chore(deploy): remove obsolete deployment and Docker build workflows

1name: deploy

3# 部署到 gitdata 命名空间。生产 values 的非敏感部分在 deploy/values/prod.yaml，

4# 敏感值来自仓库 Secret `PROD_SECRET_VALUES`（见 deploy/README.md）。

5#

6# KUBECONFIG 由 runner 环境提供（Gitea Runner 已配置），此处不额外注入凭据。

7on:

8 push:

9 branches: [main, master]

10 # 只在真正的发布路径上触发；纯文档/CI 改动由 paths 过滤

11 paths-ignore:

12 - "docs/**"

13 - "**/*.md"

14 - ".gitea/workflows/deploy.yaml"

15 workflow_dispatch:

16 inputs:

17 image_tag:

18 description: "覆盖镜像 tag（留空则用本次提交的 sha-<short>）"

19 required: false

20 default: ""

21 dry_run:

22 description: "仅渲染并校验，不实际部署"

23 type: boolean

24 default: false

26# 部署必须串行：两个 run 同时 upgrade 同一个 release 会互相打断

27concurrency:

28 group: deploy-gitdata

29 cancel-in-progress: false

31env:

32 RELEASE: gitdata

33 NAMESPACE: gitdata

34 CHART_PATH: ./chart

36jobs:

37 deploy:

38 runs-on: ubuntu-latest

39 permissions:

40 contents: read

41 steps:

42 - name: Checkout

43 uses: actions/checkout@v4

45 - name: Resolve image tag

46 id: tag

47 run: |

48 if [ -n "${{ inputs.image_tag }}" ]; then

49 tag="${{ inputs.image_tag }}"

50 else

51 tag="sha-${GITHUB_SHA:0:7}"

52 fi

53 echo "tag=$tag" >> "$GITHUB_OUTPUT"

54 echo "::notice::deploying image tag: $tag"

56 - name: Verify image exists in registry

57 run: |

58 # build-push 与本 workflow 在同一次 push 上并行触发，镜像可能还在推送，

59 # 不等就会 helm 到一半 ImagePullBackOff。

60 #

61 # 用 artifact API 而不是 /v2/.../tags/list：后者只能拿到整个 tag 数组，

62 # 用 grep 判断会子串误匹配（查 sha-a79b908 会命中 sha-a79b908-presign），

63 # 于是 workflow 以为镜像已就绪，实际拉不到。artifact API 精确返回 200/404。

64 tag="${{ steps.tag.outputs.tag }}"

65 host="${DOCKER_REGISTER:-harbor.gitdata.me}"

66 url="https://${host}/api/v2.0/projects/app/repositories/gitdata/artifacts/${tag}"

67 for attempt in $(seq 1 30); do

68 code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 20 \

69 -u "${HARBOR_USER}:${HARBOR_PASSWORD}" "$url" || echo 000)

70 case "$code" in

71 200)

72 echo "::notice::image app/gitdata:$tag is available"

73 exit 0 ;;

74 404)

75 echo "waiting for image app/gitdata:$tag (attempt $attempt/30, not pushed yet)" ;;

76 401|403)

77 echo "::error::registry auth failed (HTTP $code) -- check DOCKER_USERNAME/DOCKER_PASSWORD"

78 exit 1 ;;

79 *)

80 echo "waiting for image app/gitdata:$tag (attempt $attempt/30, registry HTTP $code)" ;;

81 esac

82 sleep 20

83 done

84 echo "::error::image app/gitdata:$tag not found in registry after ~10min"

85 exit 1

86 env:

87 HARBOR_USER: ${{ secrets.DOCKER_USERNAME }}

88 HARBOR_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

89 DOCKER_REGISTER: ${{ secrets.DOCKER_REGISTER }}

91 - name: Assemble values

92 run: |

93 # 非敏感 values + Secret 中的敏感块

94 cat deploy/values/prod.yaml > /tmp/values.yaml

95 if [ -n "${PROD_SECRET_VALUES}" ]; then

96 printf '\n' >> /tmp/values.yaml

97 printf '%s\n' "${PROD_SECRET_VALUES}" >> /tmp/values.yaml

98 fi

99 # 本次提交对应的镜像

100 if ! grep -qE '^\s*tag:' /tmp/values.yaml; then

101 echo "::error::values file has no image.tag key"

102 exit 1

103 fi

104 echo "::group::values (secrets masked)"

105 sed -E 's/^(\s*[A-Z_]+:).*/\1 <redacted>/' /tmp/values.yaml | head -60

106 echo "::endgroup::"

107 env:

108 PROD_SECRET_VALUES: ${{ secrets.PROD_SECRET_VALUES }}

110 - name: Set up Helm

111 uses: azure/setup-helm@v4

112 with:

113 version: v3.16.3

115 - name: Render (helm template)

