Merge remote-tracking branch 'origin/feat/gitea-actions'
This commit is contained in:
Greg Hellings
@@ -0,0 +1,51 @@
|
||||
name: Update flake.lock
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 0 * * 0" # Every Sunday at midnight UTC
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
update-flake-lock:
|
||||
runs-on: [self-hosted, nix]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Update flake.lock
|
||||
run: nix flake update
|
||||
|
||||
- name: Create PR if changed
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
|
||||
GITEA_URL: https://src.thehellings.com
|
||||
REPO: greg/nixos
|
||||
run: |
|
||||
if git diff --quiet flake.lock; then
|
||||
echo "flake.lock unchanged, nothing to do"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BRANCH="auto/update-flake-lock-$(date +%Y%m%d)"
|
||||
git config user.email "klaatu@thehellings.com"
|
||||
git config user.name "klaatu"
|
||||
git checkout -b "$BRANCH"
|
||||
git add flake.lock
|
||||
git commit -m "chore: update flake.lock $(date +%Y-%m-%d)"
|
||||
|
||||
# Push branch using token auth
|
||||
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
|
||||
git push origin "$BRANCH"
|
||||
|
||||
# Create PR via Gitea API
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"chore: update flake.lock $(date +%Y-%m-%d)\",
|
||||
\"head\": \"$BRANCH\",
|
||||
\"base\": \"main\",
|
||||
\"body\": \"Automated weekly flake.lock update.\\n\\nGenerated by Gitea Actions.\",
|
||||
\"assignees\": [\"greg\"]
|
||||
}"
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Update manifest chart versions
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 0 * * 1" # Every Monday at midnight UTC
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
update-manifests:
|
||||
runs-on: [self-hosted, nix]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Scan manifests for chart version updates
|
||||
run: |
|
||||
echo "TODO: implement manifest update scanning"
|
||||
echo ""
|
||||
echo "Planned implementation:"
|
||||
echo " 1. Parse each manifests/*/chart.yaml for HelmRelease chart versions"
|
||||
echo " 2. Query artifact hub or helm repo for latest versions"
|
||||
echo " 3. Emit a diff of available updates"
|
||||
echo ""
|
||||
echo "Scanned manifests directories:"
|
||||
ls manifests/
|
||||
|
||||
- name: Create PR if changes found
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.KLAATU_TOKEN }}
|
||||
GITEA_URL: https://src.thehellings.com
|
||||
REPO: greg/nixos
|
||||
run: |
|
||||
if git diff --quiet; then
|
||||
echo "No manifest changes, nothing to do"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BRANCH="auto/update-manifests-$(date +%Y%m%d)"
|
||||
git config user.email "klaatu@thehellings.com"
|
||||
git config user.name "klaatu"
|
||||
git checkout -b "$BRANCH"
|
||||
git add manifests/
|
||||
git commit -m "chore: update manifest chart versions $(date +%Y-%m-%d)"
|
||||
|
||||
git remote set-url origin "https://klaatu:${GITEA_TOKEN}@${GITEA_URL#https://}/${REPO}.git"
|
||||
git push origin "$BRANCH"
|
||||
|
||||
curl -s -X POST \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Content-Type: application/json" \
|
||||
"${GITEA_URL}/api/v1/repos/${REPO}/pulls" \
|
||||
-d "{
|
||||
\"title\": \"chore: update manifest chart versions $(date +%Y-%m-%d)\",
|
||||
\"head\": \"$BRANCH\",
|
||||
\"base\": \"main\",
|
||||
\"body\": \"Automated weekly manifest chart version update.\\n\\nGenerated by Gitea Actions.\",
|
||||
\"assignees\": [\"greg\"]
|
||||
}"
|
||||
@@ -0,0 +1,56 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
interval: "24h"
|
||||
url: https://dl.gitea.com/charts/
