rede5/gohorsejobs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Update .forgejo/workflows/deploy.yaml

Browse source
This commit is contained in:
bohessefm 2026-02-21 13:31:22 +00:00
parent adfc8386fe
commit 742aa7fe8b
1 changed files with 43 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
.forgejo/workflows/deploy.yaml
View file

@ -58,58 +58,71 @@ jobs:
- name: Sync Secrets and Vars - name: Sync Secrets and Vars
run: | run: |
# 1. Garante o namespace # 1. Namespace
kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f - kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
# 2. Sincroniza Registry Secret # 2. Sync Registry Secret com limpeza profunda de metadata
kubectl get secret forgejo-registry-secret --namespace=forgejo -o yaml | \ kubectl get secret forgejo-registry-secret --namespace=forgejo -o yaml | \
grep -vE "resourceVersion|uid|creationTimestamp|namespace" | \ grep -vE "resourceVersion|uid|creationTimestamp|namespace" | \
kubectl apply --namespace=${{ env.NAMESPACE }} -f - kubectl apply --namespace=${{ env.NAMESPACE }} -f -
# 3. Geração do arquivo de ambiente (Variáveis de texto) # 3. Geração do arquivo .env (SOMENTE VARIÁVEIS CURTAS)
printf "MTU=%s\n" "${{ vars.MTU }}" > .env.backend # O uso de 'EOF' evita que o shell interprete caracteres especiais das vars
printf "DATABASE_URL=%s\n" "${{ vars.DATABASE_URL }}" >> .env.backend cat <<'EOF' > .env.backend
printf "AMQP_URL=%s\n" "${{ vars.AMQP_URL }}" >> .env.backend MTU=${{ vars.MTU }}
printf "JWT_SECRET=%s\n" "${{ vars.JWT_SECRET }}" >> .env.backend DATABASE_URL=${{ vars.DATABASE_URL }}
printf "JWT_EXPIRATION=%s\n" "${{ vars.JWT_EXPIRATION }}" >> .env.backend AMQP_URL=${{ vars.AMQP_URL }}
printf "PASSWORD_PEPPER=%s\n" "${{ vars.PASSWORD_PEPPER }}" >> .env.backend JWT_SECRET=${{ vars.JWT_SECRET }}
printf "COOKIE_SECRET=%s\n" "${{ vars.COOKIE_SECRET }}" >> .env.backend JWT_EXPIRATION=${{ vars.JWT_EXPIRATION }}
printf "COOKIE_DOMAIN=%s\n" "${{ vars.COOKIE_DOMAIN }}" >> .env.backend PASSWORD_PEPPER=${{ vars.PASSWORD_PEPPER }}
printf "BACKEND_PORT=%s\n" "${{ vars.BACKEND_PORT }}" >> .env.backend COOKIE_SECRET=${{ vars.COOKIE_SECRET }}
printf "BACKEND_HOST=%s\n" "${{ vars.BACKEND_HOST }}" >> .env.backend COOKIE_DOMAIN=${{ vars.COOKIE_DOMAIN }}
printf "ENV=%s\n" "${{ vars.ENV }}" >> .env.backend BACKEND_PORT=${{ vars.BACKEND_PORT }}
printf "CORS_ORIGINS=%s\n" "${{ vars.CORS_ORIGINS }}" >> .env.backend BACKEND_HOST=${{ vars.BACKEND_HOST }}
printf "S3_BUCKET=%s\n" "${{ vars.S3_BUCKET }}" >> .env.backend ENV=${{ vars.ENV }}
printf "AWS_REGION=%s\n" "${{ vars.AWS_REGION }}" >> .env.backend CORS_ORIGINS=${{ vars.CORS_ORIGINS }}
printf "AWS_ENDPOINT=%s\n" "${{ vars.AWS_ENDPOINT }}" >> .env.backend S3_BUCKET=${{ vars.S3_BUCKET }}
printf "AWS_ACCESS_KEY_ID=%s\n" "${{ vars.AWS_ACCESS_KEY_ID }}" >> .env.backend AWS_REGION=${{ vars.AWS_REGION }}
printf "AWS_SECRET_ACCESS_KEY=%s\n" "${{ vars.AWS_SECRET_ACCESS_KEY }}" >> .env.backend AWS_ENDPOINT=${{ vars.AWS_ENDPOINT }}
AWS_ACCESS_KEY_ID=${{ vars.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY=${{ vars.AWS_SECRET_ACCESS_KEY }}
EOF
# 4. Cria a secret baseada nas variáveis primeiro # 4. Aplica as variáveis de ambiente
kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \ kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \
--from-env-file=.env.backend \ --from-env-file=.env.backend \
--dry-run=client -o yaml | kubectl apply -f - --dry-run=client -o yaml | kubectl apply -f -
# 5. Adiciona a chave RSA separadamente (se existir) para evitar o erro de combinação # 5. TRATAMENTO DA CHAVE RSA (O culpado do erro UTF-8)
RSA_CONTENT="${{ secrets.RSA_PRIVATE_KEY_BASE64 || vars.RSA_PRIVATE_KEY_BASE64 }}" # Extraímos a var, limpamos quebras de linha e injetamos como ARQUIVO
if [ -n "$RSA_CONTENT" ]; then RSA_RAW="${{ vars.RSA_PRIVATE_KEY_BASE64 }}"
echo "$RSA_CONTENT" | tr -d '\r\n ' > /tmp/rsa_clean_base64.txt if [ -n "$RSA_RAW" ]; then
if base64 -d /tmp/rsa_clean_base64.txt > /tmp/rsa_key.pem 2>/dev/null; then echo "$RSA_RAW" | tr -d '\r\n ' > /tmp/rsa.base64
# Adiciona o arquivo .pem na secret já existente usando set data # Tenta decodificar. Se falhar, usa o b64 puro (o app decide como ler)
kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \ if base64 -d /tmp/rsa.base64 > /tmp/key.pem 2>/dev/null; then
--from-file=private_key.pem=/tmp/rsa_key.pem \ echo "RSA decodificada com sucesso."
--dry-run=client -o yaml | kubectl apply -f - else
cp /tmp/rsa.base64 /tmp/key.pem
echo "RSA mantida em formato string limpa."
fi fi
# Injeta o arquivo na secret existente (o apply faz o merge)
kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \
--from-file=private_key.pem=/tmp/key.pem \
--dry-run=client -o yaml | kubectl apply -f -
fi fi
- name: Deploy to K3s - name: Deploy to K3s
run: | run: |
kubectl apply -f k8s/dev/ -n ${{ env.NAMESPACE }} kubectl apply -f k8s/dev/ -n ${{ env.NAMESPACE }}
# Garante que os deployments usem a imagem com o SHA atual
kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }}
kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }} kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }}
# Força o restart para ler a Secret atualizada
kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backend-dev kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backend-dev
kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backoffice-dev kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backoffice-dev
# Aguarda estabilização
kubectl -n ${{ env.NAMESPACE }} rollout status deployment/gohorse-backend-dev --timeout=120s kubectl -n ${{ env.NAMESPACE }} rollout status deployment/gohorse-backend-dev --timeout=120s