Episode 2: Forgejo Actions — runner, Docker sandbox, own registry, locked-down deploy

examples/ci.yml

@@ -0,0 +1,52 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+
+# Two pushes in a row must not deploy over each other.
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: git.example.com/youruser/hello-ops
+
+jobs:
+  test:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+
+  build:
+    needs: test
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      # The job image has node (it must -- actions are JavaScript) but no docker
+      # client. One static binary, no package manager, no daemon.
+      - name: Get a docker client
+        run: |
+          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-29.7.2.tgz \
+            | tar xz -C /usr/local/bin --strip-components=1 docker/docker
+          docker version --format "{{.Client.Version}}"
+      - name: Log in to our own registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.example.com -u youruser --password-stdin
+      - name: Build and push
+        run: |
+          TAG=${GITHUB_SHA::7}
+          docker build --build-arg APP_VERSION=$TAG -t $IMAGE:$TAG -t $IMAGE:latest .
+          docker push $IMAGE:$TAG
+          docker push $IMAGE:latest
+
+  deploy:
+    needs: build
+    runs-on: docker
+    steps:
+      - name: Deploy over a key that can only do one thing
+        run: |
+          install -m 700 -d ~/.ssh
+          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh -o StrictHostKeyChecking=no deploy@${{ secrets.DEPLOY_HOST }} ${GITHUB_SHA::7}

examples/deploy-hello-ops.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# The only thing the CI key is allowed to do. Argument comes from the CI job.
+set -eu
+TAG=$(printf "%s" "${SSH_ORIGINAL_COMMAND:-latest}" | tr -cd "a-f0-9")
+[ -n "$TAG" ] || TAG=latest
+IMAGE=git.example.com/youruser/hello-ops:$TAG
+docker pull "$IMAGE"
+docker rm -f hello-ops 2>/dev/null || true
+docker run -d --name hello-ops --restart unless-stopped \
+  --network selfhostedops-stack_proxy -e APP_VERSION="$TAG" "$IMAGE"
+echo "deployed $TAG"