mats
2a7ac824f7
build / build-push (push) Successful in 34s
The post-build webhook returned success while ignoring the delivery because it omitted X-Gitea-Event: push. As a result, GitSource kept the prior revision and the published console image was never reconciled. Add the event header so the signed notification is queued only after the image has been published.
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
# Build and publish here; k8s-helper deploys ./deploy/k8s after the webhook.
|
|
name: build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
IMAGE: registry.k6n.net/fancydns
|
|
|
|
jobs:
|
|
build-push:
|
|
runs-on: amd64
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build image
|
|
run: |
|
|
docker build --build-arg VERSION=${{ gitea.sha }} \
|
|
-t $IMAGE:${{ gitea.sha }} -t $IMAGE:latest .
|
|
|
|
- name: Push image
|
|
run: |
|
|
docker push $IMAGE:${{ gitea.sha }}
|
|
docker push $IMAGE:latest
|
|
|
|
- name: Reconcile after image is published
|
|
env:
|
|
GITOPS_WEBHOOK_SECRET: ${{ secrets.GITOPS_WEBHOOK_SECRET }}
|
|
run: |
|
|
if [ -z "$GITOPS_WEBHOOK_SECRET" ]; then
|
|
echo "GITOPS_WEBHOOK_SECRET must match the k8s-helper Gitea webhook secret" >&2
|
|
exit 1
|
|
fi
|
|
payload="$(mktemp)"
|
|
trap 'rm -f "$payload"' EXIT
|
|
printf '{"ref":"%s","after":"%s","repository":{"clone_url":"https://git.k6n.net/mats/fancy-dns.git","ssh_url":"git@git.k6n.net:mats/fancy-dns.git"}}' \
|
|
"$GITHUB_REF" "$GITHUB_SHA" > "$payload"
|
|
signature="$(openssl dgst -sha256 -hmac "$GITOPS_WEBHOOK_SECRET" "$payload" | awk '{print $NF}')"
|
|
curl --fail --silent --show-error \
|
|
-X POST \
|
|
-H "Content-Type: application/json" \
|
|
-H "X-Gitea-Event: push" \
|
|
-H "X-Gitea-Signature: $signature" \
|
|
--data-binary "@$payload" \
|
|
https://ui.k6n.net/api/gitops/webhooks/gitea
|