156 lines
4.9 KiB
YAML
156 lines
4.9 KiB
YAML
name: Build image when workload image tag changes
|
|
|
|
on:
|
|
push:
|
|
# Uncomment/adjust once it's working:
|
|
# branches: [ main ]
|
|
paths:
|
|
- "argocd/deployment.yaml"
|
|
- "Dockerfile"
|
|
|
|
jobs:
|
|
build-if-image-changed:
|
|
runs-on: self-hosted # or whatever label your runner uses
|
|
|
|
env:
|
|
DEPLOY_FILE: "argocd/deployment.yaml"
|
|
CONTAINER_NAME: "web" # we only consider this container
|
|
EXPECTED_REPO: "git.baumann.gr/adebaumann/vui" # sanity-check the repo
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
|
|
- name: Determine base commit
|
|
id: base
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if git rev-parse --verify -q HEAD~1 >/dev/null; then
|
|
echo "base=$(git rev-parse HEAD~1)" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "base=$(git hash-object -t tree /dev/null)" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Install yq
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
YQ_VER=v4.44.3
|
|
curl -sL "https://github.com/mikefarah/yq/releases/download/${YQ_VER}/yq_linux_amd64" -o /usr/local/bin/yq
|
|
chmod +x /usr/local/bin/yq
|
|
yq --version
|
|
|
|
- name: Read workload image from deployment (old vs new)
|
|
id: img
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
file="$DEPLOY_FILE"
|
|
cname="$CONTAINER_NAME"
|
|
expected_repo="$EXPECTED_REPO"
|
|
|
|
# Extract ONLY from .spec.template.spec.containers[], selecting by .name == cname
|
|
# Works across multi-doc YAML (the Service doc will be ignored)
|
|
extract() {
|
|
yq -r '
|
|
select(.kind == "Deployment") |
|
|
.spec.template.spec.containers // [] |
|
|
map(select(.name == env(cname))) |
|
|
.[]?.image
|
|
' "$1" 2>/dev/null | tail -n 1
|
|
}
|
|
|
|
debug_list() {
|
|
echo "== workload images in $1 ==" >&2
|
|
yq -r '
|
|
select(.kind == "Deployment") |
|
|
.spec.template.spec.containers // [] |
|
|
.[] | "\(.name): \(.image)"
|
|
' "$1" 2>/dev/null | nl -ba >&2 || true
|
|
}
|
|
|
|
# Old image (from previous commit)
|
|
if git cat-file -e "${{ steps.base.outputs.base }}":"$file" 2>/dev/null; then
|
|
git show "${{ steps.base.outputs.base }}:$file" > /tmp/old.yaml
|
|
debug_list /tmp/old.yaml
|
|
old_image="$(extract /tmp/old.yaml || true)"
|
|
else
|
|
old_image=""
|
|
fi
|
|
|
|
# New image (from workspace)
|
|
if [ -f "$file" ]; then
|
|
debug_list "$file"
|
|
new_image="$(extract "$file" || true)"
|
|
else
|
|
new_image=""
|
|
fi
|
|
|
|
echo "Old workload image: $old_image"
|
|
echo "New workload image: $new_image"
|
|
|
|
if [ -z "$new_image" ]; then
|
|
echo "ERROR: Could not find containers[].name == \"$cname\" in $file"
|
|
exit 1
|
|
fi
|
|
|
|
# Sanity-check repo prefix (avoid accidentally building the init image)
|
|
new_repo="${new_image%:*}"
|
|
new_tag="${new_image##*:}"
|
|
if [[ "$new_repo" != "$expected_repo" ]]; then
|
|
echo "ERROR: Found container \"$cname\" image repo is \"$new_repo\" but expected \"$expected_repo\""
|
|
exit 1
|
|
fi
|
|
|
|
# Old tag (if any)
|
|
if [ -n "$old_image" ]; then
|
|
old_tag="${old_image##*:}"
|
|
else
|
|
old_tag=""
|
|
fi
|
|
|
|
registry="$(echo "$new_repo" | awk -F/ '{print $1}')"
|
|
|
|
{
|
|
echo "changed=$([ "$old_tag" != "$new_tag" ] && echo true || echo false)"
|
|
echo "new_image=$new_image"
|
|
echo "new_repo=$new_repo"
|
|
echo "new_tag=$new_tag"
|
|
echo "registry=$registry"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Skip if tag unchanged
|
|
if: steps.img.outputs.changed != 'true'
|
|
run: echo "Workload image tag unchanged; skipping build."
|
|
|
|
- name: Set up Buildx
|
|
if: steps.img.outputs.changed == 'true'
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Log in to registry
|
|
if: steps.img.outputs.changed == 'true'
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ steps.img.outputs.registry }}
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Build and push (exact tag from deployment)
|
|
if: steps.img.outputs.changed == 'true'
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: |
|
|
${{ steps.img.outputs.new_image }}
|
|
${{ steps.img.outputs.new_repo }}:latest
|
|
labels: |
|
|
org.opencontainers.image.source=${{ gitea.repository }}
|
|
org.opencontainers.image.revision=${{ gitea.sha }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|