Bastian de BylandClaude Opus 5
d0e76bd6cf
The runner's job images were built by ansible into localhost/ only, so the nightly CI prune deleted them and every idle stretch ended with CI failing in under a second on `docker pull localhost/gitea-ci:latest` until someone re-ran the role and waited out a rebuild. The previous commit moved them to the Gitea registry; this moves the *build* off the deploy path entirely. - .gitea/workflows/ci-images.yml builds files/Containerfile.* and pushes to git.debyl.io/gitbot/. Per-image change detection, so an ESP-IDF pin bump does not rebuild the other two; weekly schedule for base-image updates; a workflow_dispatch selector. PRs build under a throwaway :pr-<n> tag and drop it -- the build lands in the live runner's store, and act_runner will not re-pull a tag it already has, so a PR using the real tag would hand every later job on this host an unmerged image. - The Containerfiles stop being ansible templates: their version vars are now --build-arg, read by the workflow out of the same defaults/main.yml the role interpolates, so CI and ansible build the same bytes from one set of pins. - LABEL io.debyl.ci-base moves into each Containerfile so neither builder can forget the prune exemption; the workflow re-checks it before pushing. - roles/gitea-actions pulls instead of building. gitea_ci_build_local=true restores the local build+push for seeding a cold registry or when CI is down -- the workflow that builds gitea-ci runs in gitea-ci. - Lint .gitea/ alongside ansible/, and document the flow in the role README. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
94 lines
4.4 KiB
YAML
94 lines
4.4 KiB
YAML
---
|
|
gitea_runner_user: gitea-runner
|
|
gitea_runner_home: /home/gitea-runner
|
|
gitea_runner_version: "0.2.13"
|
|
gitea_runner_arch: linux-amd64
|
|
|
|
# Max concurrent jobs per runner. Each job runs in its own ephemeral container
|
|
# (docker:// labels backed by rootless podman), so jobs no longer share the
|
|
# gitea-runner user's Go caches and can run fully in parallel without corruption.
|
|
gitea_runner_capacity: 4
|
|
|
|
# Gitea instances to run actions runners for. Override `labels` or `capacity`
|
|
# per runner here if needed.
|
|
gitea_runners:
|
|
- name: debyl
|
|
instance_url: https://git.debyl.io
|
|
- name: skudak
|
|
instance_url: https://git.skudak.com
|
|
|
|
# Paths
|
|
act_runner_bin: /usr/local/bin/act_runner
|
|
act_runner_config_dir: /etc/act_runner
|
|
act_runner_work_dir: /var/lib/act_runner
|
|
|
|
# Job container images, served from the Gitea container registry.
|
|
#
|
|
# They used to live only under localhost/, built by this role. The nightly
|
|
# podman prune (roles/podman: podman_prune_ci_until) deletes any CI-user image
|
|
# older than 48h that no container is using, so every idle weekend CI failed in
|
|
# 0-1s on `docker pull localhost/gitea-ci:latest` until someone re-ran the role
|
|
# and waited out a full rebuild.
|
|
#
|
|
# Now .gitea/workflows/ci-images.yml builds them from files/Containerfile.* and
|
|
# pushes them here, and this role only pulls. A pruned image is re-pulled by the
|
|
# next job on its own (force_pull stays false, which means "pull only when
|
|
# missing", so a present image is never re-fetched).
|
|
#
|
|
# Workflows that pin `container: image:` must use these registry paths too
|
|
# (esp-mg-tpms, skudak/esp32-stm32-vcu, skudak/esp32-web-interface).
|
|
gitea_ci_registry: git.debyl.io
|
|
# Namespace = the owner of gitea_registry_username / gitea_registry_token (vault).
|
|
gitea_ci_registry_namespace: gitbot
|
|
gitea_ci_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci:latest"
|
|
# ESP-IDF firmware image tag tracks the upstream espressif/idf release we build from.
|
|
esp_idf_version: v5.4.1
|
|
gitea_ci_espidf_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci-espidf:{{ esp_idf_version }}"
|
|
# PlatformIO image for Arduino-framework ESP32 builds (esp32-web-interface).
|
|
# Tag tracks the pre-baked espressif32 platform version; both pins match the
|
|
# hardware-validated local build.
|
|
platformio_core_version: "6.1.19"
|
|
pio_espressif32_version: "7.0.1"
|
|
gitea_ci_platformio_image: "{{ gitea_ci_registry }}/{{ gitea_ci_registry_namespace }}/gitea-ci-platformio:{{ pio_espressif32_version }}"
|
|
|
|
# Registry credentials for the gitea-runner user. The Docker-format path is read
|
|
# by both act_runner (to authenticate job image pulls) and podman (as its
|
|
# fallback auth file), so one login covers the runner and this role.
|
|
gitea_ci_registry_authfile: "{{ gitea_runner_home }}/.docker/config.json"
|
|
|
|
# The images this role keeps present on the runner. `build_args` is a literal
|
|
# podman-build argument string (podman_image has no structured build-arg
|
|
# option) and is only used by the gitea_ci_build_local fallback below -- the
|
|
# workflow passes the same --build-arg values, read out of the version vars
|
|
# above, so there is one source of truth for the pins.
|
|
gitea_ci_images:
|
|
- image: "{{ gitea_ci_image }}"
|
|
containerfile: Containerfile.ci
|
|
build_args: ""
|
|
- image: "{{ gitea_ci_espidf_image }}"
|
|
containerfile: Containerfile.espidf
|
|
build_args: "--build-arg ESP_IDF_VERSION={{ esp_idf_version }}"
|
|
- image: "{{ gitea_ci_platformio_image }}"
|
|
containerfile: Containerfile.platformio
|
|
build_args: >-
|
|
--build-arg PLATFORMIO_CORE_VERSION={{ platformio_core_version }}
|
|
--build-arg PIO_ESPRESSIF32_VERSION={{ pio_espressif32_version }}
|
|
|
|
# Escape hatch: build the images on the host and push them, instead of pulling
|
|
# what CI published. Needed to seed a brand-new registry namespace, and when CI
|
|
# itself is down -- the workflow that builds gitea-ci runs *in* gitea-ci, so a
|
|
# registry that has never held it cannot bootstrap itself.
|
|
#
|
|
# make deploy TAGS=gitea-actions EXTRA_VARS="gitea_ci_build_local=true"
|
|
#
|
|
# Off by default: a plain deploy should never sit through a 15-minute ESP-IDF
|
|
# rebuild, and two publishers racing on the same tag is worth avoiding.
|
|
gitea_ci_build_local: false
|
|
|
|
# Default labels for every runner — map runs-on values to the registry CI image.
|
|
# Firmware jobs opt into the ESP-IDF image per-job via `container:` in their workflow.
|
|
gitea_runner_labels:
|
|
- "fedora:docker://{{ gitea_ci_image }}"
|
|
- "ubuntu-latest:docker://{{ gitea_ci_image }}"
|
|
- "ubuntu-22.04:docker://{{ gitea_ci_image }}"
|