diff --git a/.gitea/workflows/config-provider.yml b/.gitea/workflows/config-provider.yml index 3a25bd7..d53ac18 100644 --- a/.gitea/workflows/config-provider.yml +++ b/.gitea/workflows/config-provider.yml @@ -8,7 +8,7 @@ on: secrets: GITEA_TOKEN: required: true - GIT_PAGES_PUBLISH_TOKEN: + REPORTS_PUBLISH_TOKEN: required: true outputs: env_json: @@ -19,7 +19,7 @@ on: env: CI_CONF_FILE: ${{ inputs.config_path }} GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} - GIT_PAGES_PUBLISH_TOKEN: ${{ secrets.GIT_PAGES_PUBLISH_TOKEN }} + REPORTS_PUBLISH_TOKEN: ${{ secrets.REPORTS_PUBLISH_TOKEN }} jobs: parse-config: diff --git a/.gitea/workflows/example-bats-tests.yml b/.gitea/workflows/example-bats-tests.yml index 6a7a507..71a492b 100644 --- a/.gitea/workflows/example-bats-tests.yml +++ b/.gitea/workflows/example-bats-tests.yml @@ -12,14 +12,14 @@ on: secrets: GITEA_TOKEN: required: true - GIT_PAGES_PUBLISH_TOKEN: + REPORTS_PUBLISH_TOKEN: required: true env: GITEA_API_URL: ${{ fromJson(inputs.env_json).GITEA_API_URL }} GIT_PAGES_URL: ${{ fromJson(inputs.env_json).GIT_PAGES_URL }} GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} - GIT_PAGES_PUBLISH_TOKEN: ${{ secrets.GIT_PAGES_PUBLISH_TOKEN }} + REPORTS_PUBLISH_TOKEN: ${{ secrets.REPORTS_PUBLISH_TOKEN }} jobs: bats: diff --git a/.gitea/workflows/example-cucumber-tests.yml b/.gitea/workflows/example-cucumber-tests.yml index a9ab2d6..7efa7e4 100644 --- a/.gitea/workflows/example-cucumber-tests.yml +++ b/.gitea/workflows/example-cucumber-tests.yml @@ -12,14 +12,14 @@ on: secrets: GITEA_TOKEN: required: true - GIT_PAGES_PUBLISH_TOKEN: + REPORTS_PUBLISH_TOKEN: required: true env: GITEA_API_URL: ${{ fromJson(inputs.env_json).GITEA_API_URL }} GIT_PAGES_URL: ${{ fromJson(inputs.env_json).GIT_PAGES_URL }} GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} - GIT_PAGES_PUBLISH_TOKEN: ${{ secrets.GIT_PAGES_PUBLISH_TOKEN }} + REPORTS_PUBLISH_TOKEN: ${{ secrets.REPORTS_PUBLISH_TOKEN }} jobs: cucumber: diff --git a/README.md b/README.md index 2953bf1..a65a7aa 100644 --- a/README.md +++ b/README.md @@ -264,7 +264,7 @@ Consumer-repossa on oltava seuraavat asetukset: | Secret | Kuvaus | |--------|--------| -| `GIT_PAGES_PUBLISH_TOKEN` | Git-pages-palvelimen BasicAuth-token. Nimi on lukittu — tämä tarkka nimi vaaditaan. | +| `REPORTS_PUBLISH_TOKEN` | Git-pages-palvelimen BasicAuth-token. Nimi on lukittu — tämä tarkka nimi vaaditaan. | `GITEA_TOKEN` on Gitean automaattisesti jokaiselle workflow-runille generoima token (`secrets.GITEA_TOKEN`). Se on scopeutettu **siihen repoon**, jossa workflow ajaa — ei toimi toiseen repoon dispatchaukseen eikä toisen repon commit-statusin asettamiseen. Ei tarvitse erikseen luoda. @@ -300,7 +300,7 @@ GIT_PAGES_URL=https://ci-reports.example.com Jokaisen jobin alussa `ci-validate.sh` tarkistaa: - `.gitea/workflows/gitea-env.conf` on olemassa ja sen arvot ovat validit -- `GITEA_TOKEN` ja `GIT_PAGES_PUBLISH_TOKEN` on asetettu +- `GITEA_TOKEN` ja `REPORTS_PUBLISH_TOKEN` on asetettu Jos validointi epäonnistuu, job keskeytyy exit-koodilla 1 ja Gitean commit-status näyttää epäonnistumisen linkkinä lokiin. diff --git a/docs/adr/0005-provider-consumer.md b/docs/adr/0005-provider-consumer.md index 5475a70..12ab0f7 100644 --- a/docs/adr/0005-provider-consumer.md +++ b/docs/adr/0005-provider-consumer.md @@ -26,7 +26,7 @@ Consumer: - Omistaa pipeline-logiikan (mitä testejä ajetaan, missä järjestyksessä) - Luo raportit omiin polkuihinsa (`reports/{sha8}/{step}/`) - Luo `.meta`-tiedostot per step -- Määrittelee Gitea-secretit (`GIT_PAGES_PUBLISH_TOKEN`, `GITEA_TOKEN`) +- Määrittelee Gitea-secretit (`REPORTS_PUBLISH_TOKEN`, `GITEA_TOKEN`) ### Provider → Consumer (mitä provider tarjoaa) diff --git a/docs/ci-pipeline-practices.md b/docs/ci-pipeline-practices.md index cb2aa26..ecbfe83 100644 --- a/docs/ci-pipeline-practices.md +++ b/docs/ci-pipeline-practices.md @@ -96,7 +96,7 @@ Avainkomponentit: - **workflow `env:`** — ainoa tapa jakaa arvot kaikkiin jobeihin. `fromJson(inputs.env_json).KEY` purkaa yksittäiset arvot ilman toistoa. - **Per-job `env:`** — sisältää vain secretit (`GITEA_TOKEN`, - `GIT_PAGES_PUBLISH_TOKEN`), ei config-arvoja. + `REPORTS_PUBLISH_TOKEN`), ei config-arvoja. ## 5. Pipeline Provides All Dependencies diff --git a/docs/config-model.md b/docs/config-model.md index 75dcaba..b70bac1 100644 --- a/docs/config-model.md +++ b/docs/config-model.md @@ -69,7 +69,7 @@ org-tason token. | Secret | Pakollinen | Käyttäjä | |---|---|---| | `GITEA_TOKEN` | Kyllä | `report-status.sh`, `check-version.yml`, `docker-build-push.yml`, `gitops-update.sh` (GitOps-repossa) | -| `GIT_PAGES_PUBLISH_TOKEN` | Kyllä | `publish-git-pages.sh`, `config-provider.yml` (validointi) | +| `REPORTS_PUBLISH_TOKEN` | Kyllä | `publish-git-pages.sh`, `config-provider.yml` (validointi) | | `DOCKER_USERNAME` | Ei | `docker-build-push.yml` (oletus: `github.actor`, ei pakollinen kaikissa registryissä) | | `DOCKER_PASSWORD` | Kyllä | `docker-build-push.yml` | @@ -88,7 +88,7 @@ JSON-muotoisen `env_json`:n. - `.conf`-tiedosto on olemassa - Jokaisella `KEY=VALUE`-rivillä on arvo (ei tyhjää) - URL-tyyppiset avaimet alkavat `http://` tai `https://` -- Pakolliset secretit (`GITEA_TOKEN`, `GIT_PAGES_PUBLISH_TOKEN`) on asetettu +- Pakolliset secretit (`GITEA_TOKEN`, `REPORTS_PUBLISH_TOKEN`) on asetettu Kutsu: ```yaml diff --git a/docs/git-pages-nginx-arkkitehtuuri.md b/docs/git-pages-nginx-arkkitehtuuri.md index 27e0ebb..d2a21cd 100644 --- a/docs/git-pages-nginx-arkkitehtuuri.md +++ b/docs/git-pages-nginx-arkkitehtuuri.md @@ -268,7 +268,7 @@ set -eu SUITE_PATH="${1:-}" [ -n "$SUITE_PATH" ] || { echo "ERROR: suite_path required" >&2; exit 1; } [ -n "${GIT_PAGES_URL:-}" ] || { echo "ERROR: GIT_PAGES_URL is not set" >&2; exit 1; } -[ -n "${GIT_PAGES_PUBLISH_TOKEN:-}" ] || { echo "ERROR: GIT_PAGES_PUBLISH_TOKEN is not set" >&2; exit 1; } +[ -n "${REPORTS_PUBLISH_TOKEN:-}" ] || { echo "ERROR: REPORTS_PUBLISH_TOKEN is not set" >&2; exit 1; } [ -n "${GITHUB_REPOSITORY:-}" ] || { echo "ERROR: GITHUB_REPOSITORY is not set" >&2; exit 1; } [ -n "${GITHUB_SHA:-}" ] || { echo "ERROR: GITHUB_SHA is not set" >&2; exit 1; } [ -n "${GITHUB_REF_NAME:-}" ] || { echo "ERROR: GITHUB_REF_NAME is not set" >&2; exit 1; } @@ -312,7 +312,7 @@ tar czf "$TAR" -C "$WORK/$SUITE" . # PUT upload-sidecariin PUBLISH_URL="${GIT_PAGES_URL}/${OWNER}/${REPO}/${BRANCH}/${SHA8}/${SUITE}/" HTTP_CODE=$(curl -sS -X PUT "$PUBLISH_URL" \ - -u "${PAGES_USER}:${GIT_PAGES_PUBLISH_TOKEN}" \ + -u "${PAGES_USER}:${REPORTS_PUBLISH_TOKEN}" \ -H "Content-Type: application/tar+gz" \ --data-binary @"$TAR" \ -o /tmp/git-pages-publish-response.txt \ diff --git a/docs/shared-scripts.md b/docs/shared-scripts.md index 3940913..8c593f4 100644 --- a/docs/shared-scripts.md +++ b/docs/shared-scripts.md @@ -79,7 +79,7 @@ publish-git-pages.sh |---|---| | `GITEA_API_URL` | `env_json` → workflow `env:` | | `GIT_PAGES_URL` | `env_json` → workflow `env:` | -| `GIT_PAGES_PUBLISH_TOKEN` | Gitea secret → `env:` | +| `REPORTS_PUBLISH_TOKEN` | Gitea secret → `env:` | | `GITHUB_REPOSITORY` | Automaattinen | | `GITHUB_SHA` | Automaattinen | @@ -104,7 +104,7 @@ Lukee tiedoston polun `CI_CONF_FILE`-env-muuttujasta (oletus: `.gitea/workflows/ - Jokaisella `KEY=VALUE`-rivillä on arvo (ei tyhjää) - URL-tyyppiset avaimet alkavat `http://` tai `https://` - `GITEA_TOKEN` on asetettu -- `GIT_PAGES_PUBLISH_TOKEN` on asetettu +- `REPORTS_PUBLISH_TOKEN` on asetettu --- @@ -155,7 +155,7 @@ dispatch-workflow.sh 💡 **Monelle repoille:** Toista vaiheet 3–4, tai katso [automatisointi](docs/secrets.md#automatisointi-useamman-repon-salaisuuden-lis%C3%A4%C3%A4miseen). @@ -132,7 +132,7 @@ Julkaisu DNS-osoitteeseen BasicAuthilla: ```bash # Esimerkki: julkaise raportti curl -X PUT \ - -u publish:$GIT_PAGES_PUBLISH_TOKEN \ + -u publish:$REPORTS_PUBLISH_TOKEN \ -H "Content-Type: application/tar+gz" \ --data-binary @report.tar.gz \ https://ci-reports.helm-dev.keskikuja.site/{owner}/{repo}/{branch}/{sha8}/{suite}/ @@ -142,7 +142,7 @@ curl -X PUT \ | Missä | Arvo | |-------|------| -| Gitea Actions secret | `GIT_PAGES_PUBLISH_TOKEN` (sama kuin K8s `gitea-reports-publish-token` `token`-avain) | +| Gitea Actions secret | `REPORTS_PUBLISH_TOKEN` (sama kuin K8s `gitea-reports-publish-token` `token`-avain) | | Scriptissä | `bash scripts/publish-gitea-reports.sh ` | **K8s secretit (Traefik-yhteensopivuus):** diff --git a/gitea-reports/docs/architecture.md b/gitea-reports/docs/architecture.md index 0db7db9..ae0d9ab 100644 --- a/gitea-reports/docs/architecture.md +++ b/gitea-reports/docs/architecture.md @@ -1,6 +1,6 @@ # Architecture — Nginx + upload-sidecar -> git-pages on korvattu. Uusi arkkitehtuuri: Nginx palvelee staattisia tiedostoja PV:ltä, upload-sidecar (busybox httpd + CGI) ottaa vastaan tar.gz-PUTit. +> gitea-reports on korvattu. Uusi arkkitehtuuri: Nginx palvelee staattisia tiedostoja PV:ltä, upload-sidecar (busybox httpd + CGI) ottaa vastaan tar.gz-PUTit. ## Yleiskuvaus @@ -16,7 +16,7 @@ Ei Host-header-kikkaa, ei slugia, ei rewritea. | **PVC** | Raporttisisältö suoraan FS-muodossa | | **Service** | ClusterIP :8080 (read), :8081 (write) | | **Traefik IngressRoute** | PATCH/PUT → upload:8081 (BasicAuth), GET/HEAD → nginx:8080 | -| **Traefik Middleware** | `git-pages-publish-auth` (BasicAuth), HTTPS-redirect | +| **Traefik Middleware** | `gitea-reports-publish-auth` (BasicAuth), HTTPS-redirect | | **cert-manager Certificate** | TLS | ## URL ja sisältö diff --git a/gitea-reports/docs/design-rationale.md b/gitea-reports/docs/design-rationale.md index 669458a..5e7c483 100644 --- a/gitea-reports/docs/design-rationale.md +++ b/gitea-reports/docs/design-rationale.md @@ -1,8 +1,8 @@ -# Design Rationale — git-pages +# Design Rationale — gitea-reports -> Miksi git-pages on rakennettu näin. Arvot, periaatteet ja reunaehdot. +> Miksi gitea-reports on rakennettu näin. Arvot, periaatteet ja reunaehdot. > -> Tämä dokumentti on **normatiivinen** `git-pages/`-alikansiolle. Se ei kuvaa juuren +> Tämä dokumentti on **normatiivinen** `gitea-reports/`-alikansiolle. Se ei kuvaa juuren > `gitea-ci-library`-kirjastoa eikä sen workfloweja. > > Liittyvät dokumentit: [architecture.md](architecture.md), [tech-stack.md](tech-stack.md), [secrets.md](secrets.md). @@ -18,7 +18,7 @@ elävänä dokumentaationa git commitin tilasta. Gitea ei tarjoa