From 5bf2b430500917ca0a172ce5bd406247b114b0f4 Mon Sep 17 00:00:00 2001 From: Dmitry Lebedev Date: Fri, 4 Sep 2026 21:47:50 +0200 Subject: [PATCH] ci: move static build and backend deploy jobs to self-hosted-k8s #26 --- .github/workflows/deploy-backend.yaml | 11 +++++----- .github/workflows/deploy-static-website.yaml | 21 ++++++++++++++------ 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy-backend.yaml b/.github/workflows/deploy-backend.yaml index 3c18a5c..3445951 100644 --- a/.github/workflows/deploy-backend.yaml +++ b/.github/workflows/deploy-backend.yaml @@ -252,7 +252,11 @@ jobs: done deploy: - runs-on: ubuntu-latest + runs-on: self-hosted-k8s + # ci-runner ships the argocd CLI (v3.2.1) and jq; nothing is downloaded + # through NAT per run. + container: + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner:latest needs: build if: >- (github.event_name == 'push' && github.ref == 'refs/heads/main') || @@ -262,11 +266,6 @@ jobs: flavor: ${{ fromJson(inputs.flavors) }} steps: - - name: Setup ArgoCD CLI - uses: imajeetyadav/argocd-cli@v1 - with: - version: v3.2.1 - - name: Deploy ${{ matrix.flavor }} to ArgoCD env: ARGOCD_AUTH_TOKEN: ${{ vars.ARGO_API_KEY }} diff --git a/.github/workflows/deploy-static-website.yaml b/.github/workflows/deploy-static-website.yaml index 5375a06..9202a04 100644 --- a/.github/workflows/deploy-static-website.yaml +++ b/.github/workflows/deploy-static-website.yaml @@ -64,7 +64,8 @@ env: jobs: preview-policy: - runs-on: ubuntu-latest + # Shell-only policy evaluation; runs in the ARC runner pod itself. + runs-on: self-hosted-k8s permissions: contents: read outputs: @@ -132,7 +133,11 @@ jobs: build-preview: needs: preview-policy if: needs.preview-policy.outputs.trusted == 'true' - runs-on: ubuntu-latest + runs-on: self-hosted-k8s + # ci-runner ships node 22, pnpm (corepack), make and ruby (the manifest + # validator below is a Ruby heredoc). Same digest as the deploy jobs. + container: + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a permissions: contents: read pull-requests: read @@ -535,7 +540,11 @@ jobs: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.preview-policy.outputs.toolchain_allowed == 'true' - runs-on: ubuntu-latest + runs-on: self-hosted-k8s + # ci-runner ships node 22, pnpm (corepack), make and ruby (the manifest + # validator below is a Ruby heredoc). Same digest as the deploy jobs. + container: + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a permissions: contents: read @@ -645,7 +654,7 @@ jobs: if: github.event_name == 'push' && github.ref == 'refs/heads/main' runs-on: self-hosted-k8s container: - image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960 + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a permissions: contents: read id-token: write @@ -707,7 +716,7 @@ jobs: if: needs.preview-policy.outputs.trusted == 'true' runs-on: self-hosted-k8s container: - image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960 + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a permissions: contents: read id-token: write @@ -825,7 +834,7 @@ jobs: github.event.pull_request.head.repo.full_name == github.repository runs-on: self-hosted-k8s container: - image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:e57fadf58eb4e125a101f366a9cd97cb022e3cb8a9eae6028cefdfb0003b2960 + image: europe-north1-docker.pkg.dev/festive-terrain-478011-h0/beveriq/ci-runner@sha256:8c907c4a13a14ec89617bfadb60a090abc358f91d9b888552ce91205be35a52a permissions: contents: read id-token: write