octoturge
8b3653ee96
Run 109 failed: profiles-3d-printing (and the same would've hit every other already-versioned template) already had a "v1" version from the previous run, and the pre-check meant to detect that and skip (coder templates versions list -o json piped through jq) apparently doesn't match the CLI's actual JSON shape - it never found the existing version, so the push was attempted anyway and coder rejected the duplicate name, failing the whole job. Simpler and more robust: just attempt the push and treat its specific "A template version with name ... already exists" failure as the skip signal, instead of trying to predict it from a separate list call.
226 lines
10 KiB
YAML
226 lines
10 KiB
YAML
name: Provision Coder Templates
|
|
|
|
# Keeps Coder templates in sync with templates/*/ in this repo:
|
|
# - every push to main pushes a new version of each templates/<env>/ dir
|
|
# whose VERSION file names a version not already pushed (coder templates
|
|
# push creates the template if it doesn't exist yet, so adding a new
|
|
# templates/<env>/ directory - with a VERSION file - is enough to
|
|
# provision a new one). This workflow triggers on any change under
|
|
# templates/**, not just a specific template's own directory, so VERSION
|
|
# is what keeps an edit to one template from generating a no-op new
|
|
# version for every other, unchanged template.
|
|
# - if a templates/<env>/ directory is removed on main, its template is
|
|
# deleted from Coder. `coder templates delete` refuses to delete a
|
|
# template that still has active workspaces, so this can't silently
|
|
# orphan running workspaces - it just fails loudly and needs a human.
|
|
#
|
|
# Requires three repo/org secrets (Settings > Actions > Secrets):
|
|
# CODER_URL e.g. https://code.octoturge.com
|
|
# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a
|
|
# dedicated service account rather than a personal one
|
|
# PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
|
|
# with write:package scope, for pushing each
|
|
# Dockerfile-having template's image to this
|
|
# instance's container registry.
|
|
#
|
|
# Not secrets.GITEA_TOKEN (Gitea Actions' built-in token): as of this
|
|
# writing it cannot authenticate to the container registry in any shipped
|
|
# Gitea version - `permissions: packages: write` is a no-op because the
|
|
# Actions token's package scope isn't wired up server-side yet (open since
|
|
# Gitea 1.19: https://github.com/go-gitea/gitea/issues/23642; fix in
|
|
# https://github.com/go-gitea/gitea/pull/39070, not yet merged). Every
|
|
# attempt fails at docker login with a plain "unauthorized", regardless of
|
|
# the permissions: block or which account triggered the workflow. A
|
|
# manually-created PAT is the only thing that currently works. Named
|
|
# without a GITEA_ prefix because Gitea Actions reserves that prefix for
|
|
# its own built-in secrets and rejects creating one with that name.
|
|
#
|
|
# Any templates/<env>/ that has its own Dockerfile gets its image built and
|
|
# pushed here (build-images, on the dedicated "docker-build" runner - see
|
|
# templates/web/main.tf for why: that runner is scoped to this repo only and
|
|
# has host Docker socket access that the shared runner-1 deliberately
|
|
# doesn't). provision then just pulls the tag build-images produced, instead
|
|
# of building it itself at `terraform apply` time - keeps a slow toolchain
|
|
# compile off of "someone is waiting to create a workspace".
|
|
#
|
|
# Each template's image is built independently - one Dockerfile failing to
|
|
# build doesn't stop the others from building, and provision skips pushing
|
|
# only the specific template(s) whose image build failed this run (leaving
|
|
# their previous, already-working Coder template version in place) rather
|
|
# than skipping every template or pushing one with no matching image.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "templates/**"
|
|
- ".gitea/workflows/coder-templates.yml"
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
build-images:
|
|
# The docker-build runner's docker_host: "" setting already auto-injects
|
|
# /var/run/docker.sock into job containers - an explicit
|
|
# container.volumes mount for the same path here fails at container
|
|
# creation with "Duplicate mount point: /var/run/docker.sock".
|
|
runs-on: docker-build
|
|
# Currently a no-op (see the PACKAGE_REGISTRY_TOKEN note above) but
|
|
# harmless to declare now - once go-gitea/gitea#39070 ships, GITEA_TOKEN
|
|
# will need this to get package write access, so this is one less thing
|
|
# to remember when PACKAGE_REGISTRY_TOKEN can eventually be retired.
|
|
permissions:
|
|
packages: write
|
|
outputs:
|
|
failed_templates: ${{ steps.build.outputs.failed_templates }}
|
|
# docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
|
|
# ash) - but run: steps default to bash, which fails with "exec: bash:
|
|
# executable file not found in $PATH". Both run: steps below are plain
|
|
# POSIX shell already, so just run them under sh.
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
steps:
|
|
# actions/checkout is a JS action and needs Node in the job container -
|
|
# this job runs in docker:27-cli (Alpine, just the Docker CLI) so it has
|
|
# no Node, and actions/checkout fails immediately with "exec: node:
|
|
# executable file not found in $PATH". Alpine does have apk/git though,
|
|
# so clone directly instead.
|
|
- name: Checkout
|
|
run: |
|
|
set -e
|
|
apk add --no-cache git
|
|
git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" .
