ci(tag): release Gitea (commit list) avant le dispatch Renovate + corps JSON du dispatch corrigé

Merge pull request 'ci(tag): déclenche Renovate sur tf-depl-kubernetes dès que l'image de release est poussée (opencode-openchamber)' (#62 ) from ci/renovate-dispatch-on-release into main
Reviewed-on: #62
2026-10-18 22:18:24 -04:00 · 2026-10-18 13:43:29 -04:00 · 2026-10-18 13:22:13 -04:00 · 2026-10-17 20:31:03 -04:00 · 2026-10-18 00:15:36 +00:00 · 2026-10-17 15:59:13 -04:00
11 changed files with 296 additions and 104 deletions
@@ -0,0 +1,34 @@
 name: CI Shared Jobs
 on:
  workflow_call:
 jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile
          failure-threshold: warning
  build-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Build (cached)
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          tags: ci-image:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Test
        run: bash tests/test.sh ci-image:${{ github.sha }}
@@ -0,0 +1,46 @@
 name: Nightly Rebuild
 on:
  schedule:
    - cron: '0 0 * * *'
 jobs:
  ci:
    uses: ./.gitea/workflows/_ci-common.yaml
    secrets: inherit
  build-push:
    needs: [ci]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - id: get-latest-tag
        name: Get latest tag
        run: |
          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          echo "tag=$TAG" >> $GITHUB_OUTPUT
      - id: meta
        name: Docker metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: jcabillot/opencode-openchamber
          tags: |
            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
      - name: Build and push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
@@ -1,47 +0,0 @@
 name: Docker Build and Push
 on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * *'
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Login to Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: jcabillot/openchamber
          tags: |
            #type=ref,event=branch
            #type=ref,event=pr
            #type=sha
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
@@ -0,0 +1,46 @@
 name: Main Release
 on:
  workflow_dispatch:
  push:
    branches: [main]
 jobs:
  ci:
    uses: ./.gitea/workflows/_ci-common.yaml
    secrets: inherit
  build:
    needs: [ci]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Build (cached)
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          tags: jcabillot/opencode-openchamber:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
  tag:
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Configure git auth
        run: |
          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/perso/opencode-openchamber.git"
      - name: Bump version and push tag
        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
        env:
          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
          DEFAULT_BUMP: patch
          RELEASE_BRANCHES: main
          WITH_V: true
          GIT_API_TAGGING: false
@@ -0,0 +1,12 @@
 name: PR Checks
 on:
  workflow_dispatch:
  pull_request:
    branches: [main]
 concurrency:
  group: pr-${{ github.ref }}
  cancel-in-progress: true
 jobs:
  ci:
    uses: ./.gitea/workflows/_ci-common.yaml
    secrets: inherit
@@ -0,0 +1,12 @@
 name: Renovate
 on:
  push:
    branches:
      - main
  workflow_dispatch:
 jobs:
  renovate:
    uses: perso/gitea-pipelines/.gitea/workflows/renovate.yaml@main
    secrets: inherit
@@ -0,0 +1,70 @@
 name: Tag Release
 on:
  push:
    tags: ['*']
 jobs:
  ci:
    uses: ./.gitea/workflows/_ci-common.yaml
    secrets: inherit
  build-push:
    needs: [ci]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - id: meta
        name: Docker metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: jcabillot/opencode-openchamber
          tags: |
            type=ref,event=tag
            type=ref,event=tag,suffix=-latest
      - name: Build and push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
  release:
    # Publishes the Gitea release for this tag (body = commits since the previous
    # tag). Renovate copies that body into the bump PR in
    # perso_private/tf-depl-kubernetes under "Release Notes"; without a release
    # that section stays empty (bare "Compare Source" link).
    needs: [build-push]
    uses: perso/gitea-pipelines/.gitea/workflows/gitea-release.yaml@main
    with:
      image: jcabillot/opencode-openchamber
    secrets: inherit
  trigger-renovate:
    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
    # Renovate instance only scans hourly, so this dispatch opens the image bump
    # PR within minutes of the release instead of up to an hour later.
    needs: [build-push, release]
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
        # needs: build-push — Renovate reads Docker Hub, so a scan started before
        # the push lands would only see the previous release.
        # RENOVATE_TOKEN is the org-level secret of this organisation.
        run: |
          curl -sS -f -X POST \
            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d '{"ref":"main"}' \
            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"
@@ -1,21 +1,25 @@
-FROM jcabillot/opencode:latest
+# `vX.Y.Z-latest` = the vX.Y.Z release rebuilt nightly by perso/opencode's cron job
