octoturge
278023e4c2
First real run of the new job failed at container creation: "Error response from daemon: Duplicate mount point: /var/run/docker.sock". The docker-build runner's config.yaml has docker_host: "" (not "-"), which means act_runner already auto-injects the host socket into job containers on its own - the workflow's explicit container.volumes mount for the same path was a second, conflicting request for it. Just dropping the explicit mount; the runner already provides it.
116 lines
4.7 KiB
YAML
116 lines
4.7 KiB
YAML
name: Provision Coder Templates
|
|
|
|
# Keeps Coder templates in sync with templates/*/ in this repo:
|
|
# - every push to main pushes a new version of each templates/<env>/ dir
|
|
# (coder templates push creates it if it doesn't exist yet, so adding a
|
|
# new templates/<env>/ directory is enough to provision a new one)
|
|
# - if a templates/<env>/ directory is removed on main, its template is
|
|
# deleted from Coder. `coder templates delete` refuses to delete a
|
|
# template that still has active workspaces, so this can't silently
|
|
# orphan running workspaces - it just fails loudly and needs a human.
|
|
#
|
|
# Requires two repo/org secrets (Settings > Actions > Secrets):
|
|
# CODER_URL e.g. https://code.octoturge.com
|
|
# CODER_SESSION_TOKEN a token from `coder tokens create`, ideally under a
|
|
# dedicated service account rather than a personal one
|
|
# GITEA_PACKAGE_TOKEN a Gitea access token (user Settings > Applications)
|
|
# with write:package scope, for pushing templates/web's
|
|
# image to this instance's container registry. Only
|
|
# the octoturge account's own token is used - login()
|
|
# hardcodes that username to match.
|
|
#
|
|
# templates/web builds its Docker image here (build-web-image, on the
|
|
# dedicated "docker-build" runner - see templates/web/main.tf for why: that
|
|
# runner is scoped to this repo only and has host Docker socket access that
|
|
# the shared runner-1 deliberately doesn't). provision then just pulls the
|
|
# tag build-web-image produced, instead of building it itself at
|
|
# `terraform apply` time - keeps the slow Rust toolchain compile off of
|
|
# "someone is waiting to create a workspace".
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "templates/**"
|
|
- ".gitea/workflows/coder-templates.yml"
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
build-web-image:
|
|
# The docker-build runner's docker_host: "" setting already auto-injects
|
|
# /var/run/docker.sock into job containers - an explicit
|
|
# container.volumes mount for the same path here fails at container
|
|
# creation with "Duplicate mount point: /var/run/docker.sock".
|
|
runs-on: docker-build
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build and push templates/web's image (skips if the tag already exists)
|
|
run: |
|
|
set -e
|
|
TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
|
|
IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
|
|
echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
|
|
if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
|
|
echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
|
|
exit 0
|
|
fi
|
|
docker build -t "$IMAGE" templates/web
|
|
docker push "$IMAGE"
|
|
|
|
provision:
|
|
needs: build-web-image
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CODER_URL: ${{ secrets.CODER_URL }}
|
|
CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
|
|
steps:
|
|
- name: Checkout (full history, needed to detect removed templates)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install coder CLI
|
|
run: |
|
|
set -e
|
|
curl -fsSL https://coder.com/install.sh | sh
|
|
coder version
|
|
|
|
- name: Push (create or update) every template
|
|
run: |
|
|
set -e
|
|
for dir in templates/*/; do
|
|
name="profiles-$(basename "$dir")"
|
|
echo "::group::Pushing $name from $dir"
|
|
coder templates push "$name" -d "$dir" --yes \
|
|
-m "auto-provisioned from ${GITHUB_SHA:0:12}"
|
|
echo "::endgroup::"
|
|
done
|
|
|
|
- name: Delete templates whose directory was removed
|
|
if: github.event_name == 'push'
|
|
run: |
|
|
set -e
|
|
PREV_SHA="$(git rev-parse HEAD~1 2>/dev/null || true)"
|
|
if [ -z "$PREV_SHA" ]; then
|
|
echo "No previous commit on this branch (first push), nothing to diff. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
OLD_DIRS="$(git ls-tree -d --name-only "$PREV_SHA" -- 'templates/*' 2>/dev/null | xargs -n1 basename 2>/dev/null || true)"
|
|
if [ -z "$OLD_DIRS" ]; then
|
|
echo "No templates/ directory at $PREV_SHA, nothing to diff. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
for old in $OLD_DIRS; do
|
|
if [ ! -d "templates/$old" ]; then
|
|
name="profiles-$old"
|
|
echo "::group::Deleting $name (templates/$old was removed)"
|
|
coder templates delete "$name" --yes \
|
|
|| echo "::warning::Failed to delete $name - check for active workspaces still using it."
|
|
echo "::endgroup::"
|
|
fi
|
|
done
|