initial commit

2026-08-27 10:46:36 +02:00
commit 993e5c7327
11 changed files with 591 additions and 0 deletions
@@ -0,0 +1,97 @@
+# =============================================================================
+# Gitea Actions workflow: build a Docker image and push it to Harbor.
+#
+# Place this file in your application repository at:
+#     .gitea/workflows/build-and-push.yaml
+#
+# Required repo/org Actions secrets (Settings -> Actions -> Secrets):
+#     HARBOR_REGISTRY   e.g. harbor.example.com
+#     HARBOR_USERNAME   e.g. robot$ci
+#     HARBOR_PASSWORD   the robot account token
+#
+# Optional repo/org Actions variables (Settings -> Actions -> Variables):
+#     HARBOR_PROJECT    Harbor project name (default: "library")
+#     IMAGE_NAME        image name (default: repository name)
+# =============================================================================
+name: build-and-push
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    # Uses the label advertised by the act_runner on k3s.
+    runs-on: ubuntu-22.04
+    env:
+      HARBOR_PROJECT: ${{ vars.HARBOR_PROJECT || 'library' }}
+      IMAGE_NAME: ${{ vars.IMAGE_NAME || gitea.event.repository.name }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Compute image tags
+        id: meta
+        run: |
+          REGISTRY="${{ secrets.HARBOR_REGISTRY }}"
+          IMAGE="${REGISTRY}/${HARBOR_PROJECT}/${IMAGE_NAME}"
+          SHA_TAG="${GITHUB_SHA::12}"
+          echo "image=${IMAGE}"        >> "$GITHUB_OUTPUT"
+          echo "sha_tag=${SHA_TAG}"    >> "$GITHUB_OUTPUT"
+          # Use the git tag as the version when the ref is a tag, else 'latest'.
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Log in to Harbor
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ secrets.HARBOR_REGISTRY }}
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha_tag }}
+
+      - name: Summary
+        run: |
+          echo "Pushed:"
+          echo "  ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}"
+          echo "  ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha_tag }}"
+
+# =============================================================================
+# Alternative: rootless builds (no privileged DinD sidecar)
+# -----------------------------------------------------------------------------
+# If you cannot run a privileged DinD sidecar, build with Kaniko instead.
+# Replace the "Build and push" step (and drop the Buildx/login steps) with a
+# container step running the Kaniko executor. Kaniko logs in to Harbor via a
+# generated docker config:
+#
+#   - name: Build and push with Kaniko
+#     uses: https://github.com/int128/kaniko-action@v1
+#     with:
+#       push: true
+#       tags: ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}
+#       registry: ${{ secrets.HARBOR_REGISTRY }}
+#       username: ${{ secrets.HARBOR_USERNAME }}
+#       password: ${{ secrets.HARBOR_PASSWORD }}
+#
+# In that case the act_runner does not need the DinD sidecar; the Kaniko
+# executor image performs the build inside the job container.
+# =============================================================================