Merge pull request 'ci(tag): déclenche Renovate sur tf-depl-kubernetes dès que l'image de release est poussée (opencode-openchamber)' (#62 ) from ci/renovate-dispatch-on-release into main

Reviewed-on: #62
ci(tag): dispatch Renovate on tf-depl-kubernetes once the release image is pushed
2026-10-18 13:43:29 -04:00 · 2026-10-18 13:22:13 -04:00 · 2026-10-17 20:31:03 -04:00 · 2026-10-18 00:15:36 +00:00 · 2026-10-17 15:59:13 -04:00 · 2026-10-17 19:52:27 +00:00
7 changed files with 123 additions and 89 deletions
@@ -0,0 +1,34 @@
+name: CI Shared Jobs
+
+on:
+  workflow_call:
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        with:
+          dockerfile: Dockerfile
+          failure-threshold: warning
+
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - name: Build (cached)
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: Dockerfile
+          push: false
+          load: true
+          tags: ci-image:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Test
+        run: bash tests/test.sh ci-image:${{ github.sha }}
@@ -1,52 +1,46 @@
 name: Nightly Rebuild
-
 on:
  schedule:
    - cron: '0 0 * * *'
-
 jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        with:
-          dockerfile: Dockerfile
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-
+  ci:
+    uses: ./.gitea/workflows/_ci-common.yaml
+    secrets: inherit
  build-push:
-    needs: [test]
+    needs: [ci]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - id: get-latest-tag
+        name: Get latest tag
        run: |
          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          echo "tag=$TAG" >> $GITHUB_OUTPUT
      - id: meta
+        name: Docker metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: jcabillot/opencode-openchamber
          tags: |
            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - name: Build and push
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
+          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -1,40 +1,43 @@
 name: Main Release
 on:
+  workflow_dispatch:
  push:
    branches: [main]
 jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        continue-on-error: true
-        with:
-          dockerfile: Dockerfile
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
+  ci:
+    uses: ./.gitea/workflows/_ci-common.yaml
+    secrets: inherit
  build:
-    needs: [test]
+    needs: [ci]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - run: docker build -t jcabillot/opencode-openchamber:${{ github.sha }} .
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - name: Build (cached)
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: Dockerfile
+          push: false
+          load: true
+          tags: jcabillot/opencode-openchamber:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
  tag:
    needs: [build]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
      - name: Configure git auth
        run: |
          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/perso/opencode-openchamber.git"
-      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
+      - name: Bump version and push tag
+        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
        env:
          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
          DEFAULT_BUMP: patch
@@ -1,24 +1,12 @@
 name: PR Checks
 on:
+  workflow_dispatch:
  pull_request:
    branches: [main]
+concurrency:
+  group: pr-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        continue-on-error: true
-        with:
-          dockerfile: Dockerfile
-
-  build-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - run: docker build -t ci-image:${{ github.sha }} .
+  ci:
+    uses: ./.gitea/workflows/_ci-common.yaml
+    secrets: inherit
@@ -1,47 +1,59 @@
 name: Tag Release
-
 on:
  push:
    tags: ['*']
-
 jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
-        with:
-          dockerfile: Dockerfile
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-
+  ci:
+    uses: ./.gitea/workflows/_ci-common.yaml
+    secrets: inherit
  build-push:
-    needs: [test]
+    needs: [ci]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - id: meta
+        name: Docker metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        with:
          images: jcabillot/opencode-openchamber
          tags: |
            type=ref,event=tag
            type=ref,event=tag,suffix=-latest
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - name: Build and push
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
+          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{{"ref":"main"}}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"
@@ -1,7 +1,8 @@
-# hadolint ignore=DL3007
-FROM jcabillot/opencode:latest
+# `vX.Y.Z-latest` = the vX.Y.Z release rebuilt nightly by perso/opencode's cron job
+# (fresh Debian/npm packages); the bare `latest` tag stays frozen at the last release.
+FROM jcabillot/opencode:v0.0.60-latest

-ARG OPENCHAMBER_WEB_VERSION=1.23.0
+ARG OPENCHAMBER_WEB_VERSION=2.3.3

 ENV NPM_CONFIG_UPDATE_NOTIFIER=false \
  NPM_CONFIG_LOGLEVEL=warn \
@@ -23,7 +23,9 @@ assert_eq() {
  fi
 }

-docker run -d --name "$CONTAINER_NAME" -p 3000:3000 "$IMAGE"
+docker run -d --name "$CONTAINER_NAME" -p 3000:3000 \
+  -e OPENCHAMBER_ALLOW_UNAUTHENTICATED_LAN=true \
+  "$IMAGE"

 echo "Waiting for container..."
 READY=false