seventy-five tiles that fill by how many of the five landed, and a missed day left as a gap rather than a reset. Single Go binary with no dependencies. The log is one JSON file on a mounted volume, written atomically and never silently replaced when it fails to parse, since it is the one thing here that cannot be recreated. Auth is Traefik basic auth at the ingress; the app has no login of its own, so every POST checks Sec-Fetch-Site to stop another origin posting with those credentials. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
name: Build and Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: quay.io/buildah/stable
|
|
steps:
|
|
- name: Checkout
|
|
env:
|
|
# Values reach the shell as environment variables rather than being
|
|
# interpolated into the command, so a crafted branch name cannot run
|
|
# as part of it.
|
|
REF_NAME: ${{ github.ref_name }}
|
|
REPO: ${{ github.repository }}
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The clone URL is spelled out: github.server_url resolves to Gitea's
|
|
# in-cluster address, which the runner can reach but has no
|
|
# credentials for. The token authenticates a private repo.
|
|
git clone --depth 1 --branch "$REF_NAME" \
|
|
"https://x-access-token:${TOKEN}@git.scottyah.com/${REPO}.git" .
|
|
git checkout "$GITHUB_SHA"
|
|
|
|
- name: Build image
|
|
run: |
|
|
IMAGE=harbor.scottyah.com/scottyah/tracker
|
|
buildah --isolation chroot bud -t $IMAGE:${{ github.sha }} -t $IMAGE:latest .
|
|
|
|
- name: Push image
|
|
run: |
|
|
IMAGE=harbor.scottyah.com/scottyah/tracker
|
|
# Harbor serves a publicly trusted certificate, so TLS is verified.
|
|
# Disabling verification would send these credentials, and accept the
|
|
# image, over a connection nothing has authenticated.
|
|
buildah login -u "$HARBOR_USERNAME" -p "$HARBOR_PASSWORD" harbor.scottyah.com
|
|
buildah push $IMAGE:${{ github.sha }}
|
|
buildah push $IMAGE:latest
|
|
env:
|
|
HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
|
|
HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
|
|
|
|
- name: Deploy
|
|
run: |
|
|
curl -LO "https://dl.k8s.io/release/$(curl -Ls https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
|
chmod +x kubectl
|
|
mkdir -p ~/.kube
|
|
echo "${{ secrets.KUBECONFIG_DATA }}" | base64 -d > ~/.kube/config
|
|
sed -i "s|harbor.scottyah.com/scottyah/tracker:latest|harbor.scottyah.com/scottyah/tracker:${{ github.sha }}|" k8s.yaml
|
|
./kubectl apply -f k8s.yaml
|
|
./kubectl rollout status deployment/tracker-dep -n tracker --timeout=120s
|