Beeper pipeline

Author: hifi

.github/workflows/deploy.yaml

@@ -0,0 +1,48 @@
+name: Build and Deploy
+
+on:
+  push:
+
+env:
+  CI_REGISTRY_IMAGE: "${{ secrets.CI_REGISTRY }}/litestream"
+
+jobs:
+  build-docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ secrets.CI_REGISTRY }}
+          username: ${{ secrets.CI_REGISTRY_USER }}
+          password: ${{ secrets.CI_REGISTRY_PASSWORD }}
+
+      - name: Docker Build
+        uses: docker/build-push-action@v2
+        with:
+          cache-from: ${{ env.CI_REGISTRY_IMAGE }}:latest
+          pull: true
+          file: Dockerfile
+          build-args: LITESTREAM_VERSION=${{ github.sha }}
+          tags: ${{ env.CI_REGISTRY_IMAGE }}:${{ github.sha }}
+          push: true
+
+  deploy-docker:
+    runs-on: ubuntu-latest
+    needs:
+      - build-docker
+    if: github.ref == 'refs/heads/beeper'
+    steps:
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ secrets.CI_REGISTRY }}
+          username: ${{ secrets.CI_REGISTRY_USER }}
+          password: ${{ secrets.CI_REGISTRY_PASSWORD }}
+
+      - uses: beeper/docker-retag-push-latest@main
+        with:
+          image: ${{ env.CI_REGISTRY_IMAGE }}

.github/workflows/release.docker.yml

@@ -9,8 +9,23 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 	--mount=type=cache,target=/go/pkg \
 	go build -ldflags "-s -w -X 'main.Version=${LITESTREAM_VERSION}' -extldflags '-static'" -tags osusergo,netgo,sqlite_omit_load_extension -o /usr/local/bin/litestream ./cmd/litestream
 
+# to make copy a single layer later
+COPY etc/sqlite3 etc/aws-k8s-sa-provider /usr/local/bin/
 
 FROM alpine:3.17.2
-COPY --from=builder /usr/local/bin/litestream /usr/local/bin/litestream
+ENV AWS_SDK_LOAD_CONFIG=1 \
+    AWS_CONFIG_FILE=/etc/aws-config
+
+# for debugging and cleanup
+RUN apk add --no-cache sqlite curl aws-cli && \
+    mkdir /root/.aws
+
+COPY etc/aws-config /etc/
+COPY --from=builder \
+     /usr/local/bin/litestream \
+     /usr/local/bin/sqlite3 \
+     /usr/local/bin/aws-k8s-sa-provider \
+     /usr/local/bin/
+
 ENTRYPOINT ["/usr/local/bin/litestream"]
 CMD []

.github/workflows/release.linux.yml

@@ -0,0 +1,2 @@
+[default]
+credential_process = /usr/local/bin/aws-k8s-sa-provider

Dockerfile

@@ -0,0 +1,13 @@
+#!/bin/sh
+DATEFMT=%Y-%m-%dT%H:%M:%SZ
+[ -z "$SERVICE_ACCOUNT_TOKEN" ] && exit 1
+[ -f "$SERVICE_ACCOUNT_TOKEN" ] || exit 1
+cat << EOF
+{
+    "Version": 1,
+    "AccessKeyId": "aws-k8s-sa-provider@$(date +$DATEFMT)",
+    "SecretAccessKey": "n/a",
+    "SessionToken": "$(cat $SERVICE_ACCOUNT_TOKEN)",
+    "Expiration": "$(date -ud @$(($(date -u +%s) + 300)) +$DATEFMT)"
+}
+EOF

etc/aws-config

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/bin/sqlite3 -cmd "PRAGMA foreign_keys=ON; PRAGMA journal_mode=WAL; PRAGMA wal_autocheckpoint=0; PRAGMA busy_timeout=5000;" "$@"