gib
a10ce8bb6c
Watchtower recreated containers outside their podman-compose pod, which took gitea down for three days on 2026-08-14 while reporting failed=0. It is retired. Deploys now SSH to the VPS and restart the systemd unit, so podman-compose rebuilds the project properly. The key is pinned to a forced command that only accepts a service name. Still non-fatal: the image is already pushed and podman-update.timer sweeps at midnight, so a trigger failure delays the deploy rather than failing the build.
59 lines
2.4 KiB
YAML
59 lines
2.4 KiB
YAML
name: Build and Push agentchat Image
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
- run: bun install --frozen-lockfile
|
|
- name: Typecheck and test
|
|
run: |
|
|
bun run typecheck
|
|
bun test
|
|
|
|
build-image:
|
|
needs: [quality]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Log in to container registry
|
|
run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
# One build-and-push step, fully-qualified tags, --push from the builder.
|
|
# This is the only form that works across all the runners: unqualified
|
|
# names resolve to docker.io/library/* on podman-backed daemons, and
|
|
# buildx docker-container drivers keep plain builds in the build cache
|
|
# where a separate push step can't see them.
|
|
- name: Build and push image
|
|
run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
|
|
|
|
# Watchtower was retired 2026-08-17: it recreated containers outside their
|
|
# podman-compose pod, which took gitea down for three days while reporting
|
|
# success. Deploys now SSH to the VPS and restart the systemd UNIT, so
|
|
# podman-compose rebuilds the project properly (pod, networks, ports).
|
|
#
|
|
# The key is pinned to a forced command that accepts only a service name, so
|
|
# it cannot open a shell or reach anything else. 192.168.2.2 is the VPS over
|
|
# WireGuard: reachable from every runner, never the public internet.
|
|
#
|
|
# Non-fatal on purpose: the image is already pushed, and podman-update.timer
|
|
# sweeps at midnight, so a trigger hiccup delays the deploy by hours rather
|
|
# than failing a build that otherwise succeeded.
|
|
- name: Trigger immediate deploy
|
|
run: |
|
|
echo "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
|
|
chmod 600 "$HOME/.deploy_key"
|
|
ssh -i "$HOME/.deploy_key" \
|
|
-o BatchMode=yes \
|
|
-o StrictHostKeyChecking=accept-new \
|
|
-o ConnectTimeout=15 \
|
|
[email protected] agentchat \
|
|
|| echo "::warning::deploy trigger failed; nightly sweep will deploy instead"
|
|
rm -f "$HOME/.deploy_key"
|