From 481ac166d0ff698c9b69805929985de2afd9ccd2 Mon Sep 17 00:00:00 2001 From: Lee Chapman Date: Sat, 10 Jan 2026 16:50:37 -0800 Subject: [PATCH 1/4] fix: use force push to override GitLab branch - Remove git pull step that was causing merge conflicts - Add --force flag to git push to handle branch divergence - This allows GitHub to override GitLab branch when they diverge --- .github/workflows/tests.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 690c7a0..6164536 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -81,5 +81,4 @@ jobs: git remote add gitlab https://gitlab.com/dk-raas/dkai/high-command/high-command-api.git git config credential.helper '!f() { echo "username=oauth2"; echo "password=${GITLAB_TOKEN}"; }; f' git fetch gitlab main - git pull gitlab main --no-edit - git push gitlab HEAD:main + git push gitlab HEAD:main --force From 322dd1f8cab6b85e9257f13b194c2260c89c4118 Mon Sep 17 00:00:00 2001 From: Lee Chapman Date: Sat, 10 Jan 2026 18:02:09 -0800 Subject: [PATCH 2/4] feat: add build stage and fix docker login - Add separate build stage with language-specific images (Go/Python/Node) - Fix docker login to use --username flag (per GitLab docs) - Build artifacts are passed to docker build stage via dependencies - Add DOCKER_TLS_CERTDIR for Docker-in-Docker support - Run 'make build' before docker build to prepare app assets --- .gitlab-ci.yml | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 673ffaf..2d9a3a2 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,18 +1,40 @@ stages: - build + - docker variables: HARBOR_REGISTRY: harbor.dataknife.net HARBOR_PROJECT: library IMAGE_NAME: high-command-api + DOCKER_TLS_CERTDIR: "/certs" -docker-build: +build: stage: build + image: python:3.14-slim + script: + - apt-get update && apt-get install -y --no-install-recommends make git + - make build + artifacts: + paths: + - dist/ + - build/ + - *.egg-info/ + expire_in: 1 hour + rules: + - if: '$CI_COMMIT_BRANCH == "main"' + - if: '$CI_COMMIT_TAG' + tags: + - docker + +docker-build: + stage: docker image: docker:latest services: - docker:dind + dependencies: + - build before_script: - - echo "$HARBOR_PASSWORD" | docker login -u "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY + - echo "$HARBOR_PASSWORD" | docker login --username "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY script: - | # Build image once From ebda5fe78023f9c23b4dd7f8d06a255f8c5846e0 Mon Sep 17 00:00:00 2001 From: Lee Chapman Date: Sat, 10 Jan 2026 23:07:36 -0800 Subject: [PATCH 3/4] Use DOCKER_AUTH_CONFIG group variable for Harbor authentication - Remove before_script auth generation code - Rely on DOCKER_AUTH_CONFIG GitLab group variable - Matches working pattern from proxmox-ve-mcp --- .gitlab-ci.yml | 43 +++++++++++++++++++------------------------ 1 file changed, 19 insertions(+), 24 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 2d9a3a2..9b09fc1 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -3,10 +3,7 @@ stages: - docker variables: - HARBOR_REGISTRY: harbor.dataknife.net - HARBOR_PROJECT: library IMAGE_NAME: high-command-api - DOCKER_TLS_CERTDIR: "/certs" build: stage: build @@ -24,38 +21,36 @@ build: - if: '$CI_COMMIT_BRANCH == "main"' - if: '$CI_COMMIT_TAG' tags: - - docker + - kubernetes -docker-build: +publish: stage: docker - image: docker:latest - services: - - docker:dind + image: + name: moby/buildkit:rootless + entrypoint: [""] dependencies: - build - before_script: - - echo "$HARBOR_PASSWORD" | docker login --username "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY script: - | - # Build image once - docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest . + # Use commit SHA if available, otherwise fall back to pipeline ID + IMAGE_TAG="${CI_COMMIT_SHORT_SHA:-$CI_PIPELINE_ID}" - # Tag with commit SHA - docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \ - $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA + # Build and push images with BuildKit rootless (multiple outputs for multiple tags) + OUTPUT_FLAGS="--output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest,push=true" + OUTPUT_FLAGS="$OUTPUT_FLAGS --output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$IMAGE_TAG,push=true" - # Push images - docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest - docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA - - # Tag