web-selaimella selattavaa arkistoa näille HTML-raporteille. -git-pages ratkaisee tämän ongelman. +gitea-reports ratkaisee tämän ongelman. | Vaihtoehto | Miksi ei riitä | |---|---| @@ -73,7 +73,7 @@ Julkaisija (CI tai muu asiakas) lähettää tar-arkiston PATCH/PUT:lla. Lukija h HTML:n GET:llä. Ei Gitea-git-integraatiota eikä `pages`-branchia. **Codebergin security-malli ei sovellu tähän käyttöön** — forge-auth (Gitea PAT + -`write:repository`), DNS TXT -haaste ja muut git-pagesin sisäänrakennetut valtuutus- +`write:repository`), DNS TXT -haaste ja muut gitea-reportsin sisäänrakennetut valtuutus- mekanismit on ohitettu kokonaan (`PAGES_INSECURE=1`). Niiden sijaan Kubernetes-kerros hoitaa rajauksen: Traefik BasicAuth julkaisuun, cert-manager TLS:ään, erillinen publish-token ([secrets.md](secrets.md)). Sovellus palvelee sisältöä; klusteri päättää @@ -94,13 +94,13 @@ Yksi TLS-sertifikaatti, yksi IngressRoute, yksi PVC. ### 2. Sovelluksen sisäinen security kytketty pois, Traefik hoitaa rajauksen -`git-pages`-sovelluksen koko sisäinen security-mekanismi on kytketty pois päältä (`PAGES_INSECURE=1`). Kirjoitusoikeuden validointi tapahtuu yksinomaan Kubernetes-reunalla Traefik BasicAuth -middlewaren avulla. Sovellus palvelee sisältöä sokeana; klusteri päättää, kuka saa kirjoittaa. +`gitea-reports`-sovelluksen koko sisäinen security-mekanismi on kytketty pois päältä (`PAGES_INSECURE=1`). Kirjoitusoikeuden validointi tapahtuu yksinomaan Kubernetes-reunalla Traefik BasicAuth -middlewaren avulla. Sovellus palvelee sisältöä sokeana; klusteri päättää, kuka saa kirjoittaa. ### 3. Julkaisu ja luku erotettu Julkaisu (PATCH/PUT) vaatii Traefik BasicAuthin. Luku (GET/HEAD) on erillinen reitti — katso [Luku-auth](#luku-auth) alla. -**Miksi:** Koska sovellus ei validoi julkaisuoikeuksia, kirjoitusoikeus on eksplisiittisesti eriytetty Traefik Middlewaressä (`git-pages-publish-auth`). +**Miksi:** Koska sovellus ei validoi julkaisuoikeuksia, kirjoitusoikeus on eksplisiittisesti eriytetty Traefik Middlewaressä (`gitea-reports-publish-auth`). ### 4. Yksi publish-token, kaksi säilöä @@ -112,7 +112,7 @@ julkaisuoikeuden tähän palveluun. Yksi arvo, kaksi paikkaa — ks. [secrets.md ### 5. Secretit erillisessä hallinnassa -`git-pages-publish-auth` luodaan ennen käyttöönottoa — ei osana sovelluksen konfiguraatiotiedostoja. +`gitea-reports-publish-auth` luodaan ennen käyttöönottoa — ei osana sovelluksen konfiguraatiotiedostoja. **Miksi:** Salaisuudet eivät kulje versionoiduissa arvoissa. Rotaatio ja SealedSecrets pysyvät operaattorin hallussa. Ks. [secrets.md](secrets.md). @@ -159,7 +159,7 @@ branchille säännöt tulevat `retention.rules` (`branches.default` + Ei PVC-skaalausta — sidecar lukee manifestin HTTP:lla ja poistaa whiteout PATCHilla. Ei K8s API -oikeuksia. -Secret: `git-pages-retention-gitea` — Gitea PAT branch-tarkistukseen. +Secret: `gitea-reports-retention-gitea` — Gitea PAT branch-tarkistukseen. Ks. [secrets.md](secrets.md). --- @@ -176,10 +176,10 @@ Ks. [secrets.md](secrets.md). | Valinta | Miksi | |---------|-------| -| **Codeberg git-pages** `0.9.1` | Natiivi apex index-site + tar-pohjainen PATCH/PUT -julkaisu | +| **Codeberg gitea-reports** `0.9.1` | Natiivi apex index-site + tar-pohjainen PATCH/PUT -julkaisu | | **Filesystem + PVC** | Yksinkertainen, yksi replica, ei erillistä objektivarastoa | | **Traefik IngressRoute + Middleware** | Julkaisuauth erillään sovelluksesta; GET/HEAD eri säännöllä | -| **cert-manager** | TLS automaattisesti (`git-pages-tls`) | +| **cert-manager** | TLS automaattisesti (`gitea-reports-tls`) | | **Helm v3** | Toistettava asennus; instanssikohtaiset arvot erillisessä values-tiedostossa | --- diff --git a/gitea-reports/docs/secrets.md b/gitea-reports/docs/secrets.md index c0e9e33..85eb5d3 100644 --- a/gitea-reports/docs/secrets.md +++ b/gitea-reports/docs/secrets.md @@ -1,4 +1,4 @@ -# Secrets — git-pages +# Secrets — gitea-reports ## Quick Start @@ -8,9 +8,9 @@ Järjestelmässä on kaksi loogista salaista arvoa. Publish-token jaetaan kahtee | Looginen nimi | K8s | Gitea | |---|---|---| -| `report_publish_api_token` (htpasswd) | `git-pages-publish-auth` (users) | - | -| `report_publish_api_token` (plaintext) | `git-pages-publish-token` (token) | Actions Secret: `GIT_PAGES_PUBLISH_TOKEN` | -| `reports_retention_read_token` | `git-pages-retention-gitea` (token) | PAT: `CI-REPORTS_READ_FOR_RETENTION` | +| `report_publish_api_token` (htpasswd) | `gitea-reports-publish-auth` (users) | - | +| `report_publish_api_token` (plaintext) | `gitea-reports-publish-token` (token) | Actions Secret: `REPORTS_PUBLISH_TOKEN` | +| `reports_retention_read_token` | `gitea-reports-retention-gitea` (token) | PAT: `CI-REPORTS_READ_FOR_RETENTION` | **Huomio:** Publish-token jaetaan kahteen secretiin, koska Traefik BasicAuth middleware vaatii single-key secretin sekä on muodossa, missä sitä ei saa takaisin. Jokainen repo mikä raportteja käyttää, tarvitsee selväkielisen arvon, joka on "ylimääräisessä" secretissä. @@ -32,9 +32,9 @@ Järjestelmässä on kaksi loogista salaista arvoa. Publish-token jaetaan kahtee ```bash GITEA_RETENTION_TOKEN="" -GIT_PAGES_PUBLISH_TOKEN="$(openssl rand -base64 