argoyleandClaude Opus 5.5
d041432772
schemas / vulnerabilities (pull_request) Successful in 38s
schemas / check (pull_request) Successful in 1m8s
schemas / check-release (pull_request) Successful in 1m7s
pre-commit / pre-commit (pull_request) Successful in 1m17s
schemas / build (pull_request) Successful in 1m36s
schemas / deploy-prod-frostmoln (pull_request) Skipped
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace schemas), the way the sites do. Frostmoln enforces restricted Pod Security: the pod runs as the image's non-root user with a matching securityContext. The prod-only manifests move to the prod-frostmoln target; the ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
113 lines
3.6 KiB
YAML
113 lines
3.6 KiB
YAML
name: schemas
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
deploy_prod:
|
|
description: 'Deploy to production'
|
|
required: false
|
|
default: 'false'
|
|
type: boolean
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
go-version: 'stable'
|
|
- name: Generate and format check
|
|
run: |
|
|
go install mvdan.cc/gofumpt@latest
|
|
go install golang.org/x/tools/cmd/goimports@latest
|
|
go generate ./...
|
|
git diff --stat --exit-code
|
|
- name: Run tests
|
|
run: go test -race -coverprofile=coverage.txt ./...
|
|
|
|
vulnerabilities:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
go-version: 'stable'
|
|
- name: Check vulnerabilities
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|
|
|
|
check-release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-node@v7
|
|
with:
|
|
node-version: '24'
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
go-version: 'stable'
|
|
- name: Check goreleaser config
|
|
uses: goreleaser/goreleaser-action@v7
|
|
with:
|
|
version: '~> v2'
|
|
args: check
|
|
- name: Install goreleaser
|
|
uses: goreleaser/goreleaser-action@v7
|
|
with:
|
|
version: '~> v2'
|
|
install-only: true
|
|
# Without the runner's GOCACHEPROG (gobuildcache): goreleaser's parallel
|
|
# go builds contend for its per-entry locks and time out.
|
|
- name: Test release build
|
|
run: env -u GOCACHEPROG goreleaser release --snapshot --clean
|
|
|
|
build:
|
|
needs: [check, vulnerabilities, check-release]
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: buildtool/setup-buildtools-action@v1
|
|
- name: Build and push
|
|
run: unset GITEA_TOKEN && build && push
|
|
|
|
deploy-prod-frostmoln:
|
|
needs: build
|
|
if: gitea.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
|
|
environment: prod
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: buildtool/setup-buildtools-action@v1
|
|
- name: Install fm
|
|
run: |
|
|
sudo install -d -m 0755 /etc/apt/keyrings
|
|
sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
|
|
sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
|
|
sudo apt-get update && sudo apt-get install -y fm
|
|
- name: Deploy to Frostmoln production
|
|
env:
|
|
FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
|
|
# The cluster API is private: the kubeconfig's exec plugin opens an fm
|
|
# tunnel on demand. fm reads the key from its config file, not the env.
|
|
run: |
|
|
fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
|
|
fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
|
|
KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas
|