mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0aab8d35ade7ac5c4bd6669c73c403e743a673a4
pikasTech-unidesk/.agents/skills/unidesk-cicd/references/gitea-pac.md
T

12 KiB
Raw Blame History

Gitea + Pipelines-as-Code

Gitea/Pipelines-as-Code migrated CI/CD uses one formal path:

GitHub PR merge -> GitHub webhook bridge -> Gitea controlled mirror and immutable snapshot refs -> Gitea Repository webhook -> Pipelines-as-Code -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime

GitHub remains the upstream write authority. A delivery should be triggered by merging the GitHub PR into the consumer's YAML-declared source branch, then observing the target node's Gitea mirror, PaC, Tekton, GitOps, Argo and runtime status. Do not replace this with Gitea Actions, act_runner, branch-follower, host worktree, direct GitHub-in-Pipeline, direct Gitea pushes, manual PipelineRun creation, trigger-current, webhook-test, or custom script fallback. Gitea Actions material under config/cicd-gitea-actions-poc.yaml is archived read-only POC context only; webhook-test is only a connectivity diagnostic.

Source Of Truth

  • Gitea source authority, GitHub webhook bridge, public exposure and source snapshots: config/platform-infra/gitea.yaml.
  • PaC controller, Repository CRs, consumer parameters, Tekton pipeline names and Argo applications: config/platform-infra/pipelines-as-code.yaml.
  • Historical snapshot prefixes containing gitea-actions are retained only for existing refs. They do not mean Gitea Actions is the active trigger architecture.
  • Node-level status for these consumers is bun scripts/cli.ts cicd status --node <NODE>. Consumer drill-down is platform-infra pipelines-as-code status|history|closeout --target <NODE> --consumer <id>.
  • Multi-node PaC consumers that share a GitHub upstream must not share a webhook bridge URL. Each target node declares its own GitHub webhook public path and FRP remote port in config/platform-infra/gitea.yaml#targets[].webhookSync, then platform-infra gitea apply --target <NODE> --confirm renders the node-local bridge, FRPC proxy and PK01 Caddy path.
  • PaC Repository CR spec.url matches the URL in Gitea webhook payloads. Keep config/platform-infra/pipelines-as-code.yaml#repositories[].url on the public Gitea repository URL, and keep k8s-internal service URLs only in cloneUrl or params.git_read_url; otherwise PaC logs cannot find a repository match and no PipelineRun is created.
  • Repositories shared by JD01 and NC01 must pass a target-specific node Repository param, and each .tekton PipelineRun must filter on that param with pipelinesascode.tekton.dev/on-cel-expression. A push for one target must not create the other target's PipelineRun in the same target cluster.

PaC 源码侧制品同步

当 owning Pipeline 与消费仓 .tekton 内联 pipelineSpec 或远程 Pipeline 文件存在漂移时，统一使用以下入口：

bun scripts/cli.ts platform-infra pipelines-as-code source-artifact plan --target <NODE> --consumer <id> --source-worktree <absolute-path>
bun scripts/cli.ts platform-infra pipelines-as-code source-artifact check --target <NODE> --consumer <id> --source-worktree <absolute-path>
bun scripts/cli.ts platform-infra pipelines-as-code source-artifact write --target <NODE> --consumer <id> --source-worktree <absolute-path> --confirm
bun scripts/cli.ts platform-infra pipelines-as-code source-artifact status --target <NODE> --consumer <id> --source-worktree <absolute-path> [--source-commit <full-sha>]
bun scripts/cli.ts platform-infra pipelines-as-code source-artifact verify-runtime --target <NODE> --consumer <id> --source-worktree <absolute-path> --source-commit <full-sha>
  • config/platform-infra/pipelines-as-code.yaml#consumers[].sourceArtifact 是生成职责的声明入口；未声明的 consumer 必须稳定拒绝，模板不得替它发明 owner。
  • desired 只来自 owning YAML 与共享 domain renderer；live Pipeline 和 PipelineRun 只能作为只读诊断证据，禁止从运行面反向导出 desired 或源码制品。
  • plan、check、write 只比较或更新显式消费仓 worktree，不访问运行面；worktree 必须是绝对路径、Git 根目录，并与声明仓库的精确 remote identity 一致。
  • write 先完成全部路径、内容和 renderer 合同校验，再通过同目录临时文件与 rename 更新；连续执行必须无差异。
  • status 是非门禁诊断，允许不传 commit；verify-runtime 必须传完整四十位 --source-commit，并按 PaC/source-commit label 或 annotation 精确筛选 PipelineRun，不得按 prefix 直接取全局 latest。
  • 同一 source commit 因 webhook 重投或 PaC retry 产生多个 PipelineRun 时，只在完整内联 spec 与 provenance 全部一致时确定性选择最新一条并披露候选数；存在冲突必须 fail-closed。
  • runtime observer 必须区分对象 NotFound、transport/RBAC/命令不可用和 spec drift；完整大 spec 通过受控临时文件传入目标侧原生 observer，不得放入 shell argv 或环境变量。
  • 完整 spec 比较只移除六类已验证的 Tekton admission default，并限定在裸 Pipeline spec、完整 Pipeline 或 PipelineRun pipelineSpec 三个明确根；其他同名字段不得过滤。
  • HWLAB source artifact 必须保留正式 postprocess、verify 和六个 Kafka refresh 环境合同；AgentRun source artifact 必须保留 owning Pipeline 的完整 RBAC、参数和 manager 环境合同。

