ci: use Zot API key at registry.oeo.one [CI]
This commit is contained in:
justme committed
1 parent
fd01120d3a
commit
d570435236
4 files changed
+17
-19
No files matched your search
+1
-1
@@ -1,7 +1,7 @@
|
||||
# API only. Loopback binding lets a local frontend or host reverse proxy reach it.
|
||||
API_BIND_ADDRESS=127.0.0.1
|
||||
API_PORT=5000
|
||||
WEBDROP_IMAGE_REPO=zot.oeo.one/justme/webdrop-api
|
||||
WEBDROP_IMAGE_REPO=registry.oeo.one/justme/webdrop-api
|
||||
WEBDROP_IMAGE_TAG=local
|
||||
|
||||
WEBDROP_REQUESTS_PER_MINUTE=600
|
||||
|
||||
@@ -28,23 +28,22 @@ steps:
|
||||
publish-dev-image:
|
||||
image: bash
|
||||
environment:
|
||||
ZOT_USERNAME:
|
||||
from_secret: registry_username
|
||||
ZOT_PASSWORD:
|
||||
from_secret: registry_password
|
||||
ZOT_REGISTRY: 192.168.2.162:5000
|
||||
ZOT_USERNAME: justme
|
||||
ZOT_API_KEY:
|
||||
from_secret: registry_api_key
|
||||
ZOT_REGISTRY: registry.oeo.one
|
||||
commands:
|
||||
- set -euo pipefail
|
||||
- ': "${WOODPECKER_BACKEND_LOCAL_TEMP_DIR:=$HOME/woodpecker/work}"'
|
||||
- buildah_store="$(dirname "$WOODPECKER_BACKEND_LOCAL_TEMP_DIR")/buildah-cache/webdrop"
|
||||
- mkdir -p "$buildah_store/storage" "$buildah_store/run"
|
||||
- 'buildah() { command buildah --root "$buildah_store/storage" --runroot "$buildah_store/run" "$@"; }'
|
||||
- printf '%s' "$ZOT_PASSWORD" | buildah login --tls-verify=false "$ZOT_REGISTRY" --username "$ZOT_USERNAME" --password-stdin
|
||||
- printf '%s' "$ZOT_API_KEY" | buildah login "$ZOT_REGISTRY" --username "$ZOT_USERNAME" --password-stdin
|
||||
- trap 'buildah logout "$ZOT_REGISTRY" >/dev/null 2>&1 || true' EXIT
|
||||
- sha="${CI_COMMIT_SHA:0:7}"
|
||||
- image="$ZOT_REGISTRY/justme/webdrop-api:dev-$sha"
|
||||
- dev_image="$ZOT_REGISTRY/justme/webdrop-api:dev"
|
||||
- buildah bud --layers --network host --format docker --platform linux/amd64 --tag "$image" --file server/Dockerfile .
|
||||
- buildah tag "$image" "$dev_image"
|
||||
- buildah push --tls-verify=false "$image" "docker://$image"
|
||||
- buildah push --tls-verify=false "$dev_image" "docker://$dev_image"
|
||||
- buildah push "$image" "docker://$image"
|
||||
- buildah push "$dev_image" "docker://$dev_image"
|
||||
@@ -40,11 +40,10 @@ steps:
|
||||
publish-backend:
|
||||
image: bash
|
||||
environment:
|
||||
ZOT_USERNAME:
|
||||
from_secret: registry_username
|
||||
ZOT_PASSWORD:
|
||||
from_secret: registry_password
|
||||
ZOT_REGISTRY: 192.168.2.162:5000
|
||||
ZOT_USERNAME: justme
|
||||
ZOT_API_KEY:
|
||||
from_secret: registry_api_key
|
||||
ZOT_REGISTRY: registry.oeo.one
|
||||
commands:
|
||||
- set -euo pipefail
|
||||
- release_tag="${CI_COMMIT_TAG:-${RELEASE_TAG:-}}"
|
||||
@@ -53,12 +52,12 @@ steps:
|
||||
- buildah_store="$(dirname "$WOODPECKER_BACKEND_LOCAL_TEMP_DIR")/buildah-cache/webdrop"
|
||||
- mkdir -p "$buildah_store/storage" "$buildah_store/run"
|
||||
- 'buildah() { command buildah --root "$buildah_store/storage" --runroot "$buildah_store/run" "$@"; }'
|
||||
- printf '%s' "$ZOT_PASSWORD" | buildah login --tls-verify=false "$ZOT_REGISTRY" --username "$ZOT_USERNAME" --password-stdin
|
||||
- printf '%s' "$ZOT_API_KEY" | buildah login "$ZOT_REGISTRY" --username "$ZOT_USERNAME" --password-stdin
|
||||
- trap 'buildah logout "$ZOT_REGISTRY" >/dev/null 2>&1 || true' EXIT
|
||||
- image="$ZOT_REGISTRY/justme/webdrop-api:$release_tag"
|
||||
- latest_image="$ZOT_REGISTRY/justme/webdrop-api:latest"
|
||||
- buildah bud --layers --network host --format docker --platform linux/amd64 --tag "$image" --file server/Dockerfile .
