jacobh2/kvitt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gitea workflow: sparse checkout, diagnostic step removed
Build Kvitt images / build (push) Successful in 6m7s
Details

Browse Source 
Checkout is a cone-mode sparse checkout of server and infra/backup (the
two build contexts), which makes actions/checkout fetch with
--filter=blob:none. fetch-depth stays 0: with depth 1, fetch-tags only
auto-follows tags on the fetched commit, and the version step needs
every v1.0.* tag. The temporary secrets diagnostic step is gone and the
header names kvitt_cicd as the owner's user-level secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
This commit is contained in:
Jacob Hagstedt
2026-10-19 20:37:27 +02:00
parent b1f4c10a3d
commit 3820f9c3c3
2 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/README.md
+10 -4
View File
@@ -241,10 +241,16 @@ fresh start and after a run, red at 26 h. (The Caddy and cert-sync rehearsals of
### Gitea Actions workflow (`.gitea/workflows/build-images.yaml`)
Same setup as the owner's working example: `runs-on: host`, `sh` steps, `apk add git docker-cli docker-cli-buildx`,
`docker login gitea.lan` with the repository secret `kvitt_cicd` (created by the owner) and `${{ github.actor }}`,
a buildx builder whose `buildkitd.toml` sets `http = true` for `gitea.lan` (created once and reused, so its cache
survives), `actions/checkout@v4` with `set-safe-directory` and `fetch-depth: 0`, the version from the newest
`v1.0.*` git tag plus one, and the git tag pushed after the build. That version is what `deploy.sh` takes.
`docker login gitea.lan` with `kvitt_cicd` (a user-level secret of the repository owner, created by the owner;
Gitea gives a repository its owner's secrets) and `${{ github.actor }}`, a buildx builder whose `buildkitd.toml`
sets `http = true` for `gitea.lan` (created once and reused, so its cache survives), `actions/checkout@v4` with
`set-safe-directory` and `fetch-depth: 0`, the version from the newest `v1.0.*` git tag plus one, and the git tag
pushed after the build. That version is what `deploy.sh` takes.
The checkout is a cone-mode sparse checkout of `server` and `infra/backup` only, the two build contexts (neither
Dockerfile copies anything outside its context), so the action fetches with `--filter=blob:none` and writes only
those files instead of all 2118 (52 MB of Android screenshot goldens among them; about 95 s on the first runs).
`fetch-depth: 0` stays because the version needs every `v1.0.*` tag (commits and trees only, no blobs): with
`fetch-depth: 1`, `fetch-tags: true` brings only tags that point at the fetched commit.
The token is interpolated into the login step's `run` line (`printf '%s' "${{ secrets.kvitt_cicd }}" | docker login
...`), the owner's proven form: the first run on the runner (2026-10-19) got an empty token from the env-based form
(`env: REGISTRY_TOKEN: ${{ secrets.kvitt_cicd }}`) on act_runner 0.6.1 and failed with "password is empty";