mirror of
https://github.com/imjasonh/git-k8s
synced 2026-07-09 15:16:56 +00:00
890c2b7ec9
Gitea 1.21 refuses to run as root. The non-rootless image's entrypoint switches to the git user, but kubectl exec still runs as root, causing `gitea admin user create` to fail with: "Gitea is not supposed to be run as root" Switch to gitea/gitea:1.21-rootless which runs as UID 1000, and mount emptyDir volumes at /var/lib/gitea and /etc/gitea. https://claude.ai/code/session_01QfFzqKQUsxxBsiZUhuJ3pG
315 lines
9.6 KiB
YAML
315 lines
9.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ["main"]
|
|
push:
|
|
branches: ["main"]
|
|
|
|
jobs:
|
|
build:
|
|
name: Build
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Go mod tidy
|
|
run: go mod tidy
|
|
|
|
- name: Build all binaries
|
|
run: |
|
|
go build ./cmd/push-controller/
|
|
go build ./cmd/sync-controller/
|
|
go build ./cmd/resolver-controller/
|
|
|
|
- name: Test
|
|
run: go test ./...
|
|
|
|
- name: Vet
|
|
run: go vet ./...
|
|
|
|
e2e:
|
|
name: e2e
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
KO_DOCKER_REPO: registry.local:5000/git-k8s
|
|
GOFLAGS: "-mod=mod"
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Setup KinD
|
|
id: kind
|
|
uses: chainguard-dev/actions/setup-kind@main
|
|
with:
|
|
k8s-version: 1.33.x
|
|
|
|
- name: Setup Knative
|
|
uses: chainguard-dev/actions/setup-knative@main
|
|
with:
|
|
version: "1.15.0"
|
|
|
|
- name: Install ko
|
|
uses: ko-build/setup-ko@v0.9
|
|
|
|
- name: Go mod tidy
|
|
run: go mod tidy
|
|
|
|
- name: Install CRDs
|
|
run: kubectl apply -f config/crds/
|
|
|
|
- name: Deploy RBAC
|
|
run: |
|
|
kubectl create namespace git-system || true
|
|
kubectl apply -f config/rbac/
|
|
|
|
- name: Deploy controllers with ko
|
|
run: ko apply -f config/deployments/
|
|
|
|
- name: Wait for controllers to be ready
|
|
run: |
|
|
for deploy in push-controller sync-controller resolver-controller; do
|
|
echo "Waiting for ${deploy}..."
|
|
kubectl rollout status deployment/${deploy} \
|
|
--namespace=git-system --timeout=120s
|
|
done
|
|
|
|
- name: Verify CRDs are installed
|
|
run: |
|
|
kubectl get crd gitrepositories.git-k8s.imjasonh.com
|
|
kubectl get crd gitbranches.git-k8s.imjasonh.com
|
|
kubectl get crd gitpushtransactions.git-k8s.imjasonh.com
|
|
kubectl get crd gitreposyncs.git-k8s.imjasonh.com
|
|
|
|
- name: Deploy Gitea git server
|
|
run: |
|
|
kubectl apply -f - <<'EOF'
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea
|
|
namespace: git-system
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
containers:
|
|
- name: gitea
|
|
image: gitea/gitea:1.21-rootless
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
env:
|
|
- name: GITEA__database__DB_TYPE
|
|
value: sqlite3
|
|
- name: GITEA__security__INSTALL_LOCK
|
|
value: "true"
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/v1/version
|
|
port: 3000
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/gitea
|
|
- name: config
|
|
mountPath: /etc/gitea
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: config
|
|
emptyDir: {}
|
|
EOF
|
|
kubectl apply -f - <<'EOF'
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea
|
|
namespace: git-system
|
|
spec:
|
|
selector:
|
|
app: gitea
|
|
ports:
|
|
- port: 3000
|
|
targetPort: 3000
|
|
name: http
|
|
EOF
|
|
|
|
- name: Wait for Gitea
|
|
run: |
|
|
kubectl rollout status deployment/gitea -n git-system --timeout=120s
|
|
# Wait for Gitea API to be fully responsive inside the pod.
|
|
for i in $(seq 1 30); do
|
|
if kubectl exec -n git-system deploy/gitea -- \
|
|
curl -sf http://localhost:3000/api/v1/version; then
|
|
echo ""
|
|
echo "Gitea API is ready"
|
|
break
|
|
fi
|
|
echo "Waiting for Gitea API (attempt $i)..."