Coverage Matrix

Consumer Source PaC namespace Pipeline Argo application Status
agentrun-jd01-v02 pikasTech/agentrun@v0.2 agentrun-ci agentrun-jd01-v02-ci-image-publish agentrun-jd01-v02 platform-infra pipelines-as-code closeout --target JD01 --consumer agentrun-jd01-v02 --source-commit <sha> --wait
sentinel-jd01-v03 pikasTech/unidesk@master devops-infra hwlab-web-probe-sentinel-jd01-pac hwlab-web-probe-sentinel-jd01 platform-infra pipelines-as-code closeout --target JD01 --consumer sentinel-jd01-v03 --source-commit <sha> --wait
hwlab-jd01-v03 pikasTech/HWLAB@v0.3 hwlab-ci hwlab-jd01-v03-ci-image-publish hwlab-node-v03 platform-infra pipelines-as-code closeout --target JD01 --consumer hwlab-jd01-v03 --source-commit <sha> --wait
agentrun-nc01-v02 pikasTech/agentrun@v0.2 agentrun-ci agentrun-nc01-v02-ci-image-publish agentrun-nc01-v02 platform-infra pipelines-as-code closeout --target NC01 --consumer agentrun-nc01-v02 --source-commit <sha> --wait
sentinel-nc01-v03 pikasTech/unidesk@master devops-infra hwlab-web-probe-sentinel-nc01-pac hwlab-web-probe-sentinel-nc01 platform-infra pipelines-as-code closeout --target NC01 --consumer sentinel-nc01-v03 --source-commit <sha> --wait
hwlab-nc01-v03 pikasTech/HWLAB@v0.3 hwlab-ci hwlab-nc01-v03-ci-image-publish hwlab-node-v03 platform-infra pipelines-as-code closeout --target NC01 --consumer hwlab-nc01-v03 --source-commit <sha> --wait

Use bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --limit 10 for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on the target node, aggregate on the target side, and print READ_ERRORS. history --id <pipelinerun> must still apply the consumer's actual PipelineRun prefix or Tekton pipeline match, so a PipelineRun in a shared namespace cannot be attributed to both JD01 and NC01 consumers.

Closeout Order

  1. bun scripts/cli.ts platform-infra gitea mirror status --target <NODE>
  2. bun scripts/cli.ts platform-infra gitea mirror webhook status --target <NODE>
  3. bun scripts/cli.ts platform-infra pipelines-as-code closeout --target <NODE> --consumer <id> --source-commit <sha> --wait
  4. bun scripts/cli.ts platform-infra pipelines-as-code status --target <NODE> --consumer <id>
  5. bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --consumer <id> --limit 10
  6. For ambiguous rows, drill into the PipelineRun with bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --id <pipelinerun>.

closeout is the common formal entry for all migrated JD01 consumers. It waits only for PaC/Tekton/GitOps/Argo/runtime observation from live target-side summaries and does not trigger legacy publish paths. Consumer-specific debug commands such as Web sentinel publish-current are recovery/test steps only and must not be shown as the normal next action for formal delivery.

GitHub webhook delivery 202 only means the bridge accepted the event. If platform-infra gitea mirror webhook status --target <NODE> shows STALE=true, treat the bridge event as stale and run the row's REPAIR command; the repair path is still the controlled platform-infra gitea mirror sync --target <NODE> --repo <key> --confirm entry and must not be replaced with a direct Gitea push.

The GitHub -> Gitea bridge must use YAML-declared bounded retry for its asynchronous git fetch and Gitea push worker. Retry ownership is config/platform-infra/gitea.yaml#sourceAuthority.webhookSync.bridge.retry; webhook status should show the active retry shape in the default summary. A GitHub delivery returning 202 is not enough to close a rollout or issue unless Gitea branch, snapshot ref and the latest bridge event are also aligned to GitHub head.

Do not use cicd branch-follower status to decide whether the three migrated JD01 consumers are current. It is historical/migration-only and may contain stale state from before PaC cutover.

For migrated sentinel CI/CD half-state triage, the PaC status command owns the source/registry/GitOps/Argo/runtime diagnosis. It must classify registry-missing, GitOps-missing, Argo-pending and runtime-mismatch states from target-side short probes, using YAML-declared probe endpoints such as registry_probe_base; do not reintroduce old control-plane status as the primary architecture or use registry manifest HEAD as the readiness check.

Reuse Interpretation

  • AgentRun IMAGE_STATUS=reused means the image build was skipped or registry artifact was reused for the same env identity.
  • Sentinel ENV_REUSE=hit means dependency reuse was available; cache=hit is separate BuildKit evidence.
  • HWLAB skipped,skip=<n> means service-level artifact planning skipped reusable builds; inspect the PipelineRun detail when deciding which service changed.

UniDesk Host Runtime Change Filtering

The unidesk-host consumer separates source observation from runtime delivery. config/unidesk-host-k8s.yaml#delivery.changeDetection.runtimePaths is the only editable list of source paths that can change the selected runtime, while delivery.gitops.releaseStatePath points to the generated GitOps release state used as the comparison baseline.

  • build: at least one declared runtime path changed, or no trustworthy prior release state is available. Build the image, update the manifest and release state, then let Argo converge.
  • skip: the source commit advanced but no declared runtime path changed. Do not build an image, do not modify the GitOps branch, and do not cause an Argo rollout; retain the prior runtime source commit and digest as provenance.
  • disabled: delivery.enabled=false. Remove the generated manifest and release state; this is service retirement, not a synonym for skip.

CLI, documentation, issue metadata and other files outside runtimePaths must resolve to IMAGE_STATUS=skipped. A successful skip still has a short PaC PipelineRun as source-observation evidence, but image build and GitOps publication are skipped. status and closeout must validate the retained digest, GitOps revision, Argo state, runtime readiness and health without requiring the runtime source commit to equal the newer non-runtime source commit.

Missing reuse text is not proof of a failed reuse path. Check the consumer type and PipelineRun detail first.

Reference in New Issue View Git Blame Copy Permalink