|
|
|
|
- name: Build and push every template's image (skips a tag that's already in the registry)
|
|
id: build
|
|
run: |
|
|
set -e
|
|
echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
|
|
|
|
FAILED=""
|
|
for dockerfile in templates/*/Dockerfile; do
|
|
[ -e "$dockerfile" ] || continue
|
|
dir="$(dirname "$dockerfile")"
|
|
name="$(basename "$dir")"
|
|
TAG="$(sha1sum "$dockerfile" | cut -d' ' -f1)"
|
|
IMAGE="git.octoturge.com/octo-tech/profiles-${name}:${TAG}"
|
|
|
|
echo "::group::${name}"
|
|
if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
|
|
echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
|
|
elif docker build -t "$IMAGE" "$dir" && docker push "$IMAGE"; then
|
|
echo "Built and pushed $IMAGE"
|
|
else
|
|
echo "::warning::Failed to build/push $IMAGE - templates/$name will be skipped this run."
|
|
FAILED="$FAILED $name"
|
|
fi
|
|
echo "::endgroup::"
|
|
done
|
|
|
|
echo "failed_templates=${FAILED# }" >> "$GITHUB_OUTPUT"
|
|
|
|
provision:
|
|
# needs: build-images orders this after the image builds (so a fresh
|
|
# template push never points at a tag that isn't in the registry yet)
|
|
# without making every template's reprovisioning depend on ALL builds
|
|
# succeeding - if:always() overrides the default "skip if a dependency
|
|
# failed" behavior, since build-images only fails outright on an
|
|
# infra-level problem (e.g. registry login); a single template's build
|
|
# failure is reported via failed_templates instead and only skips that
|
|
# one template below.
|
|
needs: build-images
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CODER_URL: ${{ secrets.CODER_URL }}
|
|
CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
|
|
FAILED_TEMPLATES: ${{ needs.build-images.outputs.failed_templates }}
|
|
steps:
|
|
- name: Checkout (full history, needed to detect removed templates)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install coder CLI
|
|
run: |
|
|
set -e
|
|
curl -fsSL https://coder.com/install.sh | sh
|
|
coder version
|
|
|
|
- name: Push (create or update) every template
|
|
run: |
|
|
set -e
|
|
for dir in templates/*/; do
|
|
name="$(basename "$dir")"
|
|
full="profiles-$name"
|
|
case " $FAILED_TEMPLATES " in
|
|
*" $name "*)
|
|
echo "::warning::Skipping $full - its Docker image failed to build this run (see build-images), leaving the previous template version in place."
|
|
continue
|
|
;;
|
|
esac
|
|
|
|
# templates/<name>/VERSION lets a template opt out of being
|
|
# reprovisioned on every push: bump it and coder templates push
|
|
# names the new version "v<N>". This is a manual contract, not a
|
|
# content hash - editing a template without bumping its VERSION
|
|
# means the change won't go out until someone does. paths: on
|
|
# this workflow's trigger is templates/** as a whole, so without
|
|
# this every template gets a new (identical) version on any push
|
|
# under templates/, even ones whose own directory didn't change.
|
|
#
|
|
# Rather than pre-checking `coder templates versions list` for
|
|
# whether v<N> already exists (fragile - depends on its exact
|
|
# JSON shape matching what we expect), just attempt the push and
|
|
# treat its specific "version already exists" failure as the
|
|
# skip signal instead.
|
|
version=""
|
|
if [ -f "$dir/VERSION" ]; then
|
|
version="$(tr -d '[:space:]' < "$dir/VERSION")"
|
|
fi
|
|
|
|
args=(-d "$dir" --yes -m "auto-provisioned from ${GITHUB_SHA:0:12}")
|
|
[ -n "$version" ] && args+=(--name "v$version")
|
|
|
|
echo "::group::Pushing $full from $dir"
|
|
if push_output="$(coder templates push "$full" "${args[@]}" 2>&1)"; then
|
|
echo "$push_output"
|
|
else
|
|
push_status=$?
|
|
echo "$push_output"
|
|
if [ -n "$version" ] && printf '%s' "$push_output" | grep -qF "A template version with name \"v$version\" already exists"; then
|
|
echo "Version v$version (templates/$name/VERSION) is already pushed - nothing to do. Bump the VERSION file to push a new one."
|
|
else
|
|
echo "::endgroup::"
|
|
exit "$push_status"
|
|
fi
|
|
fi
|
|
echo "::endgroup::"
|
|
done
|
|
|
|
- name: Delete templates whose directory was removed
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
set -e
|
|
PREV_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)"
|
|
if [ -z "$PREV_SHA" ]; then
|
|
echo "No previous commit on this branch (first push), nothing to diff. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
OLD_DIRS="$(git ls-tree -d --name-only "$PREV_SHA" -- 'templates/*' 2>/dev/null | xargs -n1 basename 2>/dev/null || true)"
|
|
if [ -z "$OLD_DIRS" ]; then
|
|
echo "No templates/ directory at $PREV_SHA, nothing to diff. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
for old in $OLD_DIRS; do
|
|
if [ ! -d "templates/$old" ]; then
|
|
name="profiles-$old"
|
|
echo "::group::Deleting $name (templates/$old was removed)"
|
|
coder templates delete "$name" --yes \
|
|
|| echo "::warning::Failed to delete $name - check for active workspaces still using it."
|
|
echo "::endgroup::"
|
|
fi
|
|
done
|