ci: GitOps 이미지 태그를 waffle-world-oci 액션으로 갱신 - #146
Merged
Conversation
After building and pushing the image to OCIR, call the update-image action exposed by waffle-world-oci to set the kustomize overlay tag. This replaces the OCIR registry function that previously committed the tag into the GitOps repository. The overlay path is argocd/<ocir_repository>: the OCIR repository names already mirror the directory layout of the GitOps repository, so no per-workflow wiring is needed. update_gitops allows a build to skip the GitOps commit, which the manual dispatch workflow exposes so an image can be built without triggering a deploy. Building and recording the tag are no longer a single step, so two runs can interleave and leave the older tag deployed. A per-repository concurrency group cancels a superseded run instead: the cancelled run always carries the older commit, which does not need to be deployed. The group is keyed on the OCIR repository, so the api and batch jobs of one workflow do not serialise against each other.
update-image now defaults app-id to the waffle-image-update App, so the workflows only need to pass the private key. DEPLOYER_APP_ID is no longer referenced anywhere and its plumbing is removed.
Nothing asked for a build that skips the deploy, and the workflows had no such mode before this branch. In snutt-ev it was also unreachable: the input existed on the native template but no caller passed it. Removing it takes the templates back to the two inputs they had, and the GitOps step now always runs after a successful push, which matches how the registry function behaved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
변경 사항
이미지를 OCIR에 push한 뒤,
waffle-world-oci가 노출하는update-image액션을 호출해서kustomize overlay의 태그를 올립니다. OCIR push 이벤트를 받아 매니페스트를 치환하던
서버리스 함수(
ocir-image-update)가 하던 일을 배포 파이프라인 안으로 가져오는 변경입니다.argocd/<ocir_repository>입니다. OCIR 저장소 이름이 이미 GitOps 레포의디렉터리 구조와 같아서 워크플로우별로 따로 지정할 필요가 없습니다.
DEPLOYER_APP_ID는 더 이상 쓰이지 않습니다.워크플로우에서 배선을 제거했고,
DEPLOYER_APP_PRIVATE_KEY만 넘깁니다.concurrency
빌드와 태그 기록이 더 이상 한 단계가 아니라서, 두 run이 겹치면 나중에 끝난 오래된 run이
최신 태그를 덮어쓸 수 있습니다. OCIR 저장소 단위 concurrency group을 두고
cancel-in-progress: true로 했습니다. 취소되는 쪽은 항상 더 오래된 커밋이라 배포될 필요가없습니다.
group 키를 워크플로우가 아니라 OCIR 저장소로 잡아서, 한 워크플로우 안의 api/batch 두 job이
서로를 직렬화하지 않습니다.
선행 조건
#113(액션)은 머지되었습니다. #130(snutt-ev overlay)을 먼저 머지해야 합니다. overlay의
kustomization.yaml이 없으면 액션이 실패합니다.DEPLOYER_APP_PRIVATE_KEY는 이미 등록되어 있습니다. 다만 2026-03 이후 사용되지 않아서,값이 현재 App(
waffle-image-update, id 2842871)과 맞는지는 첫 배포에서 확인이 필요합니다.