|
|
|
@@ -16,7 +16,7 @@ permissions:
|
|
|
|
|
security-events: write
|
|
|
|
|
|
|
|
|
|
env:
|
|
|
|
|
REGISTRY: ghcr.io
|
|
|
|
|
REGISTRY: git.farh.net
|
|
|
|
|
IMAGE_NAME: cartsnitch/cartsnitch
|
|
|
|
|
RECEIPTWITNESS_IMAGE_NAME: cartsnitch/receiptwitness
|
|
|
|
|
API_IMAGE_NAME: cartsnitch/api
|
|
|
|
@@ -134,13 +134,13 @@ jobs:
|
|
|
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
|
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Log in to GHCR
|
|
|
|
|
- name: Log in to Gitea registry
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
|
uses: docker/login-action@v3
|
|
|
|
|
with:
|
|
|
|
|
registry: ${{ env.REGISTRY }}
|
|
|
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
|
|
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
|
username: ${{ github.actor }}
|
|
|
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Extract metadata
|
|
|
|
|
id: meta
|
|
|
|
@@ -175,7 +175,7 @@ jobs:
|
|
|
|
|
only-fixed: "true"
|
|
|
|
|
output-format: sarif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: Push Docker image
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
@@ -224,13 +224,13 @@ jobs:
|
|
|
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
|
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Log in to GHCR
|
|
|
|
|
- name: Log in to Gitea registry
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
|
uses: docker/login-action@v3
|
|
|
|
|
with:
|
|
|
|
|
registry: ${{ env.REGISTRY }}
|
|
|
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
|
|
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
|
username: ${{ github.actor }}
|
|
|
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Extract metadata
|
|
|
|
|
id: meta
|
|
|
|
@@ -267,7 +267,7 @@ jobs:
|
|
|
|
|
only-fixed: "true"
|
|
|
|
|
output-format: sarif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: Push Docker image
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
@@ -312,13 +312,13 @@ jobs:
|
|
|
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
|
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Log in to GHCR
|
|
|
|
|
- name: Log in to Gitea registry
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
|
uses: docker/login-action@v3
|
|
|
|
|
with:
|
|
|
|
|
registry: ${{ env.REGISTRY }}
|
|
|
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
|
|
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
|
username: ${{ github.actor }}
|
|
|
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Extract metadata (API)
|
|
|
|
|
id: meta
|
|
|
|
@@ -355,7 +355,7 @@ jobs:
|
|
|
|
|
only-fixed: "true"
|
|
|
|
|
output-format: sarif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: Push Docker image
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
@@ -400,13 +400,13 @@ jobs:
|
|
|
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
|
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Log in to GHCR
|
|
|
|
|
- name: Log in to Gitea registry
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
|
uses: docker/login-action@v3
|
|
|
|
|
with:
|
|
|
|
|
registry: ${{ env.REGISTRY }}
|
|
|
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
|
|
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
|
username: ${{ github.actor }}
|
|
|
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
|
|
|
|
|
- name: Extract metadata (auth)
|
|
|
|
|
id: meta
|
|
|
|
@@ -443,7 +443,7 @@ jobs:
|
|
|
|
|
only-fixed: "true"
|
|
|
|
|
output-format: sarif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: Push Docker image
|
|
|
|
|
if: github.event_name == 'push'
|
|
|
|
@@ -467,7 +467,7 @@ jobs:
|
|
|
|
|
uses: actions/checkout@v4
|
|
|
|
|
with:
|
|
|
|
|
repository: cartsnitch/infra
|
|
|
|
|
token: ${{ secrets.GITEA_TOKEN }}
|
|
|
|
|
token: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
ref: main
|
|
|
|
|
path: infra
|
|
|
|
|
|
|
|
|
@@ -490,7 +490,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/dev
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/cartsnitch=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for receiptwitness
|
|
|
|
|
id: receiptwitness_tag
|
|
|
|
@@ -505,7 +505,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-receiptwitness.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/dev
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for api
|
|
|
|
|
id: api_tag
|
|
|
|
@@ -520,7 +520,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-api.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/dev
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for auth
|
|
|
|
|
id: auth_tag
|
|
|
|
@@ -535,13 +535,13 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-auth.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/dev
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Commit and push to infra
|
|
|
|
|
run: |
|
|
|
|
|
cd infra
|
|
|
|
|
git config user.name "cartsnitch-ci[bot]"
|
|
|
|
|
git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
|
|
|
|
|
git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
|
|
|
|
|
git add apps/overlays/dev/kustomization.yaml
|
|
|
|
|
git diff --cached --quiet && echo "No image changes to deploy" && exit 0
|
|
|
|
|
git commit -m "ci(dev): update cartsnitch, receiptwitness, api, and auth images"
|
|
|
|
@@ -557,7 +557,7 @@ jobs:
|
|
|
|
|
uses: actions/checkout@v4
|
|
|
|
|
with:
|
|
|
|
|
repository: cartsnitch/infra
|
|
|
|
|
token: ${{ secrets.GITEA_TOKEN }}
|
|
|
|
|
token: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
|
ref: main
|
|
|
|
|
path: infra
|
|
|
|
|
|
|
|
|
@@ -580,7 +580,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/uat
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/cartsnitch=git.farh.net/cartsnitch/cartsnitch:${{ steps.frontend_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for receiptwitness
|
|
|
|
|
id: receiptwitness_tag
|
|
|
|
@@ -595,7 +595,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-receiptwitness.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/uat
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/receiptwitness=git.farh.net/cartsnitch/receiptwitness:${{ steps.receiptwitness_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for api
|
|
|
|
|
id: api_tag
|
|
|
|
@@ -610,7 +610,7 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-api.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/uat
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/api=git.farh.net/cartsnitch/api:${{ steps.api_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Determine image tag for auth
|
|
|
|
|
id: auth_tag
|
|
|
|
@@ -625,13 +625,13 @@ jobs:
|
|
|
|
|
if: needs.build-and-push-auth.result == 'success'
|
|
|
|
|
run: |
|
|
|
|
|
cd infra/apps/overlays/uat
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
|
|
|
|
|
kustomize edit set image ghcr.io/cartsnitch/auth=git.farh.net/cartsnitch/auth:${{ steps.auth_tag.outputs.tag }}
|
|
|
|
|
|
|
|
|
|
- name: Commit and push to infra
|
|
|
|
|
run: |
|
|
|
|
|
cd infra
|
|
|
|
|
git config user.name "cartsnitch-ci[bot]"
|
|
|
|
|
git config user.email "cartsnitch-ci[bot]@users.noreply.github.com"
|
|
|
|
|
git config user.email "cartsnitch-ci[bot]@users.noreply.git.farh.net"
|
|
|
|
|
git add apps/overlays/uat/kustomization.yaml
|
|
|
|
|
git diff --cached --quiet && echo "No image changes to deploy" && exit 0
|
|
|
|
|
git commit -m "ci(uat): update cartsnitch, receiptwitness, api, and auth images"
|
|
|
|
|