 # (fresh Debian/npm packages); the bare `latest` tag stays frozen at the last release.
 FROM jcabillot/opencode:v0.0.60-latest
-ARG OPENCHAMBER_WEB_VERSION=1.12.3
+ARG OPENCHAMBER_WEB_VERSION=2.3.3
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false \
  NPM_CONFIG_LOGLEVEL=warn \
  NODE_ENV=production
 # hadolint ignore=DL4006
 USER root
-
+# hadolint ignore=DL3008
-RUN rm -rf /tmp/* \
+RUN apt-get update \
-  && apt-get update \
+  && apt-get install -y --no-install-recommends \
-  && apt-get install -y --no-install-recommends python3 make g++ \
+    python3 \
    make \
    g++ \
  && rm -rf /var/lib/apt/lists/* \
  && npm install -g --no-fund --no-audit "@openchamber/web@${OPENCHAMBER_WEB_VERSION}" \
  && npm cache clean --force \
-  && openchamber --version \
+  && openchamber --version
  && chown -R opencode:opencode /home/opencode
 WORKDIR /home/opencode/
 USER opencode
@@ -1,38 +0,0 @@
 pipeline {
  environment {
    registry = 'https://registry.hub.docker.com'
    registryCredential = 'dockerhub_jcabillot'
    dockerImage = 'jcabillot/openchamber'
  }
  agent any
  triggers {
    cron('@midnight')
  }
  stages {
    stage('Clone repository') {
      steps{
        checkout scm
      }
    }
    stage('Build image') {
      steps{
        sh 'docker build --force-rm=true --no-cache=true --pull -f Dockerfile -t ${dockerImage} .'
      }
    }
    stage('Deploy Image') {
      steps{
        script {
          withCredentials([usernamePassword(credentialsId: 'dockerhub_jcabillot', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
            sh 'docker login --username ${DOCKER_USER} --password ${DOCKER_PASS}'
            sh 'docker push ${dockerImage}'
          }
        }
      }
    }
  }
 }
@@ -1,22 +1,19 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "regexManagers": [
+  "customManagers": [
    {
      "customType": "regex",
      "description": "Track openchamber base Docker image FROM jcabillot/opencode",
-      "fileMatch": ["^Dockerfile$"],
+      "managerFilePatterns": ["/^Dockerfile$/"],
-      "matchStrings": [
+      "matchStrings": ["FROM jcabillot/opencode:(?<currentValue>[^\\s]+)"],
        "FROM jcabillot/opencode:(?<currentValue>[^\\s]+)"
      ],
      "depNameTemplate": "jcabillot/opencode",
-      "datasourceTemplate": "docker",
+      "datasourceTemplate": "docker"
      "versioningTemplate": "docker"
    },
    {
      "customType": "regex",
      "description": "Track @openchamber/web npm version from ARG in Dockerfile",
-      "fileMatch": ["^Dockerfile$"],
+      "managerFilePatterns": ["/^Dockerfile$/"],
-      "matchStrings": [
+      "matchStrings": ["ARG OPENCHAMBER_WEB_VERSION=(?<currentValue>[^\\s]+)"],
        "ARG OPENCHAMBER_WEB_VERSION=(?<currentValue>[^\\s]+)"
      ],
      "depNameTemplate": "@openchamber/web",
      "datasourceTemplate": "npm",
      "versioningTemplate": "npm"
@@ -0,0 +1,56 @@
 #!/bin/bash
 set -euo pipefail
 IMAGE="$1"
 FAILED=0
 PASSED=0
 TMPDIR="$(mktemp -d)"
 CONTAINER_NAME="test-$(echo "$IMAGE" | tr ':/' '-')-$$"
 trap 'docker rm -f "$CONTAINER_NAME" 2>/dev/null; rm -rf "$TMPDIR"' EXIT
 DOCKER_GW=$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}')
 BASE_URL="http://${DOCKER_GW}:3000"
 assert_eq() {
  local desc="$1" expected="$2" actual="$3"
  if [ "$expected" = "$actual" ]; then
    echo "PASS: $desc"
    PASSED=$((PASSED + 1))
  else
    echo "FAIL: $desc (expected '$expected', got '$actual')"
    FAILED=$((FAILED + 1))
  fi
 }
 docker run -d --name "$CONTAINER_NAME" -p 3000:3000 \
  -e OPENCHAMBER_ALLOW_UNAUTHENTICATED_LAN=true \
  "$IMAGE"
 echo "Waiting for container..."
 READY=false
 for i in $(seq 1 30); do
  if curl -s -o /dev/null "$BASE_URL/"; then
    echo "Container ready (attempt $i)"
    READY=true
    break
  fi
  sleep 2
 done
 if [ "$READY" = false ]; then
  echo "Container did not become ready within 60s"
  echo "=== Container logs ==="
  docker logs "$CONTAINER_NAME" 2>&1 || true
  exit 1
 fi
 STATUS=$(curl -s -o "$TMPDIR/body" -w '%{http_code}' "$BASE_URL/")
 echo "HTTP status: $STATUS"
 assert_eq "HTTP 200" "200" "$STATUS"
 echo ""
 echo "$PASSED/$((PASSED + FAILED)) tests passed"
 if [ "$FAILED" -gt 0 ]; then
  exit 1
 fi