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitea-runner
|
||||
namespace: gitea-runner
|
||||
spec:
|
||||
interval: 10m
|
||||
chart:
|
||||
spec:
|
||||
chart: actions
|
||||
version: "0.0.4"
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitea
|
||||
interval: "1h"
|
||||
values:
|
||||
rbac:
|
||||
create: true
|
||||
serviceAccount:
|
||||
create: true
|
||||
gitea:
|
||||
instanceURL: https://src.thehellings.com
|
||||
runnerToken:
|
||||
existingSecret: gitea-runner
|
||||
existingSecretKey: token
|
||||
imagePullSecrets:
|
||||
- name: image-pull-secrets
|
||||
config:
|
||||
runner:
|
||||
labels:
|
||||
# Ubuntu
|
||||
- "ubuntu-22.04:docker://ubuntu:22.04"
|
||||
- "ubuntu-24.04:docker://ubuntu:24.04"
|
||||
- "ubuntu-24.10:docker://ubuntu:24.10"
|
||||
# Fedora
|
||||
- "fedora-41:docker://fedora:41"
|
||||
- "fedora-42:docker://fedora:42"
|
||||
# CentOS Stream
|
||||
- "centos-stream-9:docker://quay.io/centos/centos:stream9"
|
||||
- "centos-stream-10:docker://quay.io/centos/centos:stream10"
|
||||
# Nix
|
||||
- "nix:docker://nixos/nix:latest"
|
||||
# ci-images (internal registry: src.thehellings.com/greg)
|
||||
- "ci-builder:docker://src.thehellings.com/greg/builder:latest"
|
||||
- "ci-vm-test:docker://src.thehellings.com/greg/vm-test:latest"
|
||||
- "ci-sword:docker://src.thehellings.com/greg/sword-container-builder:latest"
|
||||
- "ci-bitwarden:docker://src.thehellings.com/greg/bitwarden:latest"
|
||||
- "ci-immich:docker://src.thehellings.com/greg/immich:latest"
|
||||
@@ -0,0 +1,6 @@
|
||||
namespace: gitea-runner
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- secrets.yaml
|
||||
- chart.yaml
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea-runner
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-runner
|
||||
namespace: gitea-runner
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: bitwarden-login
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitea-runner
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
key: 11419680-5338-4f19-bdd9-b422007046af
|
||||
property: password
|
||||
@@ -0,0 +1,65 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.greg.gitea-runner;
|
||||
hostname = config.networking.hostName;
|
||||
|
||||
# Determine extra labels based on host role
|
||||
roleLabels =
|
||||
if builtins.elem hostname [ "isaiah" "jeremiah" "zeke" ] then
|
||||
[ "bare-metal" ]
|
||||
else if hostname == "linode" then
|
||||
[ "linode" ]
|
||||
else
|
||||
[ ];
|
||||
in
|
||||
{
|
||||
options.greg.gitea-runner = {
|
||||
enable = lib.mkEnableOption "Enable Gitea Actions runner (exec/shell mode)";
|
||||
|
||||
hostnameLabel = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = config.networking.hostName;
|
||||
description = "Label identifying this host in the runner pool (defaults to hostname)";
|
||||
};
|
||||
|
||||
tokenFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
Path to the file containing the runner registration token.
|
||||
Wire in your agenix secret path here, e.g.:
|
||||
config.age.secrets.gitea-runner-token.path
|
||||
'';
|
||||
};
|
||||
|
||||
threads = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
default = 4;
|
||||
description = "Maximum number of concurrent jobs";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.gitea-actions-runner;
|
||||
instances.${hostname} = {
|
||||
enable = true;
|
||||
url = "https://src.thehellings.com";
|
||||
tokenFile = cfg.tokenFile;
|
||||
labels =
|
||||
[
|
||||
"self-hosted"
|
||||
cfg.hostnameLabel
|
||||
]
|
||||
++ roleLabels;
|
||||
settings = {
|
||||
runner.capacity = cfg.threads;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user