107 lines
4.6 KiB
YAML
107 lines
4.6 KiB
YAML
# Builds and publishes the unifi-network-mcp container image to the Gitea
|
|
# registry.
|
|
#
|
|
# Triggers:
|
|
# - push to main (e.g. bumping the Dockerfile's default version ARG)
|
|
# - weekly schedule, Mon 06:00 UTC — resolves the newest published
|
|
# unifi-network-mcp on PyPI and builds it if not yet published. This
|
|
# lands the new tag ~7h BEFORE the cluster0 image-update cron
|
|
# (Mon 13:00 UTC) scans registries, so the Monday pass picks it up like
|
|
# any other app.
|
|
# - workflow_dispatch with an explicit version input
|
|
name: build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'unifi-network-mcp PyPI version (empty = latest published)'
|
|
required: false
|
|
default: ''
|
|
|
|
env:
|
|
REGISTRY: gitea.williammiceli.systems
|
|
IMAGE: gitea.williammiceli.systems/hermes/unifi-network-mcp
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest # cluster0 Gitea runner (registers this label; has docker + network)
|
|
# Minimal explicit scopes: read code (checkout), write packages (registry push).
|
|
# Declared explicitly so the workflow keeps working even if the repo/owner
|
|
# default token permission mode is switched to Restricted.
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve upstream version
|
|
id: ver
|
|
run: |
|
|
if [ -n "${{ github.event.inputs.version }}" ]; then
|
|
VER="${{ github.event.inputs.version }}"
|
|
else
|
|
VER=$(curl -sf https://pypi.org/pypi/unifi-network-mcp/json \
|
|
| python3 -c "import sys,json;print(json.load(sys.stdin)['info']['version'])")
|
|
fi
|
|
[ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
|
|
echo "version=$VER" >> "$GITHUB_OUTPUT"
|
|
echo "Resolved unifi-network-mcp version: $VER"
|
|
|
|
- name: Configure registry credentials
|
|
# Uses a dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN,
|
|
# read/write package scope only) instead of the built-in job token:
|
|
# Gitea's container registry rejects scoped /v2/token requests made
|
|
# with the Actions job token (GetAccessScope returns empty scope for
|
|
# ActionTokenMethodName -> Authenticate 401s, upstream issue #23642,
|
|
# unfixed as of 1.27.2). Write config.json directly; no login ping.
|
|
run: |
|
|
mkdir -p "$HOME/.docker"
|
|
AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > "$HOME/.docker/config.json"
|
|
chmod 600 "$HOME/.docker/config.json"
|
|
echo "docker config.json written for $REGISTRY"
|
|
|
|
- name: Diagnose registry auth (runs only if a later step fails)
|
|
if: failure()
|
|
# Prints only metadata (lengths, status codes) — never the token itself.
|
|
run: |
|
|
T="${{ secrets.REGISTRY_TOKEN }}"
|
|
echo "REGISTRY_TOKEN length: ${#T} (0 = secret empty or missing)"
|
|
echo "--- /v2/ ping with basic auth ---"
|
|
curl -s -o /dev/null -w "HTTP %{http_code}\n" -u "Hermes:$T" \
|
|
"https://gitea.williammiceli.systems/v2/" || true
|
|
echo "--- bearer-token flow (what docker push does after a 401 challenge) ---"
|
|
BT=$(curl -s -u "Hermes:$T" -G "https://gitea.williammiceli.systems/v2/token" \
|
|
--data-urlencode "service=container_registry" \
|
|
--data-urlencode "scope=repository:hermes/unifi-network-mcp:pull,push" \
|
|
| python3 -c "import sys,json;print(json.load(sys.stdin).get('token',''))")
|
|
echo "bearer token length: ${#BT}"
|
|
curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
|
|
-H "Authorization: Bearer ***" \
|
|
"https://gitea.williammiceli.systems/v2/hermes/unifi-network-mcp/tags/list" || true
|
|
|
|
- name: Skip if already published
|
|
id: skip
|
|
run: |
|
|
if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then
|
|
echo "Image $IMAGE:v${{ steps.ver.outputs.version }} already exists — nothing to do."
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build and push
|
|
if: steps.skip.outputs.skip != 'true'
|
|
run: |
|
|
VER="${{ steps.ver.outputs.version }}"
|
|
docker build --build-arg UNIFI_NETWORK_MCP_VERSION="$VER" \
|
|
-t "$IMAGE:v$VER" -t "$IMAGE:latest" .
|
|
docker push "$IMAGE:v$VER"
|
|
docker push "$IMAGE:latest"
|