|
|
sleep 2
|
|
done
|
|
|
|
- name: Create Gitea admin user
|
|
run: |
|
|
kubectl exec -n git-system deploy/gitea -- \
|
|
gitea admin user create \
|
|
--admin \
|
|
--username testadmin \
|
|
--password testpassword123 \
|
|
--email admin@test.local \
|
|
--must-change-password=false
|
|
|
|
- name: Create test repository
|
|
run: |
|
|
kubectl exec -n git-system deploy/gitea -- \
|
|
curl -sf -X POST http://localhost:3000/api/v1/user/repos \
|
|
-H 'Content-Type: application/json' \
|
|
-u testadmin:testpassword123 \
|
|
-d '{"name":"test-repo","auto_init":true,"default_branch":"main"}'
|
|
echo ""
|
|
echo "Test repository created"
|
|
|
|
- name: Create Git credentials Secret
|
|
run: |
|
|
kubectl create secret generic gitea-creds \
|
|
--namespace=default \
|
|
--from-literal=username=testadmin \
|
|
--from-literal=password=testpassword123
|
|
|
|
- name: Create GitRepository
|
|
run: |
|
|
cat <<'EOF' | kubectl apply -f -
|
|
apiVersion: git-k8s.imjasonh.com/v1alpha1
|
|
kind: GitRepository
|
|
metadata:
|
|
name: test-repo
|
|
namespace: default
|
|
spec:
|
|
url: http://gitea.git-system.svc.cluster.local:3000/testadmin/test-repo.git
|
|
defaultBranch: main
|
|
auth:
|
|
secretRef:
|
|
name: gitea-creds
|
|
EOF
|
|
kubectl get gitrepositories -A
|
|
|
|
- name: Create GitBranch
|
|
run: |
|
|
cat <<'EOF' | kubectl apply -f -
|
|
apiVersion: git-k8s.imjasonh.com/v1alpha1
|
|
kind: GitBranch
|
|
metadata:
|
|
name: test-repo-feature
|
|
namespace: default
|
|
spec:
|
|
repositoryRef: test-repo
|
|
branchName: feature-test
|
|
EOF
|
|
kubectl get gitbranches -A
|
|
|
|
- name: Push main to a new branch via GitPushTransaction
|
|
run: |
|
|
cat <<'EOF' | kubectl apply -f -
|
|
apiVersion: git-k8s.imjasonh.com/v1alpha1
|
|
kind: GitPushTransaction
|
|
metadata:
|
|
name: test-push
|
|
namespace: default
|
|
spec:
|
|
repositoryRef: test-repo
|
|
refSpecs:
|
|
- source: refs/heads/main
|
|
destination: refs/heads/feature-test
|
|
EOF
|
|
kubectl get gitpushtransactions -A
|
|
|
|
- name: Wait for push transaction to succeed
|
|
run: |
|
|
echo "Waiting for GitPushTransaction to complete..."
|
|
for i in $(seq 1 60); do
|
|
PHASE=$(kubectl get gitpushtransaction test-push -n default \
|
|
-o jsonpath='{.status.phase}' 2>/dev/null)
|
|
echo " attempt ${i}: phase=${PHASE:-Pending}"
|
|
if [ "$PHASE" = "Succeeded" ]; then
|
|
echo "Push transaction succeeded!"
|
|
break
|
|
elif [ "$PHASE" = "Failed" ]; then
|
|
echo "Push transaction FAILED!"
|
|
kubectl get gitpushtransaction test-push -n default -o yaml
|
|
kubectl logs -n git-system deploy/push-controller --tail=100
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
PHASE=$(kubectl get gitpushtransaction test-push -n default \
|
|
-o jsonpath='{.status.phase}')
|
|
if [ "$PHASE" != "Succeeded" ]; then
|
|
echo "Timed out waiting for push transaction (phase: ${PHASE:-empty})"
|
|
kubectl logs -n git-system deploy/push-controller --tail=100
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify push transaction result
|
|
run: |
|
|
echo "=== GitPushTransaction status ==="
|
|
kubectl get gitpushtransaction test-push -n default -o yaml
|
|
|
|
COMMIT=$(kubectl get gitpushtransaction test-push -n default \
|
|
-o jsonpath='{.status.resultCommit}')
|
|
echo "Result commit: $COMMIT"
|
|
if [ -z "$COMMIT" ]; then
|
|
echo "FAIL: resultCommit is empty"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify GitBranch was updated by controller
|
|
run: |
|
|
echo "=== GitBranch status ==="
|
|
kubectl get gitbranch test-repo-feature -n default -o yaml
|
|
|
|
COMMIT=$(kubectl get gitbranch test-repo-feature -n default \
|
|
-o jsonpath='{.status.headCommit}')
|
|
echo "GitBranch headCommit: $COMMIT"
|
|
if [ -z "$COMMIT" ]; then
|
|
echo "FAIL: GitBranch headCommit was not updated by the controller"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify branch exists on git server
|
|
run: |
|
|
echo "Listing branches on Gitea..."
|
|
kubectl exec -n git-system deploy/gitea -- \
|
|
curl -sf http://localhost:3000/api/v1/repos/testadmin/test-repo/branches/feature-test \
|
|
-u testadmin:testpassword123
|
|
echo ""
|
|
echo "Branch feature-test verified on git server!"
|
|
|
|
- name: Collect diagnostics
|
|
if: ${{ failure() }}
|
|
uses: chainguard-dev/actions/kind-diag@main
|
|
with:
|
|
artifact-name: kind-logs
|
|
cluster-resources: nodes,namespaces,crds
|
|
namespace-resources: pods,deployments,services,gitrepositories,gitbranches,gitpushtransactions
|