jwright/bztmon-site
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(bump-digest): bound PR-open curl + make it non-fatal so runs go green

Browse Source 
The branch push is the deploy artifact; opening the PR is best-effort.
Previously a no-timeout curl to the private Gitea API tripped split-horizon
DNS from the runner, hanging the step ~10min then failing the whole run.
Now: --connect-timeout 10 --max-time 30, failure is logged non-fatally, exit 0.
This commit is contained in:
Jonathon Wright
2026-06-17 23:02:27 +10:00
parent 9919e20850
commit 2592b5680b
1 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/bump-digest.sh
+19 -9
View File
@@ -48,18 +48,28 @@ git config user.email "ci@bztmon.com"
git commit -am "bztmon-site: deploy ${TAG}" git commit -am "bztmon-site: deploy ${TAG}"
git push origin "${BRANCH}" git push origin "${BRANCH}"
# --- PR (never auto-merge) ------------------------------------------------- # --- PR (never auto-merge; BEST-EFFORT) ------------------------------------
# Default (least-privilege): just push the branch — Jonathon opens+merges the PR (the approval # The branch push above IS the deploy artifact — the rollout is ready regardless of the PR.
# gate + the ArgoCD trigger). Only auto-open a PR if a GITEA_TOKEN is provided. # Opening the PR is pure convenience and must NEVER hang or fail the job. (It used to: a
# NB: use a dedicated var name (NOT GITEA_TOKEN) — Gitea auto-injects GITEA_TOKEN into every job, # no-timeout curl to the PRIVATE Gitea API tripped split-horizon DNS from the runner and hung
# which would wrongly trigger this against the private instance. Default path just pushes the branch. # the step for ~10min before failing the whole run.) So: bound the curl, treat any failure as
# non-fatal, and always exit 0 — a green run means "image built + bump branch pushed".
# NB: dedicated var name (NOT GITEA_TOKEN) — Gitea auto-injects GITEA_TOKEN into every job.
PR_URL="https://gitea.bztmon.org/jwrong96/home-ops/compare/main...${BRANCH}"
if [[ -n "${HOMEOPS_PR_TOKEN:-}" ]]; then if [[ -n "${HOMEOPS_PR_TOKEN:-}" ]]; then
curl -fsSL -X POST "${GITEA_API}/repos/jwrong96/home-ops/pulls" \ if curl -fsS --connect-timeout 10 --max-time 30 -X POST "${GITEA_API}/repos/jwrong96/home-ops/pulls" \
-H "Authorization: token ${HOMEOPS_PR_TOKEN}" \ -H "Authorization: token ${HOMEOPS_PR_TOKEN}" \
-H "Content-Type: application/json" \ -H "Content-Type: application/json" \
-d "{\"head\":\"${BRANCH}\",\"base\":\"main\",\"title\":\"bztmon-site: deploy ${TAG}\",\"body\":\"Automated digest bump.\\n\\nImage: \`${REF}\`\\n\\nMerge to roll out via ArgoCD.\"}" -d "{\"head\":\"${BRANCH}\",\"base\":\"main\",\"title\":\"bztmon-site: deploy ${TAG}\",\"body\":\"Automated digest bump.\\n\\nImage: \`${REF}\`\\n\\nMerge to roll out via ArgoCD.\"}"; then
echo ">> PR opened for ${BRANCH}" echo ">> PR opened for ${BRANCH}"
else else
echo ">> branch ${BRANCH} pushed (image ${REF})." echo ">> WARNING: PR auto-open failed/unreachable (non-fatal) — branch is pushed, open it manually:"
echo ">> open the PR to roll out: https://gitea.bztmon.org/jwrong96/home-ops/compare/main...${BRANCH}" echo ">> ${PR_URL}"
fi fi
else
echo ">> branch ${BRANCH} pushed (image ${REF})."
echo ">> open the PR to roll out: ${PR_URL}"
fi
# The deploy artifact (the bump branch) is pushed — the optional PR step never reds the run.
exit 0