From 6123604595e659e34cf0cd7b1a69e3404f89025d Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Thu, 25 Jun 2026 18:45:48 -0400 Subject: [PATCH] ci: auto build & push image on main (:latest) + v* tags Mirror mort-ci.yml's build-and-push: BuildKit secrets (REGISTRY_USER/ REGISTRY_PASSWORD) for private majordomo access instead of build-args, and the LAN --add-host so the builder can reach the registry. push main -> :latest + :sha-; tag v* -> : + :latest; other branches -> :branch-; PRs build-only (no push). Optional DISCORD_WEBHOOK_URL notifications. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/build-image.yml | 104 +++++++++++++++++++++++++------ Dockerfile | 24 +++---- README.md | 10 +-- 3 files changed, 104 insertions(+), 34 deletions(-) diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml index 1925442..6ed0bc2 100644 --- a/.gitea/workflows/build-image.yml +++ b/.gitea/workflows/build-image.yml @@ -1,47 +1,113 @@ name: Build & push image # Builds the Gadfly reviewer container and pushes it to the Gitea container -# registry. Tag a release (v1, v1.2.0, …) to publish that version + :latest. +# registry. Mirrors mort-ci.yml's build-and-push (BuildKit secrets for private +# module access + the LAN --add-host so the builder can reach the registry). +# +# push to main -> :latest + :sha- +# push tag v* -> : + :latest +# other branch push -> :branch- + :sha- +# pull_request -> build only (no push), as a sanity check # # Required repo secrets: # REGISTRY_USER / REGISTRY_PASSWORD Gitea creds with registry push + read # access to the private majordomo module. +# Optional: +# DISCORD_WEBHOOK_URL build notifications (unset => silent). on: push: + branches: [main] tags: ["v*"] + pull_request: + types: [opened, synchronize, reopened] workflow_dispatch: {} +concurrency: + group: gadfly-image-${{ github.ref }} + cancel-in-progress: true + env: - IMAGE: gitea.stevedudenhoeffer.com/steve/gadfly + IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/gadfly jobs: - image: + build-and-push: runs-on: ubuntu-latest + timeout-minutes: 20 steps: - uses: actions/checkout@v4 + - name: Set up Docker Buildx + run: docker buildx create --use --name gadfly-builder --driver docker-container 2>/dev/null || docker buildx use gadfly-builder + - name: Log in to the registry - run: | - echo "${{ secrets.REGISTRY_PASSWORD }}" \ - | docker login gitea.stevedudenhoeffer.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin + if: github.event_name != 'pull_request' + env: + REGISTRY_USER: ${{ secrets.REGISTRY_USER }} + REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} + run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin - - name: Resolve tags - id: tags + - name: Compute tags + id: meta run: | - if [ "${{ github.ref_type }}" = "tag" ]; then - echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT" + SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7) + PUSH=true + if [ "${{ github.event_name }}" = "pull_request" ]; then + # Build-only sanity check; nothing published. + TAGS="${IMAGE_NAME}:pr-${{ github.event.pull_request.number }}" + PUSH=false + elif [ "${{ github.ref_type }}" = "tag" ]; then + TAGS="${IMAGE_NAME}:${GITHUB_REF_NAME},${IMAGE_NAME}:latest" + elif [ "${GITHUB_REF_NAME}" = "main" ]; then + TAGS="${IMAGE_NAME}:latest,${IMAGE_NAME}:sha-${SHA_SHORT}" else - echo "version=dev-$(echo ${{ github.sha }} | cut -c1-8)" >> "$GITHUB_OUTPUT" + BRANCH_SAFE=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^-//; s/-$//') + TAGS="${IMAGE_NAME}:branch-${BRANCH_SAFE},${IMAGE_NAME}:sha-${SHA_SHORT}" fi + echo "tags=${TAGS}" >> "$GITHUB_OUTPUT" + echo "push=${PUSH}" >> "$GITHUB_OUTPUT" + echo "Tags: ${TAGS} (push=${PUSH})" - - name: Build & push + - name: Notify Discord (started) + if: github.event_name != 'pull_request' + env: + WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }} run: | - docker build \ - --build-arg GIT_USER="${{ secrets.REGISTRY_USER }}" \ - --build-arg GIT_TOKEN="${{ secrets.REGISTRY_PASSWORD }}" \ - -t "${IMAGE}:${{ steps.tags.outputs.version }}" \ - -t "${IMAGE}:latest" \ + [ -z "$WEBHOOK_URL" ] && exit 0 + MSG="🪰 Gadfly image build #${{ github.run_number }} started on \`${{ github.ref_name }}\` (${{ github.sha }})." + curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true + + - name: Build and push + env: + REGISTRY_USER: ${{ secrets.REGISTRY_USER }} + REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} + run: | + TAG_FLAGS="" + IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}" + for tag in "${TAG_ARRAY[@]}"; do TAG_FLAGS="$TAG_FLAGS --tag $tag"; done + + PUSH_FLAG="--push" + [ "${{ steps.meta.outputs.push }}" = "false" ] && PUSH_FLAG="--output=type=cacheonly" + + docker buildx build \ + $PUSH_FLAG \ + --platform linux/amd64 \ + $TAG_FLAGS \ + --add-host gitea.stevedudenhoeffer.com:192.168.0.134 \ + --secret id=REGISTRY_USER,env=REGISTRY_USER \ + --secret id=REGISTRY_PASSWORD,env=REGISTRY_PASSWORD \ + --file ./Dockerfile \ . - docker push "${IMAGE}:${{ steps.tags.outputs.version }}" - docker push "${IMAGE}:latest" + + - name: Notify Discord (result) + if: always() && github.event_name != 'pull_request' + env: + WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }} + run: | + [ -z "$WEBHOOK_URL" ] && exit 0 + if [ "${{ job.status }}" = "success" ]; then + MSG="✅ Gadfly image build #${{ github.run_number }} succeeded. Tags: \`${{ steps.meta.outputs.tags }}\`." + else + MSG="❌ Gadfly image build #${{ github.run_number }} failed. Check Actions logs." + fi + curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true diff --git a/Dockerfile b/Dockerfile index fd0834c..a76891f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,25 +1,27 @@ # syntax=docker/dockerfile:1 # -# Multi-stage so the private-module access token used to fetch the majordomo -# dependency lives ONLY in the build stage and never lands in the final image. +# Multi-stage so the private-module credentials (used to fetch the majordomo +# dependency) live ONLY in the build stage via BuildKit secrets and never land +# in the final image. Mirrors mort's Dockerfile secret idiom. FROM golang:1.26 AS build ARG GIT_HOST=gitea.stevedudenhoeffer.com -ARG GIT_USER= -ARG GIT_TOKEN= ENV CGO_ENABLED=0 \ GOFLAGS=-mod=mod \ - GOSUMDB=off + GOSUMDB=off \ + GOTOOLCHAIN=auto ENV GOPRIVATE=${GIT_HOST}/* GONOSUMDB=${GIT_HOST}/* WORKDIR /src -# Private Go module access (majordomo). Token is confined to this stage. -RUN if [ -n "$GIT_TOKEN" ]; then \ - git config --global url."https://${GIT_USER}:${GIT_TOKEN}@${GIT_HOST}/".insteadOf "https://${GIT_HOST}/"; \ - fi COPY go.mod go.sum ./ -RUN go mod download +RUN --mount=type=secret,id=REGISTRY_USER \ + --mount=type=secret,id=REGISTRY_PASSWORD \ + --mount=type=cache,target=/go/pkg/mod \ + git config --global url."https://$(cat /run/secrets/REGISTRY_USER):$(cat /run/secrets/REGISTRY_PASSWORD)@${GIT_HOST}/".insteadOf "https://${GIT_HOST}/" \ + && go mod download COPY . . -RUN go build -trimpath -ldflags="-s -w" -o /out/gadfly ./cmd/gadfly +RUN --mount=type=cache,target=/go/pkg/mod \ + --mount=type=cache,target=/root/.cache/go-build \ + go build -trimpath -ldflags="-s -w" -o /out/gadfly ./cmd/gadfly FROM alpine:3.20 RUN apk add --no-cache bash git curl jq ca-certificates diff --git a/README.md b/README.md index 15153ed..22da6ae 100644 --- a/README.md +++ b/README.md @@ -65,13 +65,15 @@ cmd/gadfly/ the agentic reviewer binary (majordomo + Ollama Cloud); z scripts/run.sh fetches the PR diff, runs the reviewer, upserts one labeled comment scripts/system-prompt.txt the reviewer persona + verification discipline entrypoint.sh the container brains: trigger gating, clone, model loop (logic lives here, not in YAML) -Dockerfile multi-stage; the build-time module token never reaches the final image -.gitea/workflows/build-image.yml tags v* → build & push the image +Dockerfile multi-stage; build-time module creds (BuildKit secrets) never reach the final image +.gitea/workflows/build-image.yml push to main → :latest; tag v* → : + :latest examples/ the ~15-line stub a consuming repo drops in ``` -The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Push a `v*` tag to -build and publish a new version (and `:latest`). +The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Every push to `main` +rebuilds and republishes `:latest` (plus `:sha-`); pushing a `v*` tag publishes that +pinned version (plus `:latest`). Pin consumers to a `:vN` tag for stability, or track +`:latest` to ride main. ## Configuration (advanced)