24)" +REPORTS_PUBLISH_TOKEN="$(openssl rand -base64 24)" echo "Publish-token generoitu. Tallennetaan K8s-secretiin Vaiheessa 4." -echo "$GIT_PAGES_PUBLISH_TOKEN" +echo "$REPORTS_PUBLISH_TOKEN" ``` ### Vaihe 4: Luo K8s secrets @@ -43,17 +43,17 @@ echo "$GIT_PAGES_PUBLISH_TOKEN" NS=gitea-reports # 1. Publish-auth: htpasswd (Traefik BasicAuth - vaatii single-key secretin) -kubectl create secret generic git-pages-publish-auth \ - --from-literal=users="$(docker run --rm httpd:2-alpine htpasswd -nb publish "$GIT_PAGES_PUBLISH_TOKEN")" \ +kubectl create secret generic gitea-reports-publish-auth \ + --from-literal=users="$(docker run --rm httpd:2-alpine htpasswd -nb publish "$REPORTS_PUBLISH_TOKEN")" \ -n "$NS" # 2. Publish-token: plaintext (luetaan README:stä Giteaan viedessä) -kubectl create secret generic git-pages-publish-token \ - --from-literal=token="$GIT_PAGES_PUBLISH_TOKEN" \ +kubectl create secret generic gitea-reports-publish-token \ + --from-literal=token="$REPORTS_PUBLISH_TOKEN" \ -n "$NS" # 3. Retention (käyttää Vaiheessa 2 luotua PAT:ia) -kubectl create secret generic git-pages-retention-gitea \ +kubectl create secret generic gitea-reports-retention-gitea \ --from-literal=token="$GITEA_RETENTION_TOKEN" \ -n "$NS" @@ -68,20 +68,20 @@ Token näkyy terminaalissa Vaiheen 3 `echo`sta. Jos se on jo kadonnut näkyvist ```bash NS=gitea-reports -kubectl get secret git-pages-publish-token -n "$NS" -o jsonpath='{.data.token}' | base64 -d; echo +kubectl get secret gitea-reports-publish-token -n "$NS" -o jsonpath='{.data.token}' | base64 -d; echo ``` Vie kopioitu secret Gitea Actions Secrets: Kannattaa viedä tämä token ORG tason secretiksi Gitea Actions. Muuten joudut tekemään tämän jokaiselle rapositorylle erikseen. -Luo `GIT_PAGES_PUBLISH_TOKEN` secret, ja terminaalista kopioitu arvo `values` kenttään. +Luo `REPORTS_PUBLISH_TOKEN` secret, ja terminaalista kopioitu arvo `values` kenttään. Description voi olla esim: -> Julkaisuun liittyvä salaisuus, jonka ci-reports auth tarkistaa, että saako julkaista raporttia. +> Julkaisuun liittyvä salaisuus, jonka gitea-pages auth tarkistaa, että saako julkaista raporttia. -**Gitea UI:ssa:** New Secret → Name: `GIT_PAGES_PUBLISH_TOKEN` → Value: **liitä token** → Save +**Gitea UI:ssa:** New Secret → Name: `REPORTS_PUBLISH_TOKEN` → Value: **liitä token** → Save Toista jokaiselle repolle, joka julkaisee raportteja. @@ -99,23 +99,23 @@ Palaa takaisin [README.md](../README.md#käyttöönotto) ja jatka kohdasta "Inst | Looginen nimi | K8s | Gitea | |---|---|---| -| `report_publish_api_token` | `git-pages-publish-auth` (htpasswd) | Actions Secret: `GIT_PAGES_PUBLISH_TOKEN` | -| `reports_retention_read_token` | `git-pages-retention-gitea` (token) | PAT: `CI-REPORTS_READ_FOR_RETENTION` | +| `report_publish_api_token` | `gitea-reports-publish-auth` (htpasswd) | Actions Secret: `REPORTS_PUBLISH_TOKEN` | +| `reports_retention_read_token` | `gitea-reports-retention-gitea` (token) | PAT: `CI-REPORTS_READ_FOR_RETENTION` | ### Secret Reference Architecture ```mermaid graph TD subgraph "Publish Flow" - P1["Actions Secret
GIT_PAGES_PUBLISH_TOKEN"] - P2["K8s Secret
git-pages-publish-auth"] + P1["Actions Secret
REPORTS_PUBLISH_TOKEN"] + P2["K8s Secret
gitea-reports-publish-auth"] P1 -->|token| TRAEFIK P2 -->|htpasswd| TRAEFIK TRAEFIK["Traefik BasicAuth"] end subgraph "Retention Flow" - R1["K8s Secret
git-pages-retention-gitea"] + R1["K8s Secret
gitea-reports-retention-gitea"] R2["Gitea PAT
CI-REPORTS_READ_FOR_RETENTION"] R1 -->|token| SC["Sidecar"] SC -->|API auth| GITEA["Gitea API"] @@ -133,8 +133,8 @@ graph TD sequenceDiagram participant Actions as Gitea Actions participant Traefik as Traefik - participant K8sAuth as K8s Secret
git-pages-publish-auth - participant K8sToken as K8s Secret
git-pages-publish-token + participant K8sAuth as K8s Secret
gitea-reports-publish-auth + participant K8sToken as K8s Secret
gitea-reports-publish-token participant Upload as upload-sidecar participant PV as PVC /app/data @@ -158,8 +158,8 @@ sequenceDiagram ``` **Kaksi secretiä (Traefik-yhteensopivuus):** -- `git-pages-publish-auth` = `users` (htpasswd, Traefik käyttää) -- `git-pages-publish-token` = `token` (plaintext, luetaan Giteaan viedessä) +- `gitea-reports-publish-auth` = `users` (htpasswd, Traefik käyttää) +- `gitea-reports-publish-token` = `token` (plaintext, luetaan Giteaan viedessä) --- @@ -189,7 +189,7 @@ GET/HEAD-reitillä ei ole Middlewarea. Luku on julkinen, jos URL tunnetaan. ```mermaid sequenceDiagram participant CronJob as Retention CronJob - participant K8sSecret as K8s Secret
git-pages-retention-gitea + participant K8sSecret as K8s Secret