with version if tag exists + # Add version tag if tag exists if [ -n "$CI_COMMIT_TAG" ]; then - docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \ - $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG - docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG + OUTPUT_FLAGS="$OUTPUT_FLAGS --output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG,push=true" fi + + buildctl-daemonless.sh build \ + --frontend dockerfile.v0 \ + --local context=. \ + --local dockerfile=. \ + $OUTPUT_FLAGS rules: - if: '$CI_COMMIT_BRANCH == "main"' - if: '$CI_COMMIT_TAG' tags: - - docker + - kubernetes From f5dd715117a4497afa6d6eb3ff097a463f4b9e07 Mon Sep 17 00:00:00 2001 From: Lee Chapman Date: Sun, 11 Jan 2026 01:39:33 -0800 Subject: [PATCH 4/4] ci: use GitLab CLI image for release stage The release: keyword requires glab CLI which is provided by registry.gitlab.com/gitlab-org/cli:latest image --- .gitlab-ci.yml | 160 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 157 insertions(+), 3 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 9b09fc1..7ce9396 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,13 +1,17 @@ stages: - build - docker + - release + - deploy variables: IMAGE_NAME: high-command-api + K8S_NAMESPACE: high-command + DEPLOYMENT_NAME: high-command-api build: stage: build - image: python:3.14-slim + image: harbor.dataknife.net/dockerhub/library/python:3.14-slim script: - apt-get update && apt-get install -y --no-install-recommends make git - make build @@ -50,7 +54,157 @@ publish: --local dockerfile=. \ $OUTPUT_FLAGS rules: - - if: '$CI_COMMIT_BRANCH == "main"' - - if: '$CI_COMMIT_TAG' + - if: '$CI_COMMIT_TAG' # Run on any git tag + tags: + - kubernetes + +release: + stage: release + image: registry.gitlab.com/gitlab-org/cli:latest + rules: + - if: $CI_COMMIT_TAG + when: never # Do not run this job when a tag is created manually + - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH # Run this job when commits are pushed or merged to the default branch + script: + - | + echo "Creating release for commit $CI_COMMIT_SHORT_SHA" + echo "Release will create tag automatically" + release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties + tag_name: 'v0.$CI_PIPELINE_IID' # The version is incremented per pipeline + description: 'Release v0.$CI_PIPELINE_IID' + ref: '$CI_COMMIT_SHA' # The tag is created from the pipeline SHA + tags: + - kubernetes + +deploy: + stage: deploy + image: harbor.dataknife.net/dockerhub/library/bitnami/kubectl:latest + dependencies: + - publish + variables: + KUBECONFIG: /tmp/kubeconfig + before_script: + - | + # Write kubeconfig from GitLab variable + echo "$PRD_APPS_KUBECONFIG" | base64 -d > $KUBECONFIG + chmod 600 $KUBECONFIG + kubectl config use-context prd-apps || kubectl config get-contexts | head -5 + script: + - | + # Use semantic version tag if available, otherwise use commit SHA + if [ -n "$CI_COMMIT_TAG" ] && [[ "$CI_COMMIT_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + IMAGE_VERSION="$CI_COMMIT_TAG" + else + IMAGE_VERSION="${CI_COMMIT_SHORT_SHA:-$CI_PIPELINE_ID}" + fi + + FULL_IMAGE="$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$IMAGE_VERSION" + + echo "Deploying $DEPLOYMENT_NAME to prd-apps cluster" + echo "Image: $FULL_IMAGE" + echo "Namespace: $K8S_NAMESPACE" + + # Create namespace if it doesn't exist + kubectl create namespace $K8S_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - + + # Determine current deployment color (blue or green) + CURRENT_COLOR=$(kubectl get deployment $DEPLOYMENT_NAME -n $K8S_NAMESPACE -o jsonpath='{.spec.template.metadata.labels.deployment-color}' 2>/dev/null || echo "blue") + + if [ "$CURRENT_COLOR" = "blue" ]; then + NEW_COLOR="green" + else + NEW_COLOR="blue" + fi + + echo "Current deployment: $CURRENT_COLOR" + echo "New deployment: $NEW_COLOR" + + # Create green/blue deployment + kubectl apply -f - </dev/null | grep -q ${DEPLOYMENT_NAME}-${CURRENT_COLOR}; then + echo "Scaling down old deployment ${DEPLOYMENT_NAME}-${CURRENT_COLOR}..." + kubectl scale deployment ${DEPLOYMENT_NAME}-${CURRENT_COLOR} -n $K8S_NAMESPACE --replicas=0 + fi + + echo "✓ Deployment complete. ${DEPLOYMENT_NAME}-${NEW_COLOR} is now serving traffic." + rules: + - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/' # Only run this job when a semantic version tag is created tags: - kubernetes