From a53403fbea39c88bcbadc6e6daa4cee0d3f2334c Mon Sep 17 00:00:00 2001 From: "info@pi-farm.de" <6+pi-farm@noreply.git.pi-farm.de> Date: Wed, 7 Oct 2026 11:25:39 +0000 Subject: [PATCH] .gitea/workflows/build-and-push.yaml aktualisiert --- .gitea/workflows/build-and-push.yaml | 260 +++++++++++++-------------- 1 file changed, 130 insertions(+), 130 deletions(-) diff --git a/.gitea/workflows/build-and-push.yaml b/.gitea/workflows/build-and-push.yaml index 19693de..e1cc772 100644 --- a/.gitea/workflows/build-and-push.yaml +++ b/.gitea/workflows/build-and-push.yaml @@ -204,135 +204,133 @@ jobs: run: | set -x - export TZ=Europe/Berlin - CURRENT_TIME=$(date '+%d.%m.%Y %H:%M') - BUILD_TAG="${{ steps.prep.outputs.docker_tag }}" - FULL_URL="${{ steps.prep.outputs.image_name }}" - REPO_PURE="${{ steps.prep.outputs.repo_pure }}" - BASE_IMAGE="${{ steps.prep.outputs.base_image }}" - - if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi - - grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh - set -a - source ./cleaned_env.sh - set +a - - if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi - - cat << 'EOF' > commit_msg.txt - ${{ gitea.event.head_commit.message }} - EOF - COMMIT_MSG=$(sed 's/\[skip ci\]//g' commit_msg.txt | xargs) - - # 1. Authentifizierter Download der Templates via curl (-f bricht bei HTTP-Fehlern ab) - TOKEN="${{ secrets.RUNNER_TOKEN }}" - curl -sSLf -H "Authorization: token $TOKEN" \ - "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/README.template" \ - -o README.template || echo "Warnung: README Template konnte nicht geladen werden" - - curl -sSLf -H "Authorization: token $TOKEN" \ - "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/docker-compose.template" \ - -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden" - - # 2. Sicherheitsprüfung: Falls Gitea trotz -f eine HTML-Login-Seite ausgibt, Datei sofort verwerfen - for t_file in README.template docker-compose.template; do - if [ -f "$t_file" ] && grep -qi "" "$t_file"; then - echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen." - rm -f "$t_file" - fi - done - - NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |" - if [ -f "VERSION.history" ]; then - grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true - echo "$NEW_ROW" > VERSION.history - cat VERSION.history.tmp >> VERSION.history - rm VERSION.history.tmp - else - echo "$NEW_ROW" > VERSION.history + export TZ=Europe/Berlin + CURRENT_TIME=$(date '+%d.%m.%Y %H:%M') + BUILD_TAG="${{ steps.prep.outputs.docker_tag }}" + FULL_URL="${{ steps.prep.outputs.image_name }}" + REPO_PURE="${{ steps.prep.outputs.repo_pure }}" + BASE_IMAGE="${{ steps.prep.outputs.base_image }}" + + if [ ! -f "buildargs.env" ]; then echo "❌ buildargs.env missing!"; exit 1; fi + + grep -v '^#' buildargs.env | sed 's/\r$//' > cleaned_env.sh + set -a + source ./cleaned_env.sh + set +a + + if [ -f "Dockerfile.aarch64" ]; then ARM_STATUS="✅ Active"; else ARM_STATUS="❌ Not supported"; fi + + # Commit-Message ohne fehleranfälliges Here-Doc einlesen + RAW_COMMIT_MSG="${{ gitea.event.head_commit.message }}" + COMMIT_MSG=$(echo "$RAW_COMMIT_MSG" | sed 's/\[skip ci\]//g' | tr -d '\r\n' | xargs) + + # 1. Authentifizierter Download der Templates + TOKEN="${{ secrets.RUNNER_TOKEN }}" + curl -sSLf -H "Authorization: token $TOKEN" \ + "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/README.template" \ + -o README.template || echo "Warnung: README Template konnte nicht geladen werden" + + curl -sSLf -H "Authorization: token $TOKEN" \ + "https://git.pi-farm.de/pi-farm/templates/raw/branch/dev/docker-compose.template" \ + -o docker-compose.template || echo "Warnung: Compose Template konnte nicht geladen werden" + + # 2. Sicherheitsprüfung auf HTML-Login-Seite + for t_file in README.template docker-compose.template; do + if [ -f "$t_file" ] && grep -qi "" "$t_file"; then + echo "❌ FEHLER: $t_file ist eine HTML-Loginseite! Download verworfen." + rm -f "$t_file" fi - HISTORY_CONTENT=$(cat VERSION.history) - - ENV_BLOCK_CONTENT="" - env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$env_vars" ]; then - ENV_BLOCK_CONTENT=" environment:\n" + done + + NEW_ROW="| **$BUILD_TAG** | $CURRENT_TIME | $COMMIT_MSG ✅ |" + if [ -f "VERSION.history" ]; then + grep -v "| **$BUILD_TAG** |" VERSION.history > VERSION.history.tmp || true + echo "$NEW_ROW" > VERSION.history + cat VERSION.history.tmp >> VERSION.history + rm VERSION.history.tmp + else + echo "$NEW_ROW" > VERSION.history + fi + HISTORY_CONTENT=$(cat VERSION.history) + + ENV_BLOCK_CONTENT="" + env_vars=$(grep '^ENV_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$env_vars" ]; then + ENV_BLOCK_CONTENT=" environment:\n" + while read -r line; do + [ -z "$line" ] && continue + key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_} + ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n" + done <<< "$env_vars" + fi + + PORTS_BLOCK_CONTENT="" + port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$port_vars" ]; then + PORTS_BLOCK_CONTENT=" ports:\n" + while read -r line; do + [ -z "$line" ] && continue + val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n" + done <<< "$port_vars" + fi + + VOL_BLOCK_CONTENT="" + vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true) + if [ -n "$vol_vars" ]; then + VOL_BLOCK_CONTENT=" volumes:\n" + while read -r line; do + [ -z "$line" ] && continue + val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n" + done <<< "$vol_vars" + fi + + { + echo "docker run -d \\" + echo " --name $REPO_PURE \\" + echo " --restart unless-stopped \\" + + all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true) + if [ -n "$all_params" ]; then while read -r line; do [ -z "$line" ] && continue - key=$(echo "$line" | cut -d= -f1); val=$(echo "$line" | cut -d= -f2-); clean_key=${key#ENV_} - ENV_BLOCK_CONTENT="${ENV_BLOCK_CONTENT} - ${clean_key}=${val}\n" - done <<< "$env_vars" + if [[ "$line" =~ ^PORT_ ]]; then + val=$(echo "$line" | cut -d= -f2-) + echo " -p ${val} \\" + elif [[ "$line" =~ ^ENV_ ]]; then + key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-) + echo " -e ${clean_key}=${val} \\" + elif [[ "$line" =~ ^VOL_ ]]; then + val=$(echo "$line" | cut -d= -f2-) + echo " -v ${val} \\" + fi + done <<< "$all_params" fi - - PORTS_BLOCK_CONTENT="" - port_vars=$(grep '^PORT_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$port_vars" ]; then - PORTS_BLOCK_CONTENT=" ports:\n" - while read -r line; do - [ -z "$line" ] && continue - val=$(echo "$line" | cut -d= -f2-); PORTS_BLOCK_CONTENT="${PORTS_BLOCK_CONTENT} - ${val}\n" - done <<< "$port_vars" - fi - - VOL_BLOCK_CONTENT="" - vol_vars=$(grep '^VOL_' buildargs.env | grep -v '^#' | tr -d '\r' || true) - if [ -n "$vol_vars" ]; then - VOL_BLOCK_CONTENT=" volumes:\n" - while read -r line; do - [ -z "$line" ] && continue - val=$(echo "$line" | cut -d= -f2-); VOL_BLOCK_CONTENT="${VOL_BLOCK_CONTENT} - ${val}\n" - done <<< "$vol_vars" - fi - - { - echo "docker run -d \\" - echo " --name $REPO_PURE \\" - echo " --restart unless-stopped \\" - - all_params=$(grep -E '^(PORT_|ENV_|VOL_)' buildargs.env | grep -v '^#' | sed 's/\r$//' || true) - if [ -n "$all_params" ]; then - while read -r line; do - [ -z "$line" ] && continue - if [[ "$line" =~ ^PORT_ ]]; then - val=$(echo "$line" | cut -d= -f2-) - echo " -p ${val} \\" - elif [[ "$line" =~ ^ENV_ ]]; then - key=$(echo "$line" | cut -d= -f1); clean_key=${key#ENV_}; val=$(echo "$line" | cut -d= -f2-) - echo " -e ${clean_key}=${val} \\" - elif [[ "$line" =~ ^VOL_ ]]; then - val=$(echo "$line" | cut -d= -f2-) - echo " -v ${val} \\" - fi - done <<< "$all_params" - fi - echo " $FULL_URL:$BUILD_TAG" - } > docker_run_block.txt - - DOCKERHUB_LINK_CONTENT="" - if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then - DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" - DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})" - fi - - # Template-Verarbeitung via Python (verhindert awk-Abstürze bei Zeilenumbrüchen) - process_template() { - local template=$1; local output=$2 - [ ! -f "$template" ] && return - cp "$template" "$output" - - export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \ - HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \ - PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION - - python3 -c ' + echo " $FULL_URL:$BUILD_TAG" + } > docker_run_block.txt + + DOCKERHUB_LINK_CONTENT="" + if [[ "${{ steps.prep.outputs.push_targets }}" == *"dockerhub"* ]]; then + DH_USER="${{ secrets.DOCKERHUB_USERNAME }}" + DOCKERHUB_LINK_CONTENT="[![Docker Hub](https://img.shields.io/badge/docker-hub-blue?logo=docker&logoColor=white)](https://hub.docker.com/r/${DH_USER}/${REPO_PURE})" + fi + + process_template() { + local template=$1; local output=$2 + [ ! -f "$template" ] && return + cp "$template" "$output" + + export REPO_PURE FULL_URL BUILD_TAG BASE_IMAGE ARM_STATUS CURRENT_TIME \ + HISTORY_CONTENT DOCKERHUB_LINK_CONTENT ENV_BLOCK_CONTENT \ + PORTS_BLOCK_CONTENT VOL_BLOCK_CONTENT DESCRIPTION + + python3 -c ' import os, sys - + output = sys.argv[1] - + with open(output, "r", encoding="utf-8") as f: - content = f.read() - + content = f.read() + content = content.replace("__REPO_NAME__", os.environ.get("REPO_PURE", "")) content = content.replace("__FULL_URL__", os.environ.get("FULL_URL", "")) content = content.replace("__BUILD_TAG__", os.environ.get("BUILD_TAG", "")) @@ -357,15 +355,17 @@ jobs: with open(output, "w", encoding="utf-8") as f: f.write(content) ' "$output" - } + } + + process_template "docker-compose.template" "docker-compose.yml" + process_template "README.template" "README.md" - process_template "docker-compose.template" "docker-compose.yml" - process_template "README.template" "README.md" - - echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV - echo "DESCRIPTION<> $GITHUB_ENV - echo -e "$DESCRIPTION" >> $GITHUB_ENV - echo "EOF" >> $GITHUB_ENV + echo "FINAL_MSG=$COMMIT_MSG" >> $GITHUB_ENV + { + echo "DESCRIPTION<> $GITHUB_ENV - name: Push README to Docker Hub if: steps.check_changes.outputs.should_build == 'true' && contains(steps.prep.outputs.push_targets, 'dockerhub')