From 1a1c57461fcde9f68c0d12fefc65bfb128d58c10 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Sun, 31 May 2026 08:11:45 -0400 Subject: [PATCH] fork: production Dockerfile additions + Gitea registry build workflows Only fork divergence from upstream/master. Adds to the production stage: - kubectl, kubeseal (Kubernetes ops in deployed pods) - uv, uvx (Python tooling) - forgejo-cli (fj, fj-ex, fgj) - gitea tea CLI - mmx-cli - nano, vim Workflows push to git.farh.net/farhoodlabs/paperclip{,-dev}. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/build-dev.yml | 77 ++++++++++++++++++++++++++++++++ .github/workflows/build-prod.yml | 48 ++++++++++++++++++++ Dockerfile | 25 +++++++++-- 3 files changed, 147 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/build-dev.yml create mode 100644 .github/workflows/build-prod.yml diff --git a/.github/workflows/build-dev.yml b/.github/workflows/build-dev.yml new file mode 100644 index 00000000..aa828b45 --- /dev/null +++ b/.github/workflows/build-dev.yml @@ -0,0 +1,77 @@ +name: "Build: Dev" + +on: + push: + branches: [dev] + workflow_dispatch: + +permissions: + contents: read + packages: write + +jobs: + build: + runs-on: ubuntu-latest + timeout-minutes: 30 + outputs: + image-tag: ${{ steps.tag.outputs.sha }} + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set image tag + id: tag + run: echo "sha=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Gitea Registry + uses: docker/login-action@v3 + with: + registry: git.farh.net + username: admin + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: git.farh.net/farhoodlabs/paperclip-dev + tags: | + type=sha,prefix= + type=semver,pattern={{version}} + type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }} + + - name: Build and push + uses: docker/build-push-action@v6 + with: + context: . + file: Dockerfile + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + no-cache: true + + update-infra: + needs: build + runs-on: ubuntu-latest + steps: + - name: Update dev image tag in infra repo + run: | + SHA="${{ needs.build.outputs.image-tag }}" + FILE="overlays/dev/kustomization.yaml" + + response=$(curl -sS \ + -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \ + "https://git.farh.net/api/v1/repos/farhoodlabs/paperclip-infra/contents/$FILE") + + file_sha=$(echo "$response" | jq -r '.sha') + content=$(echo "$response" | jq -r '.content' | base64 -d) + new_content=$(echo "$content" | sed "s/newTag: \".*\"/newTag: \"$SHA\"/") + encoded=$(printf '%s' "$new_content" | base64 -w 0) + + curl -sS -X PUT \ + -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \ + "https://git.farh.net/api/v1/repos/farhoodlabs/paperclip-infra/contents/$FILE" \ + -d "{\"message\":\"chore(cd): update paperclip-dev to $SHA\",\"content\":\"$encoded\",\"sha\":\"$file_sha\"}" diff --git a/.github/workflows/build-prod.yml b/.github/workflows/build-prod.yml new file mode 100644 index 00000000..1af2f2fc --- /dev/null +++ b/.github/workflows/build-prod.yml @@ -0,0 +1,48 @@ +name: "Build: Production" + +on: + push: + branches: [local] + workflow_dispatch: + +permissions: + contents: read + packages: write + +jobs: + build: + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Gitea Registry + uses: docker/login-action@v3 + with: + registry: git.farh.net + username: admin + password: ${{ secrets.REGISTRY_TOKEN }} + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: git.farh.net/farhoodlabs/paperclip + tags: | + type=sha,prefix= + type=semver,pattern={{version}} + type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }} + + - name: Build and push + uses: docker/build-push-action@v6 + with: + context: . + file: Dockerfile + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + no-cache: true diff --git a/Dockerfile b/Dockerfile index b64f59e2..f1b487f7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -57,10 +57,29 @@ ARG USER_UID=1000 ARG USER_GID=1000 WORKDIR /app COPY --chown=node:node --from=build /app /app -RUN npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai \ - && apt-get update \ - && apt-get install -y --no-install-recommends openssh-client jq \ +# Fork additions: kubectl, kubeseal, uv, forgejo CLIs, gitea tea CLI, editor tools, mmx-cli +# Upstream installs: claude-code, codex, opencode-ai, openssh-client, jq +RUN apt-get update \ + && apt-get install -y --no-install-recommends openssh-client jq nano vim \ && rm -rf /var/lib/apt/lists/* \ + && curl -fsSL https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl -o /usr/local/bin/kubectl \ + && chmod +x /usr/local/bin/kubectl \ + && curl -fsSL https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.36.6/kubeseal-0.36.6-linux-amd64.tar.gz | tar -xzf - -C /tmp \ + && mv /tmp/kubeseal /usr/local/bin/kubeseal \ + && rm -rf /tmp/kubeseal /tmp/LICENSE /tmp/README.md \ + && curl -LsSf https://astral.sh/uv/install.sh | sh \ + && mv /root/.local/bin/uv /usr/local/bin/uv \ + && mv /root/.local/bin/uvx /usr/local/bin/uvx \ + && curl -fsSL https://codeberg.org/forgejo-contrib/forgejo-cli/releases/download/v0.4.1/forgejo-cli-linux.tar.gz | tar -xzf - -C /usr/local/bin \ + && chmod +x /usr/local/bin/fj \ + && curl -fsSL https://github.com/JKamsker/forgejo-cli-ex/releases/download/v0.1.7/fj-ex-linux-x86_64.tar.gz | tar -xzf - -C /usr/local/bin \ + && chmod +x /usr/local/bin/fj-ex \ + && curl -fsSL https://codeberg.org/romaintb/fgj/releases/download/v0.3.0/fgj_linux_amd64 -o /usr/local/bin/fgj \ + && chmod +x /usr/local/bin/fgj \ + && curl -fsSL https://dl.gitea.com/tea/0.14.0/tea-0.14.0-linux-amd64 -o /usr/local/bin/tea \ + && chmod +x /usr/local/bin/tea \ + && npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai \ + && npm install --global --omit=dev mmx-cli \ && mkdir -p /paperclip \ && chown node:node /paperclip