gitea-reports-retention-gitea participant GiteaAPI as Gitea API participant PV as PVC /app/data @@ -218,23 +218,23 @@ joista raportteja on PVC:llä. - **"secret not found"** — luiko secretit ennen Helm-asennusta? - **"401 Unauthorized"** — onko Gitea Actions secret oikea? -- **"found 2 elements for secret"** — Traefik vaatii single-key secretin. Varmista että `git-pages-publish-auth` sisältää vain `users`-avaimen. +- **"found 2 elements for secret"** — Traefik vaatii single-key secretin. Varmista että `gitea-reports-publish-auth` sisältää vain `users`-avaimen. - **"token hukkuu"** — generoi uusi token (Vaihe 3) ja päivitä molemmat publish-secretit: ```bash # 1. Generoi uusi - GIT_PAGES_PUBLISH_TOKEN="$(openssl rand -base64 24)" + REPORTS_PUBLISH_TOKEN="$(openssl rand -base64 24)" # 2. Päivitä K8s secrets (molemmat) NS=gitea-reports - kubectl delete secret git-pages-publish-auth -n "$NS" - kubectl delete secret git-pages-publish-token -n "$NS" + kubectl delete secret gitea-reports-publish-auth -n "$NS" + kubectl delete secret gitea-reports-publish-token -n "$NS" - kubectl create secret generic git-pages-publish-auth \ - --from-literal=users="$(docker run --rm httpd:2-alpine htpasswd -nb publish "$GIT_PAGES_PUBLISH_TOKEN")" \ + kubectl create secret generic gitea-reports-publish-auth \ + --from-literal=users="$(docker run --rm httpd:2-alpine htpasswd -nb publish "$REPORTS_PUBLISH_TOKEN")" \ -n "$NS" - kubectl create secret generic git-pages-publish-token \ - --from-literal=token="$GIT_PAGES_PUBLISH_TOKEN" \ + kubectl create secret generic gitea-reports-publish-token \ + --from-literal=token="$REPORTS_PUBLISH_TOKEN" \ -n "$NS" # 3. Päivitä Gitea Actions secret jokaisessa repoissa (luke README:stä) @@ -249,19 +249,19 @@ ADMIN_TOKEN="" NS=gitea-reports # Lue plaintext-token erillisestä secretistä -TOKEN=$(kubectl get secret git-pages-publish-token -n "$NS" -o jsonpath='{.data.token}' | base64 -d) +TOKEN=$(kubectl get secret gitea-reports-publish-token -n "$NS" -o jsonpath='{.data.token}' | base64 -d) for repo in "owner/repo1" "owner/repo2" "owner/repo3"; do curl -X POST "https://gitea.example.com/api/v1/repos/$repo/actions/secrets" \ -H "Authorization: token $ADMIN_TOKEN" \ -H "Content-Type: application/json" \ - -d "{\"name\":\"GIT_PAGES_PUBLISH_TOKEN\",\"data\":\"$TOKEN\"}" + -d "{\"name\":\"REPORTS_PUBLISH_TOKEN\",\"data\":\"$TOKEN\"}" done ``` Tai `tea` CLI:lla (Gitea:n virallinen CLI): ```bash -tea actions secrets add --repo owner/repo1 GIT_PAGES_PUBLISH_TOKEN "$TOKEN" -tea actions secrets add --repo owner/repo2 GIT_PAGES_PUBLISH_TOKEN "$TOKEN" +tea actions secrets add --repo owner/repo1 REPORTS_PUBLISH_TOKEN "$TOKEN" +tea actions secrets add --repo owner/repo2 REPORTS_PUBLISH_TOKEN "$TOKEN" ``` diff --git a/gitea-reports/docs/tech-stack.md b/gitea-reports/docs/tech-stack.md index f1b9982..e9f91dd 100644 --- a/gitea-reports/docs/tech-stack.md +++ b/gitea-reports/docs/tech-stack.md @@ -1,7 +1,7 @@ -# Tech Stack — git-pages +# Tech Stack — gitea-reports -> Mitä teknologioita `git-pages/` Helm chart käyttää ja edellyttää. Tämä dokumentti koskee vain -> `git-pages/`-alikansiota monorepossa — ei juuren `gitea-ci-library`-kirjastoa. +> Mitä teknologioita `gitea-reports/` Helm chart käyttää ja edellyttää. Tämä dokumentti koskee vain +> `gitea-reports/`-alikansiota monorepossa — ei juuren `gitea-ci-library`-kirjastoa. --- @@ -9,11 +9,11 @@ | Teknologia | Versio | Käyttö | |---|---|---| -| **git-pages** (Codeberg) | `0.9.1` | Staattinen sisältö, apex index-site (`/.index`), HTTP PATCH/PUT -julkaisu | +| **gitea-reports** (Codeberg) | `0.9.1` | Staattinen sisältö, apex index-site (`/.index`), HTTP PATCH/PUT -julkaisu | | **Filesystem storage** | — | Sisältö PVC:llä (`/app/data`) | | **TOML** | — | Sovellusconfig ConfigMapissa (`config.toml`) | -Image: `codeberg.org/git-pages/git-pages:0.9.1` (ei `v`-etuliitettä tagissa). +Image: `codeberg.org/gitea-reports/gitea-reports:0.9.1` (ei `v`-etuliitettä tagissa). Chart ajaa `PAGES_INSECURE=1` — julkaisuvaltuutus Traefik Middlewaressä, ei forge-authia. @@ -26,7 +26,7 @@ Chart ajaa `PAGES_INSECURE=1` — julkaisuvaltuutus Traefik Middlewaressä, ei f | **Kubernetes** | 1.24+ | Deployment, Service, PVC, Secret | | **Helm** | v3 | Chart asennus ja päivitys | | **Traefik** | CRD `traefik.io/v1alpha1` | IngressRoute, Middleware (`basicAuth`, HTTPS-redirect) | -| **cert-manager** | — | TLS-sertifikaatti (`git-pages-tls`) | +| **cert-manager** | — | TLS-sertifikaatti (`gitea-reports-tls`) | --- @@ -43,8 +43,8 @@ Chart ajaa `PAGES_INSECURE=1` — julkaisuvaltuutus Traefik Middlewaressä, ei f | Resurssi | Lähde | Dokumentti | |---|---|---| -| `git-pages-publish-auth` | Manuaalinen Secret | [secrets.md](secrets.md) | -| `git-pages-tls` | cert-manager Certificate | Automaattinen asennuksessa | +| `gitea-reports-publish-auth` | Manuaalinen Secret | [secrets.md](secrets.md) | +| `gitea-reports-tls` | cert-manager Certificate | Automaattinen asennuksessa | | `ClusterIssuer` | Klusteri (esim. `letsencrypt-prod`) | `dev-values.yaml` | --- @@ -74,8 +74,8 @@ Esimerkki: `helm upgrade --install gitea-reports ./gitea-reports -n gitea-report | Teknologia | Syy | |---|---| -| **Gitea `pages`-branch** | Ei Gitea git-pages -integraatiota | +| **Gitea `pages`-branch** | Ei Gitea gitea-reports -integraatiota | | **deadnews/gitea-pages** | Ei Gitea API -hakua | | **MinIO / S3** | Erillinen raporttivarasto — ei tämän chartin scope | -| **Gitea forge-auth / PAT** | Julkaisu BasicAuth-tokenilla (`git-pages-publish-auth`) | +| **Gitea forge-auth / PAT** | Julkaisu BasicAuth-tokenilla (`gitea-reports-publish-auth`) | | **Helm-managed publish Secret** | `publishAuth.create: false` — secret