refactor: reorganize GitOps control plane

2026-07-25 23:55:31 +09:00
parent d507ac6ee9
commit 293ee6fc97
191 changed files with 7046 additions and 9034 deletions
@@ -0,0 +1,114 @@
+name: Promote Dev Image by Pull Request
+
+on:
+  workflow_dispatch:
+    inputs:
+      service:
+        description: Workload to promote
+        required: true
+        type: choice
+        options:
+          - auth-server
+          - api-server
+      image_digest:
+        description: Immutable OCI digest including the sha256 prefix
+        required: true
+        type: string
+
+concurrency:
+  group: promote-dev-${{ inputs.service }}
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    runs-on:
+      - self-hosted
+      - linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITOPS_BOT_TOKEN }}
+
+      - name: Update immutable digest
+        env:
+          SERVICE: ${{ inputs.service }}
+          IMAGE_DIGEST: ${{ inputs.image_digest }}
+        run: |
+          case "$SERVICE" in
+            auth-server)
+              image_name="ghcr.io/donghyeonka/project-auth-server"
+              ;;
+            api-server)
+              image_name="ghcr.io/donghyeonka/project-api-server"
+              ;;
+            *)
+              echo "Unsupported service: $SERVICE" >&2
+              exit 1
+              ;;
+          esac
+          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
+            echo "image_digest must be an immutable sha256 digest" >&2
+            exit 1
+          fi
+          manifest="clusters/dev-k3s/manifests/${SERVICE}/kustomization.yaml"
+          temporary="$(mktemp "${manifest}.XXXXXX")"
+          awk -v image_name="$image_name" -v image_digest="$IMAGE_DIGEST" '
+            $1 == "-" && $2 == "name:" { target = ($3 == image_name) }
+            target && $1 == "newTag:" {
+              match($0, /^[[:space:]]*/)
+              print substr($0, RSTART, RLENGTH) "digest: " image_digest
+              target = 0
+              updated = 1
+              next
+            }
+            target && $1 == "digest:" {
+              match($0, /^[[:space:]]*/)
+              print substr($0, RSTART, RLENGTH) "digest: " image_digest
+              target = 0
+              updated = 1
+              next
+            }
+            { print }
+            END { if (!updated) exit 42 }
+          ' "$manifest" >"$temporary"
+          mv "$temporary" "$manifest"
+          kubectl kustomize "$(dirname "$manifest")" >/dev/null
+
+      - name: Create promotion branch
+        env:
+          SERVICE: ${{ inputs.service }}
+          RUN_NUMBER: ${{ gitea.run_number }}
+        run: |
+          branch="gitops/promote-${SERVICE}-${RUN_NUMBER}"
+          git config user.name "gitops-bot"
+          git config user.email "gitops-bot@hyeonworks.local"
+          git switch -c "$branch"
+          git add "clusters/dev-k3s/manifests/${SERVICE}/kustomization.yaml"
+          git commit -m "chore(gitops): promote ${SERVICE} dev digest"
+          git push --set-upstream origin "$branch"
+          echo "PROMOTION_BRANCH=$branch" >>"$GITHUB_ENV"
+
+      - name: Open Gitea pull request
+        env:
+          GITEA_TOKEN: ${{ secrets.GITOPS_BOT_TOKEN }}
+          GITEA_API_URL: ${{ gitea.api_url }}
+          REPOSITORY: ${{ gitea.repository }}
+          DEFAULT_BRANCH: ${{ gitea.event.repository.default_branch }}
+          SERVICE: ${{ inputs.service }}
+          IMAGE_DIGEST: ${{ inputs.image_digest }}
+        run: |
+          payload="$(
+            jq -n \
+              --arg base "$DEFAULT_BRANCH" \
+              --arg head "$PROMOTION_BRANCH" \
+              --arg title "chore(gitops): promote ${SERVICE} dev digest" \
+              --arg body "Promotes ${SERVICE} to immutable digest ${IMAGE_DIGEST}." \
+              '{base: $base, head: $head, title: $title, body: $body}'
+          )"
+          curl -fsS \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$payload" \
+            "${GITEA_API_URL}/repos/${REPOSITORY}/pulls"
@@ -0,0 +1,23 @@
+name: Validate GitOps Repository
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: validate-gitops-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on:
+      - self-hosted
+      - linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Validate
+        run: ./hack/validate.sh