|
||||
- buildah tag "$image" "$latest_image"
|
||||
- buildah push --tls-verify=false "$image" "docker://$image"
|
||||
- buildah push --tls-verify=false "$latest_image" "docker://$latest_image"
|
||||
- buildah push "$image" "docker://$image"
|
||||
- buildah push "$latest_image" "docker://$latest_image"
|
||||
|
||||
+2
-2
@@ -38,13 +38,13 @@ CAPTCHA_SECRET=<server-side-secret>
|
||||
|
||||
`.woodpecker/ci.yml` 在默认分支 push、pull request 和手动运行时执行 API 契约与服务端检查；`.woodpecker/web-build.yml` 同时执行 Core 测试向量、类型检查、Web CSS lint、测试和构建。两个 workflow 独立运行，让前后端验证并行。默认分支当前为 `master`，配置也兼容迁移后的 `main`。
|
||||
|
||||
默认分支每次 push 和 PR 都会跑常规检查。提交信息含 `[SKIP TESTS]` 时只跳过服务端测试；API 契约检查和前端/Core 检查照常运行。提交信息含 `[CI]` 时，`.woodpecker/dev-image.yml` 会等 `ci` 和 `web-build` 都通过后，构建并推送带提交 SHA 的开发镜像以及可变 `dev` 标签。开发镜像不会覆盖 release tag 或 `latest`。
|
||||
默认分支每次 push 和 PR 都会跑常规检查。提交信息含 `[SKIP TESTS]` 时只跳过服务端测试；API 契约检查和前端/Core 检查照常运行。提交信息含 `[CI]` 时，`.woodpecker/dev-image.yml` 会等 `ci` 和 `web-build` 都通过后，构建并推送带提交 SHA 的开发镜像以及可变 `dev` 标签。开发镜像不会覆盖 release tag 或 `latest`。发布目标为 `registry.oeo.one/justme/webdrop-api`；Buildah 使用 Woodpecker secret `registry_api_key` 作为 Zot API key 的密码字段，用户名为 `justme`，并启用默认 TLS 校验。Gitea clone 凭据保存在 `gitea_clone_webdrop` secret。
|
||||
|
||||
`.woodpecker/release-backend.yml` 响应 `vMAJOR.MINOR.PATCH` SemVer tag；也可手动运行并传入 `RELEASE_TAG`(例如 `v0.1.0`)。发布 workflow 会重新执行 Core、Web 和服务端完整检查，全部通过后才用 Linux native agent 的 Buildah 构建并推送后端镜像 tag 与 `latest`。所有 workflow 都通过 Woodpecker secret `gitea_clone_webdrop` 从 `https://git.oeo.one` 克隆公开仓库。
|
||||
|
||||
两条流水线固定到 `ci: domain-linux-native` 的 `linux/amd64` Agent；该主机需要 Node 24、.NET 10 和 Buildah。release job 在 `WOODPECKER_BACKEND_LOCAL_TEMP_DIR` 对应的持久目录缓存 Buildah 层，Dockerfile 单独缓存 NuGet restore 层。Gitea webhook 走同 Docker 网络中的 `woodpecker-server:8000`，代码 clone 走公网 Git 域名。
|
||||
|
||||
后端镜像发布到 `zot.oeo.one/justme/webdrop-api`。Woodpecker Linux agent 通过内网 `192.168.2.162:5000` 访问同一 Zot 仓库，发布需要 Buildah 与 tag/manual 事件可用的 secrets `registry_username`、`registry_password`。使用已发布镜像时，在 `.env` 中设置 `WEBDROP_IMAGE_TAG`，仓库名已填入 `.env.example`。
|
||||
后端镜像发布到 `registry.oeo.one/justme/webdrop-api`。Woodpecker Linux agent 通过 TLS 连接 registry；发布需要 Buildah 与 push/tag/manual 事件可用的 `registry_api_key` secret。使用已发布镜像时，在 `.env` 中设置 `WEBDROP_IMAGE_TAG`，仓库名已填入 `.env.example`。
|
||||
|
||||
API 契约版本以 `contracts/api-contract.json` 为准，并同步到 OpenAPI 与后端 `/api/v1/info`。加字段等向后兼容更新递增 minor，兼容性修复递增 patch，破坏性更新递增 major。前端声明支持的契约主版本；后端主版本变化时，前端 CI 契约检查和运行时连接检查都会失败，直到前端同步支持该主版本。
|
||||
|
||||
|
||||
Reference in new issue
Block a user