From b8445a83c4a45ec509d21b4920c76fcee29c0b22 Mon Sep 17 00:00:00 2001 From: Torsten Ueberschar Date: Fri, 30 Oct 2026 15:21:49 +0100 Subject: [PATCH] =?UTF-8?q?feat:=20Woodpecker-Plugin=20deploy=20f=C3=BCr?= =?UTF-8?q?=20oumta-deploy?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Schreibt dev- und beta-Images mit Digest nach tanztee/oumta-deploy über dessen ci/deploy-image.sh. Gebaut per .woodpecker/plugins.yaml, Release über Tag deploy-vX.Y.Z. Co-Authored-By: Claude Opus 5.5 --- .woodpecker/plugins.yaml | 33 +++++++++++++++++++++++ README.md | 51 ++++++++++++++++++++++++++++++++++++ woodpecker/deploy/Dockerfile | 5 ++++ woodpecker/deploy/deploy.sh | 35 +++++++++++++++++++++++++ 4 files changed, 124 insertions(+) create mode 100644 .woodpecker/plugins.yaml create mode 100644 woodpecker/deploy/Dockerfile create mode 100755 woodpecker/deploy/deploy.sh diff --git a/.woodpecker/plugins.yaml b/.woodpecker/plugins.yaml new file mode 100644 index 0000000..9466d84 --- /dev/null +++ b/.woodpecker/plugins.yaml @@ -0,0 +1,33 @@ +# Builds the plugins in woodpecker//. A tag -vX.Y.Z pushes +# git.uesome.de/actions/ci-cd/:vX.Y.Z; pushes and PRs only test the build. +when: + - event: [push, pull_request] + path: 'woodpecker/deploy/**' + - event: tag + ref: refs/tags/deploy-v* + +steps: + - name: deploy-plugin-check + image: woodpeckerci/plugin-docker-buildx:6.1.2 + settings: + repo: git.uesome.de/actions/ci-cd/deploy + context: woodpecker/deploy + dockerfile: woodpecker/deploy/Dockerfile + dry_run: true + when: + event: [push, pull_request] + + - name: deploy-plugin + image: woodpeckerci/plugin-docker-buildx:6.1.2 + settings: + registry: git.uesome.de + repo: git.uesome.de/actions/ci-cd/deploy + context: woodpecker/deploy + dockerfile: woodpecker/deploy/Dockerfile + tags: ${CI_COMMIT_TAG##deploy-} + username: + from_secret: registry_username + password: + from_secret: registry_password + when: + event: tag diff --git a/README.md b/README.md index 96e207e..1196c64 100644 --- a/README.md +++ b/README.md @@ -117,3 +117,54 @@ jobs: kubeconfig: ${{ secrets.KUBECONFIG }} registry: ${{ secrets.REGISTRY }} ``` + +## Woodpecker plugins + +Plugins are Docker images built from `woodpecker//` by `.woodpecker/plugins.yaml`. A tag `-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/:vX.Y.Z`; pipelines pin that version. + +### deploy + +Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16 there). `ci/deploy-image.sh` in oumta-deploy decides the environment from the tag: `-dev.` goes to dev, `-beta.` to beta, anything else is skipped (prod only via PR). + +Settings: + +- `var` (required): variable in `envs//images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`). +- `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`. +- `registry_username`, `registry_password`: read access to the registry for the digest +- `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo) +- `tag`: default `CI_COMMIT_TAG` +- `registry`: default `git.uesome.de` +- `image`: default `/` +- `deploy_user`: default `oumta-ci` +- `deploy_repo`: default `https://git.uesome.de/tanztee/oumta-deploy.git` + +Example: + +```yaml +when: + event: tag + ref: refs/tags/v* + +steps: + - name: build + image: woodpeckerci/plugin-docker-buildx:6.1.2 + settings: + registry: git.uesome.de + repo: git.uesome.de/tanztee/oumta-auth + tags: ${CI_COMMIT_TAG} + username: + from_secret: registry_username + password: + from_secret: registry_password + + - name: deploy + image: git.uesome.de/actions/ci-cd/deploy:v1.0.0 + settings: + var: AUTH_IMAGE + registry_username: + from_secret: registry_username + registry_password: + from_secret: registry_password + deploy_token: + from_secret: oumta_deploy_token +``` diff --git a/woodpecker/deploy/Dockerfile b/woodpecker/deploy/Dockerfile new file mode 100644 index 0000000..efa36c8 --- /dev/null +++ b/woodpecker/deploy/Dockerfile @@ -0,0 +1,5 @@ +# Woodpecker plugin: writes dev and beta image tags with digest to oumta-deploy +FROM alpine:3.20 +RUN apk add --no-cache bash git ca-certificates crane +COPY deploy.sh /usr/local/bin/deploy.sh +ENTRYPOINT ["/usr/local/bin/deploy.sh"] diff --git a/woodpecker/deploy/deploy.sh b/woodpecker/deploy/deploy.sh new file mode 100755 index 0000000..4b445d1 --- /dev/null +++ b/woodpecker/deploy/deploy.sh @@ -0,0 +1,35 @@ +#!/usr/bin/env bash +# Woodpecker plugin "deploy": writes the pushed image with its digest to +# oumta-deploy. ci/deploy-image.sh there decides the environment from the tag +# (-dev. -> dev, -beta. -> beta, anything else -> nothing). +set -euo pipefail + +die() { echo "deploy: $*" >&2; exit 1; } + +VAR=${PLUGIN_VAR:?settings.var is missing} +REGISTRY=${PLUGIN_REGISTRY:-git.uesome.de} +IMAGE=${PLUGIN_IMAGE:-$REGISTRY/${CI_REPO:?CI_REPO is missing}} +TAG=${PLUGIN_TAG:-${CI_COMMIT_TAG:-}} +DEPLOY_USER=${PLUGIN_DEPLOY_USER:-oumta-ci} +DEPLOY_REPO=${PLUGIN_DEPLOY_REPO:-https://git.uesome.de/tanztee/oumta-deploy.git} +[[ -n $TAG ]] || die "no tag (settings.tag or tag event)" +[[ -n ${PLUGIN_DEPLOY_TOKEN:-} ]] || die "settings.deploy_token is missing" + +major=${TAG#v}; major=${major%%.*} +VAR=${VAR//\{major\}/$major} + +if [[ -n ${PLUGIN_REGISTRY_USERNAME:-} ]]; then + crane auth login "$REGISTRY" -u "$PLUGIN_REGISTRY_USERNAME" --password-stdin \ + <<<"${PLUGIN_REGISTRY_PASSWORD:?settings.registry_password is missing}" >/dev/null +fi + +# Token only via credential helper, never in a URL or config, so no log shows it +helper='!f() { echo "username=$DEPLOY_USER"; echo "password=$PLUGIN_DEPLOY_TOKEN"; }; f' +export DEPLOY_USER PLUGIN_DEPLOY_TOKEN +work=$(mktemp -d) +git -c credential.helper="$helper" clone --quiet "$DEPLOY_REPO" "$work/oumta-deploy" +git -C "$work/oumta-deploy" config credential.helper "$helper" + +export DEPLOY_ENVS=${PLUGIN_ENVS:-} +export SOURCE_REPO=${CI_REPO:-} SOURCE_COMMIT=${CI_COMMIT_SHA:-} +"$work/oumta-deploy/ci/deploy-image.sh" "$VAR" "${IMAGE,,}:$TAG" -- 2.54.0