panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix(ci): bootstrap lint toolchain' (#4) from fix/ci-tool-bootstrap into main
lint / yaml (push) Failing after 13s
Details
lint / ansible (push) Failing after 13s
Details
lint / terraform (push) Successful in 28s
Details

Browse Source 
Reviewed-on: #4
This commit was merged in pull request #4.
This commit is contained in:
panxiao81
2026-09-09 17:56:53 +00:00
parent 0644c25567 3de2a078b9
commit 661f841837
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/lint.yml
+3
View File
@@ -29,6 +29,7 @@ jobs:
runs-on: self-hosted runs-on: self-hosted
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
- name: Install yamllint - name: Install yamllint
# The WAN drops at random (see CLAUDE.md); retry rather than fail a run. # The WAN drops at random (see CLAUDE.md); retry rather than fail a run.
@@ -52,6 +53,7 @@ jobs:
runs-on: self-hosted runs-on: self-hosted
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
- name: Install ansible-lint and collections - name: Install ansible-lint and collections
# pywinrm is not optional — without it every ansible.windows.* task dies # pywinrm is not optional — without it every ansible.windows.* task dies
@@ -89,6 +91,7 @@ jobs:
runs-on: self-hosted runs-on: self-hosted
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- uses: hashicorp/setup-terraform@v3
- name: fmt and validate - name: fmt and validate
# -backend=false so validate never touches real state or needs credentials. # -backend=false so validate never touches real state or needs credentials.
CHANGELOG.md
+1 -1
View File
@@ -26,7 +26,7 @@ What changed in this homelab, when, and why. Newest first.
| secrets | Recorded that ESO 2.8.0, five ExternalSecrets and the scoped OpenBao Kubernetes-auth path already exist; the next gate is live recovery testing and migration of any remaining manual Secrets | | secrets | Recorded that ESO 2.8.0, five ExternalSecrets and the scoped OpenBao Kubernetes-auth path already exist; the next gate is live recovery testing and migration of any remaining manual Secrets |
| Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop | | Terraform | Recorded Gitea 1.27 State Registry as the preferred candidate for local roots after version and recovery testing; the OCI recovery root remains in OCI Object Storage to avoid a home-control-plane dependency loop |
| cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored | | cleanup | Removed the retired NapCat tree, the Contour and Kanidm archive trees, and seven generated Terraform plan files before establishing the clean Git baseline; plans may embed complete state and remain globally ignored |
| CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent instance-scoped Kubernetes runner with capacity four, plus an ESO reference to its registration token in OpenBao. The first deployment proved that rootlesskit is blocked by the node's AppArmor unprivileged-userns policy; because the chart requires privileged DinD in either mode, the reviewed fix uses regular DinD instead of weakening the host-wide policy | | CI | Added a review-first Gitea Actions runner bootstrap: official actions chart 0.1.1, pinned runner 2.3.0, one persistent instance-scoped Kubernetes runner with capacity four, plus an ESO reference to its registration token in OpenBao. The first deployment proved that rootlesskit is blocked by the node's AppArmor unprivileged-userns policy; because the chart requires privileged DinD in either mode, the reviewed fix uses regular DinD instead of weakening the host-wide policy. The runner image intentionally carries neither `uv` nor Terraform, so the lint workflow now bootstraps both with versioned setup actions instead of relying on developer-machine state |
| identity | Declared the Samba AD `gitea-admins` group with `panxiao81` as its initial member. Gitea already maps this OIDC group to site administrators; the local `gitea_admin` account remains as break-glass access | | identity | Declared the Samba AD `gitea-admins` group with `panxiao81` as its initial member. Gitea already maps this OIDC group to site administrators; the local `gitea_admin` account remains as break-glass access |
`Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory; `Carried forward`: re-verify OpenBao/ESO recovery and remaining Secret inventory;