diff --git a/.gitea/workflows/coder-templates.yml b/.gitea/workflows/coder-templates.yml new file mode 100644 index 0000000..49b177d --- /dev/null +++ b/.gitea/workflows/coder-templates.yml @@ -0,0 +1,80 @@ +name: Provision Coder Templates + +# Keeps Coder templates in sync with templates/*/ in this repo: +# - every push to main pushes a new version of each templates// dir +# (coder templates push creates it if it doesn't exist yet, so adding a +# new templates// directory is enough to provision a new one) +# - if a templates// directory is removed on main, its template is +# deleted from Coder. `coder templates delete` refuses to delete a +# template that still has active workspaces, so this can't silently +# orphan running workspaces - it just fails loudly and needs a human. +# +# Requires two repo/org secrets (Settings > Actions > Secrets): +# CODER_URL e.g. https://code.octoturge.com +# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a +# dedicated service account rather than a personal one + +on: + push: + branches: [main] + paths: + - "templates/**" + - "scripts/**" + - "profile-templates/**" + - ".gitea/workflows/coder-templates.yml" + workflow_dispatch: {} + +jobs: + provision: + runs-on: ubuntu-latest + env: + CODER_URL: ${{ secrets.CODER_URL }} + CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }} + steps: + - name: Checkout (full history, needed to detect removed templates) + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Install coder CLI + run: | + set -e + curl -fsSL https://coder.com/install.sh | sh + coder version + + - name: Push (create or update) every template + run: | + set -e + for dir in templates/*/; do + name="profiles-$(basename "$dir")" + echo "::group::Pushing $name from $dir" + coder templates push "$name" -d "$dir" --yes \ + -m "auto-provisioned from ${GITHUB_SHA:0:12}" + echo "::endgroup::" + done + + - name: Delete templates whose directory was removed + if: github.event_name == 'push' + run: | + set -e + PREV_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)" + if [ -z "$PREV_SHA" ]; then + echo "No previous commit on this branch (first push), nothing to diff. Skipping." + exit 0 + fi + + OLD_DIRS="$(git ls-tree -d --name-only "$PREV_SHA" -- templates 2>/dev/null | xargs -n1 basename 2>/dev/null || true)" + if [ -z "$OLD_DIRS" ]; then + echo "No templates/ directory at $PREV_SHA, nothing to diff. Skipping." + exit 0 + fi + + for old in $OLD_DIRS; do + if [ ! -d "templates/$old" ]; then + name="profiles-$old" + echo "::group::Deleting $name (templates/$old was removed)" + coder templates delete "$name" --yes \ + || echo "::warning::Failed to delete $name - check for active workspaces still using it." + echo "::endgroup::" + fi + done diff --git a/README.md b/README.md index 5f26074..b440318 100644 --- a/README.md +++ b/README.md @@ -25,15 +25,17 @@ extensions/ # Agent Skills bundles, installed per env (see below Each `templates//main.tf` is a complete, independent Coder template (agent, docker container, code-server, JetBrains). They're deliberately not built from a shared Terraform module - only their `locals` block differs -(which profile file to read). Push them individually: +(which profile file to read). The naming convention is `profiles-` +(matches what `.gitea/workflows/coder-templates.yml` does automatically - +see below). To push by hand: ```sh -coder templates push profiles-default -d templates/default -coder templates push profiles-3d -d templates/3d-printing -coder templates push profiles-cobol -d templates/cobol -coder templates push profiles-python -d templates/python -coder templates push profiles-ttrpg -d templates/ttrpg -coder templates push profiles-web -d templates/web +coder templates push profiles-default -d templates/default +coder templates push profiles-3d-printing -d templates/3d-printing +coder templates push profiles-cobol -d templates/cobol +coder templates push profiles-python -d templates/python +coder templates push profiles-ttrpg -d templates/ttrpg +coder templates push profiles-web -d templates/web ``` ### How the VS Code profile gets applied @@ -111,3 +113,40 @@ the `SPECIALTY_SKILLS` env var passed to the script from each template's - 3D Printing -> `openscad-parametric` - TTRPG -> `foundryvtt-modding` and `ttrpg-lore-weaver` - Default / Python / Web -> none (no matching specialty skill exists yet) + +### Auto-provisioning (Gitea Actions) + +`.gitea/workflows/coder-templates.yml` keeps Coder in sync with this repo on +every push to `main` that touches `templates/**`, `scripts/**`, or +`profile-templates/**`: + +- **Add** a new `templates//` directory -> next push creates a new + Coder template `profiles-` automatically. No workflow edits needed. +- **Edit** an existing `templates//main.tf` (or a shared script/profile + it references) -> next push updates that template with a new version. +- **Remove** a `templates//` directory -> next push deletes + `profiles-` from Coder. `coder templates delete` refuses if the + template still has active workspaces, so this fails loudly instead of + silently orphaning anyone's running workspace - that failure only shows up + as a `::warning::` in the job log, it doesn't fail the whole run. + +It runs on the `ubuntu-latest` self-hosted runner already registered on this +Gitea instance and installs the `coder` CLI itself via `coder.com/install.sh`. + +**One-time setup required** (not something this workflow can do for itself - +needs a human with Coder access): + +1. Create a Coder API token - ideally under a dedicated service account + rather than a personal login, since this token can create/delete + templates: + ```sh + coder login https://code.octoturge.com + coder tokens create --name gitea-ci --lifetime 8760h + ``` +2. In Gitea, go to this repo's **Settings -> Actions -> Secrets** (or the + org-level equivalent to share across repos) and add: + - `CODER_URL` = `https://code.octoturge.com` + - `CODER_SESSION_TOKEN` = the token printed by step 1 + +Until those secrets exist, the workflow will run and fail cleanly at the +`coder templates push` step rather than doing anything destructive.