2026-10-30 14:23:44 +00:00
4 changed files with 124 additions and 0 deletions
@@ -0,0 +1,33 @@
+# Builds the plugins in woodpecker/<name>/. A tag <name>-vX.Y.Z pushes
+# git.uesome.de/actions/ci-cd/<name>:vX.Y.Z; pushes and PRs only test the build.
+when:
+  - event: [push, pull_request]
+    path: 'woodpecker/deploy/**'
+  - event: tag
+    ref: refs/tags/deploy-v*
+
+steps:
+  - name: deploy-plugin-check
+    image: woodpeckerci/plugin-docker-buildx:6.1.2
+    settings:
+      repo: git.uesome.de/actions/ci-cd/deploy
+      context: woodpecker/deploy
+      dockerfile: woodpecker/deploy/Dockerfile
+      dry_run: true
+    when:
+      event: [push, pull_request]
+
+  - name: deploy-plugin
+    image: woodpeckerci/plugin-docker-buildx:6.1.2
+    settings:
+      registry: git.uesome.de
+      repo: git.uesome.de/actions/ci-cd/deploy
+      context: woodpecker/deploy
+      dockerfile: woodpecker/deploy/Dockerfile
+      tags: ${CI_COMMIT_TAG##deploy-}
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
+    when:
+      event: tag
@@ -117,3 +117,54 @@ jobs:
          kubeconfig: ${{ secrets.KUBECONFIG }}
          registry: ${{ secrets.REGISTRY }}
 ```
+
+## Woodpecker plugins
+
+Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version.
+
+### deploy
+
+Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16 there). `ci/deploy-image.sh` in oumta-deploy decides the environment from the tag: `-dev.` goes to dev, `-beta.` to beta, anything else is skipped (prod only via PR).
+
+Settings:
+
+- `var` (required): variable in `envs/<env>/images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`).
+- `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`.
+- `registry_username`, `registry_password`: read access to the registry for the digest
+- `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo)
+- `tag`: default `CI_COMMIT_TAG`
+- `registry`: default `git.uesome.de`
+- `image`: default `<registry>/<CI_REPO>`
+- `deploy_user`: default `oumta-ci`
+- `deploy_repo`: default `https://git.uesome.de/tanztee/oumta-deploy.git`
+
+Example:
+
+```yaml
+when:
+  event: tag
+  ref: refs/tags/v*
+
+steps:
+  - name: build
+    image: woodpeckerci/plugin-docker-buildx:6.1.2
+    settings:
+      registry: git.uesome.de
+      repo: git.uesome.de/tanztee/oumta-auth
+      tags: ${CI_COMMIT_TAG}
+      username:
+        from_secret: registry_username
+      password:
+        from_secret: registry_password
+
+  - name: deploy
+    image: git.uesome.de/actions/ci-cd/deploy:v1.0.0
+    settings:
+      var: AUTH_IMAGE
+      registry_username:
+        from_secret: registry_username
+      registry_password:
+        from_secret: registry_password
+      deploy_token:
+        from_secret: oumta_deploy_token
+```
@@ -0,0 +1,5 @@
+# Woodpecker plugin: writes dev and beta image tags with digest to oumta-deploy
+FROM alpine:3.20
+RUN apk add --no-cache bash git ca-certificates crane
+COPY deploy.sh /usr/local/bin/deploy.sh
+ENTRYPOINT ["/usr/local/bin/deploy.sh"]
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Woodpecker plugin "deploy": writes the pushed image with its digest to
+# oumta-deploy. ci/deploy-image.sh there decides the environment from the tag
+# (-dev. -> dev, -beta. -> beta, anything else -> nothing).
+set -euo pipefail
+
+die() { echo "deploy: $*" >&2; exit 1; }
+
+VAR=${PLUGIN_VAR:?settings.var is missing}
+REGISTRY=${PLUGIN_REGISTRY:-git.uesome.de}
+IMAGE=${PLUGIN_IMAGE:-$REGISTRY/${CI_REPO:?CI_REPO is missing}}
+TAG=${PLUGIN_TAG:-${CI_COMMIT_TAG:-}}
+DEPLOY_USER=${PLUGIN_DEPLOY_USER:-oumta-ci}
+DEPLOY_REPO=${PLUGIN_DEPLOY_REPO:-https://git.uesome.de/tanztee/oumta-deploy.git}
+[[ -n $TAG ]] || die "no tag (settings.tag or tag event)"
+[[ -n ${PLUGIN_DEPLOY_TOKEN:-} ]] || die "settings.deploy_token is missing"
+
+major=${TAG#v}; major=${major%%.*}
+VAR=${VAR//\{major\}/$major}
+
+if [[ -n ${PLUGIN_REGISTRY_USERNAME:-} ]]; then
+  crane auth login "$REGISTRY" -u "$PLUGIN_REGISTRY_USERNAME" --password-stdin \
+    <<<"${PLUGIN_REGISTRY_PASSWORD:?settings.registry_password is missing}" >/dev/null
+fi
+
+# Token only via credential helper, never in a URL or config, so no log shows it
+helper='!f() { echo "username=$DEPLOY_USER"; echo "password=$PLUGIN_DEPLOY_TOKEN"; }; f'
+export DEPLOY_USER PLUGIN_DEPLOY_TOKEN
+work=$(mktemp -d)
+git -c credential.helper="$helper" clone --quiet "$DEPLOY_REPO" "$work/oumta-deploy"
+git -C "$work/oumta-deploy" config credential.helper "$helper"
+
+export DEPLOY_ENVS=${PLUGIN_ENVS:-}
+export SOURCE_REPO=${CI_REPO:-} SOURCE_COMMIT=${CI_COMMIT_SHA:-}
+"$work/oumta-deploy/ci/deploy-image.sh" "$VAR" "${IMAGE,,}:$TAG"