prod docker change (#221)

Reviewed-on: graham/towerops-web#221

.forgejo/workflows/production.yaml

@@ -79,85 +79,71 @@ jobs:
       - name: Run tests
         run: mix test
 
-  build-and-deploy:
-    name: Build and Deploy to Production
+  build-image:
+    name: Build and Push Docker Image
     runs-on: ubuntu-22.04
     needs: [test-exunit]
+    container:
+      image: gcr.io/kaniko-project/executor:debug
+      options: --entrypoint=""
+    outputs:
+      image_tag: ${{ steps.tag.outputs.tag }}
 
     steps:
       - name: Checkout code
         uses: https://github.com/actions/checkout@v4
-        with:
-          fetch-depth: 0  # Need full history for git operations
-
-      - name: Start Docker daemon
-        run: |
-          # Start Docker daemon to run kaniko container
-          if ! docker info > /dev/null 2>&1; then
-            sudo dockerd \
-              --iptables=false \
-              --ip6tables=false \
-              --bridge=none \
-              --storage-driver=vfs &
-            # Wait for Docker to be ready
-            timeout 30 bash -c 'until docker info > /dev/null 2>&1; do sleep 1; done'
-          fi
 
       - name: Generate image tag
         id: tag
         run: |
           BRANCH=${GITHUB_REF#refs/heads/}
           TIMESTAMP=$(date +%s)
-          SHORT_SHA=$(git rev-parse --short=7 HEAD)
+          SHORT_SHA=$(git rev-parse --short=7 HEAD | cut -c1-7)
           TAG="${BRANCH}-${TIMESTAMP}-${SHORT_SHA}"
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Log in to Container Registry
-        uses: https://github.com/docker/login-action@v3
-        with:
-          registry: ${{ secrets.REGISTRY_URL }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build and push Docker image
-        env:
-          DOCKER_BUILDKIT: 0
+      - name: Build and push with Kaniko
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
+          REGISTRY_AUTH=$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" | base64 -w 0)
 
-          # Build image without BuildKit (required for unprivileged runner)
-          docker build \
-            --build-arg MIX_ENV=prod \
-            --file k8s/Dockerfile \
-            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
-            .
+          mkdir -p /kaniko/.docker
+          echo "{\"auths\":{\"${{ secrets.REGISTRY_URL }}\":{\"auth\":\"${REGISTRY_AUTH}\"}}}" \
+            > /kaniko/.docker/config.json
 
-          # Push both tags
-          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
-          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          /kaniko/executor \
+            --context="${GITHUB_WORKSPACE}" \
+            --dockerfile="${GITHUB_WORKSPACE}/k8s/Dockerfile" \
+            --build-arg="MIX_ENV=prod" \
+            --destination="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+            --destination="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+
+  update-manifest:
+    name: Update Deployment Manifest
+    runs-on: ubuntu-22.04
+    needs: [build-image]
+
+    steps:
+      - name: Checkout code
+        uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Update deployment manifest
         run: |
-          IMAGE_TAG="${{ steps.tag.outputs.tag }}"
+          IMAGE_TAG="${{ needs.build-image.outputs.image_tag }}"
 
-          # Configure git
           git config user.name "Forgejo Actions"
           git config user.email "actions@git.mcintire.me"
 
-          # Fetch and checkout production branch
           git fetch origin production
           git checkout production
           git pull origin production --rebase
-
-          # Merge main branch changes
           git merge origin/main --no-edit
 
-          # Update deployment manifest
-          sed -i "s|image: ${REGISTRY}/${IMAGE_NAME}:.*|image: ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}|g" k8s/deployment.yaml
+          sed -i "s|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:.*|image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}|g" k8s/deployment.yaml
 
-          # Commit and push if there are changes
           git add k8s/deployment.yaml
           if git diff --staged --quiet; then
             echo "No changes to deployment.yaml"
@@ -170,7 +156,7 @@ jobs:
         run: |
           echo "### ✅ Production Deployment Complete" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Image:** \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "**Image:** \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-image.outputs.image_tag }}\`" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "FluxCD will automatically apply the changes to the cluster." >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY

.forgejo/workflows/staging.yaml

@@ -4,9 +4,6 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-env:
-  DOCKER_BUILDKIT: 1
-  DOCKER_TLS_CERTDIR: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}