manuaalisesti | diff --git a/gitea-reports/templates/NOTES.txt b/gitea-reports/templates/NOTES.txt index 9365218..06ef71d 100644 --- a/gitea-reports/templates/NOTES.txt +++ b/gitea-reports/templates/NOTES.txt @@ -3,7 +3,7 @@ Nginx + upload-sidecar installed. See docs/secrets.md for secret prerequisites (K8s + Gitea Actions). Install: - helm upgrade --install git-pages ./git-pages -n {{ .Release.Namespace }} --create-namespace -f dev-values.yaml + helm upgrade --install gitea-reports ./gitea-reports -n {{ .Release.Namespace }} --create-namespace -f dev-values.yaml Host: https://{{ .Values.ingress.host }} Reports: https://{{ .Values.ingress.host }}/{owner}/{repo}/{branch}/{sha8}/{suite}/ @@ -15,5 +15,5 @@ Publish (CI): --data-binary @report.tar.gz \ https://{{ .Values.ingress.host }}/{owner}/{repo}/{branch}/{sha8}/{suite}/ -Upgrade: helm upgrade {{ .Release.Name }} ./git-pages -n {{ .Release.Namespace }} -f dev-values.yaml +Upgrade: helm upgrade {{ .Release.Name }} ./gitea-reports -n {{ .Release.Namespace }} -f dev-values.yaml Uninstall: helm uninstall {{ .Release.Name }} -n {{ .Release.Namespace }} diff --git a/gitea-reports/templates/_helpers.tpl b/gitea-reports/templates/_helpers.tpl index 08418db..19b2dd4 100644 --- a/gitea-reports/templates/_helpers.tpl +++ b/gitea-reports/templates/_helpers.tpl @@ -1,8 +1,8 @@ -{{- define "git-pages.name" -}} +{{- define "gitea-reports.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} {{- end }} -{{- define "git-pages.fullname" -}} +{{- define "gitea-reports.fullname" -}} {{- if .Values.fullnameOverride }} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} {{- else }} @@ -15,25 +15,25 @@ {{- end }} {{- end }} -{{- define "git-pages.chart" -}} +{{- define "gitea-reports.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} -{{- define "git-pages.labels" -}} -helm.sh/chart: {{ include "git-pages.chart" . }} -{{ include "git-pages.selectorLabels" . }} +{{- define "gitea-reports.labels" -}} +helm.sh/chart: {{ include "gitea-reports.chart" . }} +{{ include "gitea-reports.selectorLabels" . }} {{- if .Chart.AppVersion }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} {{- end }} -{{- define "git-pages.selectorLabels" -}} -app.kubernetes.io/name: {{ include "git-pages.name" . }} +{{- define "gitea-reports.selectorLabels" -}} +app.kubernetes.io/name: {{ include "gitea-reports.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{- define "git-pages.componentLabels" -}} -{{ include "git-pages.labels" . }} +{{- define "gitea-reports.componentLabels" -}} +{{ include "gitea-reports.labels" . }} app.kubernetes.io/component: pages-server {{- end }} diff --git a/gitea-reports/templates/certificate.yaml b/gitea-reports/templates/certificate.yaml index a4d7377..1ffcc5d 100644 --- a/gitea-reports/templates/certificate.yaml +++ b/gitea-reports/templates/certificate.yaml @@ -2,11 +2,11 @@ apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: {{ include "git-pages.fullname" . }}-tls + name: {{ include "gitea-reports.fullname" . }}-tls labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: - secretName: git-pages-tls + secretName: {{ include "gitea-reports.fullname" . }}-tls dnsNames: - {{ .Values.ingress.host | quote }} issuerRef: diff --git a/gitea-reports/templates/configmap.yaml b/gitea-reports/templates/configmap.yaml index d7aeebb..19a625f 100644 --- a/gitea-reports/templates/configmap.yaml +++ b/gitea-reports/templates/configmap.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "git-pages.fullname" . }}-config + name: {{ include "gitea-reports.fullname" . }}-config labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} data: default.conf: | client_max_body_size {{ .Values.nginx.bodySize }}; diff --git a/gitea-reports/templates/deployment.yaml b/gitea-reports/templates/deployment.yaml index e460f5b..fae8315 100644 --- a/gitea-reports/templates/deployment.yaml +++ b/gitea-reports/templates/deployment.yaml @@ -1,18 +1,18 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: {{ include "git-pages.fullname" . }} + name: {{ include "gitea-reports.fullname" . }} labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: replicas: 1 selector: matchLabels: - {{- include "git-pages.selectorLabels" . | nindent 6 }} + {{- include "gitea-reports.selectorLabels" . | nindent 6 }} template: metadata: labels: - {{- include "git-pages.componentLabels" . | nindent 8 }} + {{- include "gitea-reports.componentLabels" . | nindent 8 }} spec: securityContext: fsGroup: 1000 @@ -57,13 +57,13 @@ spec: volumes: - name: nginx-conf configMap: - name: {{ include "git-pages.fullname" . }}-config + name: {{ include "gitea-reports.fullname" . }}-config items: - key: default.conf path: default.conf - name: upload-script configMap: - name: {{ include "git-pages.fullname" . }}-config + name: {{ include "gitea-reports.fullname" . }}-config defaultMode: 0755 items: - key: upload-server.py @@ -71,5 +71,5 @@ spec: {{- if .Values.persistence.enabled }} - name: data persistentVolumeClaim: - claimName: {{ include "git-pages.fullname" . }}-data + claimName: {{ include "gitea-reports.fullname" . }}-data {{- end }} diff --git a/gitea-reports/templates/ingressroute.yaml