377369a5be
- Add gov-portals-runtime.v1.json + schema; jq gate in validate-config-files - Python: parity-deploy-targets, parity-operational-template (IP strict, hostname WARN), parity-gov-portals-runtime; validate-vm-routing-parity.sh wrapper - check-gov-portal-workflow-canonical-strings.sh for monorepo Pattern A - PORTAL_WORKFLOW_PARITY.md; template headers; repos README; operator checklist secrets - report-gitea-cd-parity runs full VM routing parity; task doc marked complete - GOV_PORTALS_XOM_DEV + GITEA_GOV + MASTER_INDEX + matrix doc cross-links Co-authored-by: Cursor <cursoragent@cursor.com>
3.3 KiB
3.3 KiB
Gitea CD/CI — operator checklist
Use this after changing phoenix-deploy-api/deploy-targets.json or adding workflows under config/gitea-workflow-templates/.
One-time per application repo (on Gitea)
- Actions enabled for the org/repo (Gitea settings).
- Secrets on that repo (not only global):
PHOENIX_DEPLOY_URL— full URL forPOST(same shape asd-bis/proxmoxworkflows use), typicallyhttp://<dev-vm>:4001/api/deployor HTTPS equivalent.PHOENIX_DEPLOY_TOKEN— bearer token accepted by Phoenix deploy API.GITEA_TOKEN— used by Pattern B single-file portal templates underconfig/gitea-workflow-templates/repos/*-portal-ci-and-live.ymlwhen cloning the monorepo withoauth2:${GITEA_TOKEN}@…(read-only is enough).GOV_PORTALS_TOKEN— used by Pattern A split workflows inGov_Web_Portals/gov-portals-monoreposubmodules (GOV_PORTALS_TOKEN+http.extraHeader=Authorization: token …); same minimum scope: readGov_Web_Portals/gov-portals-monorepoon Gitea.
- Workflow file in the repo: copy from
config/gitea-workflow-templates/repos/README.mdor use the repo’s existing.gitea/workflows/*.yml. Pattern A vs B:config/gitea-workflow-templates/PORTAL_WORKFLOW_PARITY.md.
Secrets hygiene (Gitea-only, least privilege)
| Secret | Typical scope | Never |
|---|---|---|
GITEA_TOKEN / GOV_PORTALS_TOKEN |
Read Gov_Web_Portals/gov-portals-monorepo (and overlay subtree) for CI |
Commit into repo YAML, .git/config remote URLs, or logs |
PHOENIX_DEPLOY_TOKEN |
POST Phoenix deploy API only |
Reuse as full Gitea admin token |
NPM_PASSWORD (operator) |
NPMplus API on LAN | Same token as Gitea |
Rotate any token that was ever pasted into a git remote URL. Prefer source scripts/lib/load-project-env.sh and git -c "http.extraHeader=Authorization: token …" for one-off pushes (see GITEA_GOV_PORTALS_LIVE_SOURCE_OF_TRUTH.md).
Phoenix deploy host (LAN)
git pullproxmox sodeploy-targets.jsonandscripts/deployment/phoenix-deploy-*.shmatch Gitead-bis/proxmoxmaster/main.- Restart or reinstall phoenix-deploy-api if you manage it via systemd (see
phoenix-deploy-api/scripts/install-systemd.sh). GITEA_TOKENon that host must allow archive fetch for repos you deploy.- Optional: set
PHOENIX_DEPLOY_VERIFY_SHA_ON_BRANCH=1on the Phoenix deploy API host soPOST /api/deployrequests that includeshamust resolve to a commit on the declaredbranch(seephoenix-deploy-api/README.md).
Verify locally (proxmox clone)
bash scripts/validation/validate-phoenix-deploy-targets.sh phoenix-deploy-api/deploy-targets.json
bash scripts/verify/report-gitea-cd-parity.sh