67 lines
2.1 KiB
YAML
67 lines
2.1 KiB
YAML
name: Run app
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release:
|
|
description: "Published full commit SHA or Git tag (not a branch or latest)"
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
request:
|
|
name: Run selected image over restricted SSH
|
|
# Execute trusted control-plane code, never a user-selected release workflow.
|
|
if: github.ref == 'refs/heads/master'
|
|
runs-on: python-ci
|
|
env:
|
|
REGISTRY: gitea.vandeplanque.com
|
|
IMAGE_REPOSITORY: tonio/car-tracker
|
|
DOCKER_CONFIG: /tmp/car-tracker-docker-auth
|
|
RELEASE: ${{ github.event.inputs.release }}
|
|
steps:
|
|
- name: Check out trusted master workflow revision
|
|
uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0
|
|
|
|
- name: Install Docker client
|
|
run: sh ops/ci/install-docker-cli.sh
|
|
|
|
- name: Install Python
|
|
uses: https://github.com/astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
|
|
with:
|
|
version: "0.9.3"
|
|
python-version: "3.13"
|
|
enable-cache: false
|
|
add-problem-matchers: false
|
|
github-token: ""
|
|
|
|
- name: Authenticate to registry
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
test -n "$REGISTRY_USER" && test -n "$REGISTRY_TOKEN"
|
|
umask 077
|
|
mkdir -p "$DOCKER_CONFIG"
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USER" --password-stdin
|
|
|
|
- name: Install SSH client
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends openssh-client
|
|
|
|
- name: Run selected release on homelab
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
|
|
GITHUB_RUN_ID: ${{ github.run_id }}
|
|
run: uv run --no-project --python 3.13 python ops/ssh/run.py
|
|
|
|
- name: Remove job registry credentials
|
|
if: always()
|
|
run: rm -rf /tmp/car-tracker-docker-auth
|