dc90e7404b
All checks were successful
Docker / build-and-push (push) Successful in 46s
Was a Vite build-time env var, requiring a second copy of a non-secret value as a separate Gitea CI secret alongside the one already in .env for the api service. Client id isn't sensitive (public in every Spotify authorize URL), so it doesn't need build-time baking at all — now fetched once from a new GET /api/config on the already-running api server, cached client-side after the first call. Collapses config back down to the one place it already lived (the deploy host's .env / docker-compose environment), removes the CI build-arg and its secret entirely. Verified end-to-end: /api/config returns the real client id, and a live guest-login click correctly carries it through into the actual Spotify authorize URL (decoded and checked, not just assumed from the code).
69 lines
2.1 KiB
YAML
69 lines
2.1 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Derive image name and tags
|
|
id: meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
SERVER_URL="${GITHUB_SERVER_URL:-${GITEA_SERVER_URL:-}}"
|
|
REPO="${GITHUB_REPOSITORY:-${GITEA_REPOSITORY:-}}"
|
|
SHA="${GITHUB_SHA:-${GITEA_SHA:-}}"
|
|
|
|
if [[ -z "${SERVER_URL}" || -z "${REPO}" || -z "${SHA}" ]]; then
|
|
echo "Missing SERVER_URL/REPO/SHA env vars." >&2
|
|
exit 1
|
|
fi
|
|
|
|
HOST=$(echo "${SERVER_URL}" | sed 's|https://||;s|http://||')
|
|
IMAGE=$(echo "${HOST}/${REPO}" | tr '[:upper:]' '[:lower:]')
|
|
SHORT_SHA=$(echo "${SHA}" | cut -c1-7)
|
|
|
|
echo "host=${HOST}" >> "$GITHUB_OUTPUT"
|
|
echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
|
|
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Log in to Gitea container registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ steps.meta.outputs.host }}
|
|
username: ${{ github.actor }}
|
|
# Create a Gitea PAT with packages:write scope and add it as a
|
|
# repository secret named TKNTKN (Settings → Secrets)
|
|
password: ${{ secrets.TKNTKN }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push (web)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: Dockerfile
|
|
push: true
|
|
tags: |
|
|
${{ steps.meta.outputs.image }}:latest
|
|
${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.short_sha }}
|
|
|
|
- name: Build and push (api)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: Dockerfile.api
|
|
push: true
|
|
tags: |
|
|
${{ steps.meta.outputs.image }}-api:latest
|
|
${{ steps.meta.outputs.image }}-api:${{ steps.meta.outputs.short_sha }}
|