116 run: |

117 helm template "$RELEASE" "$CHART_PATH" \

118 --namespace "$NAMESPACE" \

119 --set "image.tag=${{ steps.tag.outputs.tag }}" \

120 -f /tmp/values.yaml > /tmp/rendered.yaml

121 echo "::notice::rendered $(grep -c '^kind:' /tmp/rendered.yaml) manifests"

123 - name: Diff against live cluster

124 run: |

125 # 只读，让评审者在日志里看到本次实际会改什么

126 if helm get manifest "$RELEASE" -n "$NAMESPACE" > /tmp/live.yaml 2>/dev/null; then

127 diff -u /tmp/live.yaml /tmp/rendered.yaml || true

128 else

129 echo "::notice::release not found yet; this will be an install"

130 fi

132 - name: Deploy (helm upgrade --install)

133 if: ${{ inputs.dry_run != true && inputs.dry_run != 'true' }}

134 run: |

135 helm upgrade --install "$RELEASE" "$CHART_PATH" \

136 --namespace "$NAMESPACE" --create-namespace \

137 -f /tmp/values.yaml \

138 --set "image.tag=${{ steps.tag.outputs.tag }}" \

139 --wait --timeout 15m \

140 --atomic

141 echo "::notice::deployed $RELEASE:${{ steps.tag.outputs.tag }}"

143 - name: Skip deploy (dry run)

144 if: ${{ inputs.dry_run == true || inputs.dry_run == 'true' }}

145 run: echo "::notice::dry_run=true; render validated, cluster untouched"

147 - name: Verify rollout

148 if: ${{ inputs.dry_run != true && inputs.dry_run != 'true' }}

149 run: |

150 echo "=== pods ==="

151 kubectl get pods -n "$NAMESPACE" -l app.kubernetes.io/instance="$RELEASE" -o wide

152 echo "=== images in use ==="

153 kubectl get deploy -n "$NAMESPACE" -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.template.spec.containers[0].image}{"\n"}{end}'

154 echo "=== waiting for rollout ==="

155 for d in $(kubectl get deploy -n "$NAMESPACE" -l app.kubernetes.io/instance="$RELEASE" -o name); do

156 kubectl rollout status "$d" -n "$NAMESPACE" --timeout=180s

157 done

158 echo "=== recent errors ==="

159 kubectl get events -n "$NAMESPACE" --field-selector type=Warning --sort-by=.lastTimestamp | tail -15 || true

161 - name: Deploy summary

162 if: always()

163 run: |

164 {

165 echo "## Deploy ${{ job.status }}"

166 echo ""

167 echo "| item | value |"

168 echo "| --- | --- |"

169 echo "| release | \`$RELEASE\` |"

170 echo "| namespace | \`$NAMESPACE\` |"

171 echo "| image tag | \`${{ steps.tag.outputs.tag }}\` |"

172 echo "| commit | \`${GITHUB_SHA:0:7}\` |"

173 echo "| dry run | \`${{ inputs.dry_run || 'false' }}\` |"

174 } >> "$GITHUB_STEP_SUMMARY"

1name: docker-build-push

3on:

4 push:

5 branches: [main, master]

6 tags: ["v*"]

7 workflow_dispatch:

9env:

10 IMAGE: harbor.gitdata.me/app/gitdata

12jobs:

13 build:

14 runs-on: ubuntu-latest

15 permissions:

16 contents: read

17 steps:

18 - name: Checkout

19 uses: actions/checkout@v4

21 - name: Setup Docker Buildx

22 uses: docker/setup-buildx-action@v3

24 - name: Login to Harbor

25 uses: docker/login-action@v3

26 with:

27 registry: ${{ secrets.DOCKER_REGISTER || 'harbor.gitdata.me' }}

28 username: ${{ secrets.DOCKER_USERNAME }}

29 password: ${{ secrets.DOCKER_PASSWORD }}

31 - name: Compute tags

32 id: meta

33 run: |

34 short="${GITHUB_SHA:0:7}"

35 tag="${GITHUB_REF#refs/tags/}"

36 {

37 echo "tags<<EOF"

38 if [ "$tag" != "$GITHUB_REF" ]; then

39 echo "$IMAGE:$tag"

40 else

41 echo "$IMAGE:sha-$short"

42 fi

43 echo "$IMAGE:latest"

44 echo "EOF"

45 } >> "$GITHUB_OUTPUT"

47 - name: Build and push

48 uses: docker/build-push-action@v6

49 with:

50 context: .

51 push: true

52 tags: ${{ steps.meta.outputs.tags }}

53 cache-from: type=registry,ref=harbor.gitdata.me/app/gitdata:buildcache

54 cache-to: type=registry,ref=harbor.gitdata.me/app/gitdata:buildcache,mode=max