Initial commit

.gitignore

@@ -0,0 +1 @@
+.idea/

README.md

@@ -0,0 +1,66 @@
+# sebse/actions
+
+Reusable Gitea Actions for sebse infrastructure.
+
+## Actions
+
+### `docker-login`
+Login to git.sebse.de container registry.
+
+**Inputs:** `username`, `password`
+
+### `docker-build-push`
+Extract metadata, build and push Docker image. Handles cache automatically.
+
+**Inputs:** `image`, `context`, `dockerfile` (optional)
+
+### `helm-package-push`
+Inject image tag into chart values, package and push to git.sebse.de helm registry.
+Pushes both SHA-tagged and `latest` versions.
+
+**Inputs:** `chart-path`, `version`, `app-version`, `username`, `password`
+
+### `helm-deploy`
+Deploy via helmbot SSH to vmd127288. Validates all inputs server-side.
+
+**Inputs:** `app`, `profile`, `version`, `ssh-key`
+
+## Usage example
+
+```yaml
+- name: Docker login
+  uses: sebse/actions/docker-login@main
+  with:
+    username: ${{ secrets.REGISTRY_USERNAME }}
+    password: ${{ secrets.REGISTRY_TOKEN }}
+
+- name: Build and push app
+  uses: sebse/actions/docker-build-push@main
+  with:
+    image: git.sebse.de/${{ github.repository }}
+    context: ./web
+
+- name: Package and push helm chart
+  uses: sebse/actions/helm-package-push@main
+  with:
+    chart-path: web/charts/my-app
+    version: 0.0.0-${{ env.SHORT_SHA }}
+    app-version: ${{ env.SHORT_SHA }}
+    username: ${{ secrets.REGISTRY_USERNAME }}
+    password: ${{ secrets.REGISTRY_TOKEN }}
+
+- name: Deploy to prod
+  uses: sebse/actions/helm-deploy@main
+  with:
+    app: my-app
+    profile: prod
+    version: 0.0.0-${{ env.SHORT_SHA }}
+    ssh-key: ${{ secrets.HELMBOT_SSH_KEY }}
+```
+
+## Constants hardcoded in actions
+- Registry: `git.sebse.de`
+- Deploy host: `84.247.134.31`
+- Deploy port: `1234`
+- Deploy user: `helmbot`
+- Helm registry path: `https://git.sebse.de/api/packages/sebse/helm/api/charts`

docker-build-push/action.yml

@@ -0,0 +1,40 @@
+name: Docker Build and Push
+description: Extract metadata, build and push Docker image to git.sebse.de
+
+inputs:
+  image:
+    description: Full image name, e.g. git.sebse.de/sebse/my-app
+    required: true
+  context:
+    description: Docker build context path
+    required: true
+  dockerfile:
+    description: Path to Dockerfile (optional, defaults to context/Dockerfile)
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Extract metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ inputs.image }}
+        tags: |
+          type=sha,prefix=,format=short
+          type=raw,value=latest
+
+    - name: Setup Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build and push
+      uses: docker/build-push-action@v5
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.dockerfile != '' && inputs.dockerfile || format('{0}/Dockerfile', inputs.context) }}
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: type=registry,ref=${{ inputs.image }}:latest
+        cache-to: type=inline

docker-login/action.yml

@@ -0,0 +1,20 @@
+name: Docker Login
+description: Login to git.sebse.de container registry
+
+inputs:
+  username:
+    description: Registry username
+    required: true
+  password:
+    description: Registry password or token
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Login to registry
+      uses: docker/login-action@v3
+      with:
+        registry: git.sebse.de
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}

helm-deploy/action.yml

@@ -0,0 +1,34 @@
+name: Helm Deploy
+description: Deploy helm chart via helmbot SSH to vmd127288
+
+inputs:
+  app:
+    description: App subfolder name in /home/sebse/helm, e.g. factorio-signal-exporter
+    required: true
+  profile:
+    description: Deployment profile, e.g. prod or dev
+    required: true
+  version:
+    description: Chart version to deploy, e.g. 0.0.0-abc1234
+    required: true
+  ssh-key:
+    description: helmbot SSH private key
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Deploy via helmbot
+      shell: bash
+      run: |
+        mkdir -p ~/.ssh
+        echo "${{ inputs.ssh-key }}" > ~/.ssh/helmbot_deploy
+        chmod 600 ~/.ssh/helmbot_deploy
+        ssh -i ~/.ssh/helmbot_deploy \
+            -o StrictHostKeyChecking=no \
+            -p 1234 \
+            helmbot@84.247.134.31 \
+            " -s ${{ inputs.app }} -p ${{ inputs.profile }} -v ${{ inputs.version }}"
+        EXIT_CODE=$?
+        rm ~/.ssh/helmbot_deploy
+        exit $EXIT_CODE

helm-package-push/action.yml

@@ -0,0 +1,67 @@
+name: Helm Package and Push
+description: Inject image tag, package helm chart and push to git.sebse.de helm registry
+
+inputs:
+  chart-path:
+    description: Path to helm chart directory, e.g. web/charts/my-app
+    required: true
+  version:
+    description: Helm chart version, e.g. 0.0.0-abc1234
+    required: true
+  app-version:
+    description: App version / image tag, e.g. abc1234
+    required: true
+  username:
+    description: Registry username
+    required: true
+  password:
+    description: Registry password or token
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install Helm
+      uses: azure/setup-helm@v4
+
+    - name: Inject image tag into chart values
+      shell: bash
+      run: |
+        sed -i "s|^\(\s*tag:\).*|\1 ${{ inputs.app-version }}|" \
+          ${{ inputs.chart-path }}/values.yaml
+
+    - name: Package helm chart (SHA)
+      shell: bash
+      run: |
+        helm package ${{ inputs.chart-path }} \
+          --version "${{ inputs.version }}" \
+          --app-version "${{ inputs.app-version }}"
+
+    - name: Push helm chart (SHA) to Gitea
+      shell: bash
+      run: |
+        CHART_NAME=$(basename ${{ inputs.chart-path }})
+        curl -u ${{ inputs.username }}:${{ inputs.password }} \
+          -X POST \
+          https://git.sebse.de/api/packages/sebse/helm/api/charts \
+          -F "chart=@${CHART_NAME}-${{ inputs.version }}.tgz" \
+          --fail-with-body
+
+    - name: Package helm chart (latest)
+      shell: bash
+      run: |
+        sed -i "s|^\(\s*tag:\).*|\1 ${{ inputs.app-version }}|" \
+          ${{ inputs.chart-path }}/values.yaml
+        helm package ${{ inputs.chart-path }} \
+          --version "0.0.0-latest" \
+          --app-version "${{ inputs.app-version }}"
+
+    - name: Push helm chart (latest) to Gitea
+      shell: bash
+      run: |
+        CHART_NAME=$(basename ${{ inputs.chart-path }})
+        curl -u ${{ inputs.username }}:${{ inputs.password }} \
+          -X POST \
+          https://git.sebse.de/api/packages/sebse/helm/api/charts \
+          -F "chart=@${CHART_NAME}-0.0.0-latest.tgz" \
+          --fail-with-body