b/gitea-reports/templates/ingressroute.yaml index ca255c9..493d52a 100644 --- a/gitea-reports/templates/ingressroute.yaml +++ b/gitea-reports/templates/ingressroute.yaml @@ -2,9 +2,9 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: {{ include "git-pages.fullname" . }} + name: {{ include "gitea-reports.fullname" . }} labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: entryPoints: - {{ .Values.ingress.entryPoints.websecure }} @@ -14,24 +14,24 @@ spec: (Method(`PATCH`) || Method(`PUT`)) kind: Rule middlewares: - - name: {{ include "git-pages.fullname" . }}-publish-auth + - name: {{ include "gitea-reports.fullname" . }}-publish-auth services: - - name: {{ include "git-pages.fullname" . }} + - name: {{ include "gitea-reports.fullname" . }} port: {{ .Values.upload.port }} - match: Host(`{{ .Values.ingress.host }}`) && (Method(`GET`) || Method(`HEAD`)) kind: Rule services: - - name: {{ include "git-pages.fullname" . }} + - name: {{ include "gitea-reports.fullname" . }} port: {{ .Values.nginx.port }} tls: - secretName: git-pages-tls + secretName: {{ include "gitea-reports.fullname" . }}-tls --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: {{ include "git-pages.fullname" . }}-http + name: {{ include "gitea-reports.fullname" . }}-http labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: entryPoints: - {{ .Values.ingress.entryPoints.web }} @@ -41,8 +41,8 @@ spec: !PathPrefix(`/.well-known/acme-challenge/`) kind: Rule middlewares: - - name: {{ include "git-pages.fullname" . }}-https-redirect + - name: {{ include "gitea-reports.fullname" . }}-https-redirect services: - - name: {{ include "git-pages.fullname" . }} + - name: {{ include "gitea-reports.fullname" . }} port: {{ .Values.nginx.port }} {{- end }} diff --git a/gitea-reports/templates/middleware.yaml b/gitea-reports/templates/middleware.yaml index 8cc55e5..7f1af6c 100644 --- a/gitea-reports/templates/middleware.yaml +++ b/gitea-reports/templates/middleware.yaml @@ -2,19 +2,19 @@ apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: - name: {{ include "git-pages.fullname" . }}-publish-auth + name: {{ include "gitea-reports.fullname" . }}-publish-auth labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: basicAuth: - secret: git-pages-publish-auth + secret: {{ include "gitea-reports.fullname" . }}-publish-auth --- apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: - name: {{ include "git-pages.fullname" . }}-https-redirect + name: {{ include "gitea-reports.fullname" . }}-https-redirect labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: redirectScheme: scheme: https diff --git a/gitea-reports/templates/publish-auth-secret.yaml b/gitea-reports/templates/publish-auth-secret.yaml index e6d36ca..538d6c9 100644 --- a/gitea-reports/templates/publish-auth-secret.yaml +++ b/gitea-reports/templates/publish-auth-secret.yaml @@ -2,9 +2,9 @@ apiVersion: v1 kind: Secret metadata: - name: git-pages-publish-auth + name: {{ include "gitea-reports.fullname" . }}-publish-auth labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} type: Opaque stringData: users: | diff --git a/gitea-reports/templates/pvc.yaml b/gitea-reports/templates/pvc.yaml index a377929..6a2d14d 100644 --- a/gitea-reports/templates/pvc.yaml +++ b/gitea-reports/templates/pvc.yaml @@ -2,9 +2,9 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: {{ include "git-pages.fullname" . }}-data + name: {{ include "gitea-reports.fullname" . }}-data labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: accessModes: - {{ .Values.persistence.accessMode }} diff --git a/gitea-reports/templates/retention-configmap.yaml b/gitea-reports/templates/retention-configmap.yaml index cc59680..cd6adb0 100644 --- a/gitea-reports/templates/retention-configmap.yaml +++ b/gitea-reports/templates/retention-configmap.yaml @@ -2,9 +2,9 @@ apiVersion: v1 kind: ConfigMap metadata: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} data: retention.json: | {{- .Values.retention.rules | toJson | nindent 4 }} diff --git a/gitea-reports/templates/retention-cronjob.yaml b/gitea-reports/templates/retention-cronjob.yaml index 2817611..133b524 100644 --- a/gitea-reports/templates/retention-cronjob.yaml +++ b/gitea-reports/templates/retention-cronjob.yaml @@ -2,9 +2,9 @@ apiVersion: batch/v1 kind: CronJob metadata: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: schedule: {{ .Values.retention.schedule | quote }} concurrencyPolicy: Forbid @@ -16,10 +16,10 @@ spec: template: metadata: labels: - app.kubernetes.io/name: git-pages-retention + app.kubernetes.io/name: {{ include "gitea-reports.fullname" . }}-retention app.kubernetes.io/instance: {{ .Release.Name }} spec: - serviceAccountName: git-pages-retention + serviceAccountName: {{ include "gitea-reports.fullname" . }}-retention restartPolicy: OnFailure containers: - name: retention @@ -46,7 +46,7 @@ spec: - name: GITEA_TOKEN valueFrom: secretKeyRef: - name: git-pages-retention-gitea + name: {{ include "gitea-reports.fullname" . }}-retention-gitea key: token volumeMounts: - name: data @@ -58,14 +58,14 @@ spec: volumes: - name: data persistentVolumeClaim: - claimName: {{ include "git-pages.fullname" . }}-data + claimName: {{ include "gitea-reports.fullname" . }}-data - name: scripts configMap: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention defaultMode: 0755 - name: config configMap: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention items: - key: retention.json path: retention.json diff --git a/gitea-reports/templates/retention-rbac.yaml b/gitea-reports/templates/retention-rbac.yaml index 0dcf543..d053c40 100644 --- a/gitea-reports/templates/retention-rbac.yaml +++ b/gitea-reports/templates/retention-rbac.yaml @@ -2,16 +2,16 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} rules: - apiGroups: ["apps"] resources: ["deployments", "deployments/scale"] @@ -23,15 +23,15 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention subjects: - kind: ServiceAccount - name: git-pages-retention + name: {{ include "gitea-reports.fullname" . }}-retention namespace: {{ .Release.Namespace }} {{- end }} diff --git a/gitea-reports/templates/service.yaml b/gitea-reports/templates/service.yaml index 15dfd6f..b175fbb 100644 --- a/gitea-reports/templates/service.yaml +++ b/gitea-reports/templates/service.yaml @@ -1,13 +1,13 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "git-pages.fullname" . }} + name: {{ include "gitea-reports.fullname" . }} labels: - {{- include "git-pages.componentLabels" . | nindent 4 }} + {{- include "gitea-reports.componentLabels" . | nindent 4 }} spec: type: {{ .Values.service.type }} selector: - {{- include "git-pages.selectorLabels" . | nindent 4 }} + {{- include "gitea-reports.selectorLabels" . | nindent 4 }} ports: - name: http-read port: {{ .Values.nginx.port }} diff --git a/scripts/ci-validate.sh b/scripts/ci-validate.sh index f79cbe0..12e7788 100644 --- a/scripts/ci-validate.sh +++ b/scripts/ci-validate.sh @@ -21,7 +21,7 @@ while IFS='=' read -r key value || [ -n "$key" ]; do done < "$CONF_FILE" [ -z "${GITEA_TOKEN:-}" ] && echo "ERROR: GITEA_TOKEN secret is not set" >&2 && ERRORS=1 -[ -z "${GIT_PAGES_PUBLISH_TOKEN:-}" ] && echo "ERROR: GIT_PAGES_PUBLISH_TOKEN secret is not set" >&2 && ERRORS=1 +[ -z "${REPORTS_PUBLISH_TOKEN:-}" ] && echo "ERROR: REPORTS_PUBLISH_TOKEN secret is not set" >&2 && ERRORS=1 if [ "$ERRORS" -ne 0 ]; then echo "FATAL: CI config validation failed" >&2 diff --git a/scripts/publish-git-pages.sh b/scripts/publish-git-pages.sh index 082e0f3..ca39099 100755 --- a/scripts/publish-git-pages.sh +++ b/scripts/publish-git-pages.sh @@ -5,7 +5,7 @@ SUITE_PATH="${1:-}" [ -n "$SUITE_PATH" ] || { echo "ERROR: suite_path argument required" >&2; exit 1; } [ -n "${GIT_PAGES_URL:-}" ] || { echo "ERROR: GIT_PAGES_URL is not set" >&2; exit 1; } -[ -n "${GIT_PAGES_PUBLISH_TOKEN:-}" ] || { echo "ERROR: GIT_PAGES_PUBLISH_TOKEN is not set" >&2; exit 1; } +[ -n "${REPORTS_PUBLISH_TOKEN:-}" ] || { echo "ERROR: REPORTS_PUBLISH_TOKEN is not set" >&2; exit 1; } [ -n "${GITHUB_REPOSITORY:-}" ] || { echo "ERROR: GITHUB_REPOSITORY is not set" >&2; exit 1; } [ -n "${GITHUB_SHA:-}" ] || { echo "ERROR: GITHUB_SHA is not set" >&2; exit 1; } [ -n "${GITHUB_REF_NAME:-}" ] || { echo "ERROR: GITHUB_REF_NAME is not set" >&2; exit 1; } @@ -93,7 +93,7 @@ tar czf "$TAR" -C "$WORK/$SUITE" . # PUT upload-sidecariin PUBLISH_URL="${GIT_PAGES_URL}/${OWNER}/${REPO}/${BRANCH}/${SHA8}/${SUITE}/" HTTP_CODE=$(curl -sS -X PUT "$PUBLISH_URL" \ - -u "${PAGES_USER}:${GIT_PAGES_PUBLISH_TOKEN}" \ + -u "${PAGES_USER}:${REPORTS_PUBLISH_TOKEN}" \ -H "Content-Type: application/tar+gz" \ --data-binary @"$TAR" \ -o /tmp/git-pages-publish-response.txt \ diff --git a/scripts/publish.sh b/scripts/publish.sh index eb9b53e..9f71e42 100644 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -7,7 +7,7 @@ SUITE_PATH="${1:-}" [ -n "${GITEA_API_URL:-}" ] || { echo "ERROR: GITEA_API_URL is not set" >&2; exit 1; } [ -n "${GITEA_TOKEN:-}" ] || { echo "ERROR: GITEA_TOKEN is not set" >&2; exit 1; } [ -n "${GIT_PAGES_URL:-}" ] || { echo "ERROR: GIT_PAGES_URL is not set" >&2; exit 1; } -[ -n "${GIT_PAGES_PUBLISH_TOKEN:-}" ] || { echo "ERROR: GIT_PAGES_PUBLISH_TOKEN is not set" >&2; exit 1; } +[ -n "${REPORTS_PUBLISH_TOKEN:-}" ] || { echo "ERROR: REPORTS_PUBLISH_TOKEN is not set" >&2; exit 1; } SCRIPT_DIR="$(dirname "$0")" diff --git a/skills/consumer-pipelines/REFERENCE.md b/skills/consumer-pipelines/REFERENCE.md index 9e11d46..d541fa5 100644 --- a/skills/consumer-pipelines/REFERENCE.md +++ b/skills/consumer-pipelines/REFERENCE.md @@ -473,7 +473,7 @@ VERSION_FILE=git-pages/Chart.yaml | Secret | Pakollinen | |---|---| | `GITEA_TOKEN` | Aina (Gitean sisäinen, automaattisesti saatavilla) | -| `GIT_PAGES_PUBLISH_TOKEN` | Aina | +| `REPORTS_PUBLISH_TOKEN` | Aina | | `DOCKER_USERNAME` | Vain jos buildaat kontteja | | `DOCKER_PASSWORD` | Vain jos buildaat kontteja | | `HELM_USER` | Vain jos pushaat Helm chartin OCI-rekisteriin (oletus `github.actor`) | diff --git a/tests/ci-validate.bats b/tests/ci-validate.bats index 46e8f9c..6b5e55c 100644 --- a/tests/ci-validate.bats +++ b/tests/ci-validate.bats @@ -44,15 +44,15 @@ EOF [[ "$output" == *"GITEA_TOKEN"* ]] } -@test "missing GIT_PAGES_PUBLISH_TOKEN secret → exit 1" { +@test "missing REPORTS_PUBLISH_TOKEN secret → exit 1" { cat > "$CONF_FILE" <