opencodecabilloteu
328a4a11aa
A release only reached perso_private/tf-depl-kubernetes on the next hourly Renovate scan, so the image bump PR could lag up to an hour behind the tag. After the image push completes, dispatch that repo's Renovate workflow through the Gitea API (workflow_dispatch is already enabled there). It authenticates with the RENOVATE_TOKEN org secret of this organisation — the same token the Renovate instance itself uses, no extra credential. The job fails loudly so a rotated token shows up instead of the trigger silently going missing.
68 lines
2.6 KiB
YAML
68 lines
2.6 KiB
YAML
name: Tag Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['*']
|
|
|
|
jobs:
|
|
hadolint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
|
|
continue-on-error: true
|
|
with:
|
|
dockerfile: Dockerfile
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
|
|
- run: docker build --load -t ci-image:${{ github.sha }} .
|
|
- run: bash tests/test.sh ci-image:${{ github.sha }}
|
|
|
|
build-push:
|
|
needs: [test]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- id: meta
|
|
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
|
|
with:
|
|
images: jcabillot/sabnzbd
|
|
tags: |
|
|
type=ref,event=tag
|
|
type=ref,event=tag,suffix=-latest
|
|
- uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
pull: true
|
|
|
|
trigger-renovate:
|
|
# The deployment repo perso_private/tf-depl-kubernetes pins this image; its
|
|
# Renovate instance only scans hourly, so this dispatch opens the image bump
|
|
# PR within minutes of the release instead of up to an hour later.
|
|
needs: [build-push]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Trigger Renovate on perso_private/tf-depl-kubernetes
|
|
# needs: build-push — Renovate reads Docker Hub, so a scan started before
|
|
# the push lands would only see the previous release.
|
|
# RENOVATE_TOKEN is the org-level secret of this organisation.
|
|
run: |
|
|
curl -sS -f -X POST \
|
|
-u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{{"ref":"main"}}' \
|
|
"https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
|
|
echo "Renovate dispatched on perso_private/tf-depl-kubernetes"
|