## Actions This repo provides reusable Gitea Actions as composite actions that can be referenced with `uses:`. ### Bump Version Creates or updates the version in `package.json`, commits it, creates a matching Git tag, and pushes both. Inputs: - `node_version`: Node.js version to use. Default: `24` - `release_line`: optional release line for dev builds. Format: `.` or `..`. Overrides branch, PR target, inferred ancestor release branch, and `package.json`. - `gitea_token`: optional token used for checkout and push Branch and tag rules: - `main`: creates release tags from the latest commit message (`release/x.y.z`, `release/x.y`, `hotfix/x.y.z`) or falls back to a patch bump. - `release/.` or `release/..`: creates the next beta tag for that release base, e.g. `v2.4.0-beta.3` or `v2.4.1-beta.3`. - all other branches: create a dev tag for the resolved release base using a UTC timestamp, e.g. `v2.4.0-dev.20260314153045`. Dev release line resolution order: - `inputs.release_line` - current branch if it matches `release/.` or `release/..` - PR target branch if it matches `release/.` or `release/..` - newest ancestor branch from `origin/release/*` (for feature branches created from release branches outside PR context) - `major.minor` from `package.json` If no release line can be resolved for a dev build, the action fails intentionally. Examples: Commit message examples on `main`: - `release/2.4.0` -> `v2.4.0` - `release/2.4` -> `v2.4.0` - `hotfix/2.4.1` -> `v2.4.1` Branch examples: - `release/2.4` -> next `v2.4.0-beta.N` - `release/v2.4.1` -> next `v2.4.1-beta.N` - feature branch in a PR to `release/2.4` -> `v2.4.0-dev.` - feature branch created from `release/v2.4.1` (without PR base) -> `v2.4.1-dev.` when the release branch tip is an ancestor - feature branch outside a PR with `package.json` version `2.4.0` -> `v2.4.0-dev.` - feature branch outside a PR with `release_line: 2.4` -> `v2.4.0-dev.` Example: ```yaml jobs: bump-version: runs-on: ubuntu-latest permissions: contents: write steps: - uses: tanztee/ci-cd/.github/actions/bump-version@main with: gitea_token: ${{ secrets.GITEA_TOKEN }} ``` Feature branch outside a PR: ```yaml jobs: bump-version: runs-on: ubuntu-latest permissions: contents: write steps: - uses: tanztee/ci-cd/.github/actions/bump-version@main with: gitea_token: ${{ secrets.GITEA_TOKEN }} release_line: 2.4 ``` ### Build and Push Docker Image Example: ```yaml jobs: build-and-push: runs-on: ubuntu-latest permissions: contents: read packages: write steps: - uses: tanztee/ci-cd/.github/actions/build-and-push@main with: registry: ${{ secrets.REGISTRY }} registry_username: ${{ secrets.REGISTRY_USERNAME }} registry_password: ${{ secrets.REGISTRY_PASSWORD }} ``` ### Deploy Image to Kubernetes Example: ```yaml on: workflow_dispatch: inputs: tag: description: Image tag to deploy (e.g. v1.2.3) required: true type: string jobs: deploy: runs-on: ubuntu-latest steps: - uses: tanztee/ci-cd/.github/actions/deploy-k8s@main with: tag: ${{ inputs.tag }} namespace: oumta-dev kubeconfig: ${{ secrets.KUBECONFIG }} registry: ${{ secrets.REGISTRY }} ``` ## Woodpecker plugins Plugins are Docker images built from `woodpecker//` by `.woodpecker/plugins.yaml`. A tag `-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/:vX.Y.Z`; pipelines pin that version. ### deploy Writes a pushed dev or beta image with its digest to `tanztee/oumta-deploy` (D16 there). `ci/deploy-image.sh` in oumta-deploy decides the environment from the tag: `-dev.` goes to dev, `-beta.` to beta, anything else is skipped (prod only via PR). Settings: - `var` (required): variable in `envs//images.env`, e.g. `AUTH_IMAGE`. `{major}` is replaced by the major of the tag (`APP_V{major}_IMAGE` -> `APP_V2_IMAGE`). - `deploy_token` (required): token of `oumta-ci`, write access to oumta-deploy only. Limit the secret to this image and the events `tag` and `manual`. - `registry_username`, `registry_password`: read access to the registry for the digest - `envs`: fixed environments instead of the tag rule, e.g. `dev beta` (oumta-keyklo) - `tag`: default `CI_COMMIT_TAG` - `registry`: default `git.uesome.de` - `image`: default `/` - `deploy_user`: default `oumta-ci` - `deploy_repo`: default `https://git.uesome.de/tanztee/oumta-deploy.git` Example: ```yaml when: event: tag ref: refs/tags/v* steps: - name: build image: woodpeckerci/plugin-docker-buildx:6.1.2 settings: registry: git.uesome.de repo: git.uesome.de/tanztee/oumta-auth tags: ${CI_COMMIT_TAG} username: from_secret: registry_username password: from_secret: registry_password - name: deploy image: git.uesome.de/actions/ci-cd/deploy:v1.0.0 settings: var: AUTH_IMAGE registry_username: from_secret: registry_username registry_password: from_secret: registry_password deploy_token: from_secret: oumta_ci_token ``` ### bump Sets the version for the pushed branch in `package.json`, commits it as `update version: vX [skip ci]`, tags it and pushes branch and tag. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events. - `main`: release from the commit message (`release/x.y[.z]`, `hotfix/x.y.z`), otherwise a patch bump - `release/*`, `hotfix/*`: next `vX.Y.Z-beta.N` - any other branch: `vX.Y.Z-dev.`; the release line comes from `release_line`, the newest ancestor `release/*` branch, or `package.json` Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over. Settings: - `git_token` (required): token with write access to the repo (`oumta_ci_token`) - `git_user`: default `oumta-ci` - `release_line`: optional, `.[.]` - `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de` - `remote`: default `CI_REPO_CLONE_URL` Example: ```yaml when: - event: push branch: [develop, 'feature/**', 'release/**', 'hotfix/**'] - event: manual steps: - name: bump image: git.uesome.de/actions/ci-cd/bump:v1.0.0 settings: git_token: from_secret: oumta_ci_token ```