Vishesh 'ironeagle' Bangotra
a754366901
Document the two `.drone.yml` shapes used across the org, derived from the repos: - Type A `python-lib.yaml`: build-and-publish-pypi + backfill-pypi-from-tags - Type B `service-docker.yaml`: build-and-deploy-service + build-and-deploy-site - add reference page `10_drone_pipelines` - vendor `src/templates/drone/` into the MCP bundle (`drone.json`) - expose `registry://drone` + `list_drone_templates` / `get_drone_template` - wire `build.py` to vendor drone templates; rebuild nav/index (14 modules)
258 lines
7.5 KiB
YAML
258 lines
7.5 KiB
YAML
# Drone standard — Type B: Docker deployment
|
|
#
|
|
# Canonical pipelines for services that build an image, push it to the private
|
|
# registry, and run it on the Docker host (auth-server, docs, mcp).
|
|
#
|
|
# Two variants ship together:
|
|
# build-and-deploy-service — a long-running API/worker service: fetch the git
|
|
# tag, skip if the image already exists, run the
|
|
# quality gate, build, push, restart the container.
|
|
# build-and-deploy-site — a static/HTTP site: build, push, restart, on
|
|
# every push (no tag, no quality gate).
|
|
#
|
|
# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD (service only),
|
|
# REGISTRY_HOST, REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env
|
|
# (for example MONGO_* / JWT_SECRET).
|
|
#
|
|
# Placeholders to set per repo:
|
|
# <app> image / container / network name (e.g. auth-server).
|
|
# aetos/<app> image repository on the private registry.
|
|
# <host-port> published host port; <container-port> the in-image port.
|
|
# <site> site image name for the site variant (e.g. docs, mcp).
|
|
# <env-var> runtime environment variable consumed by the service.
|
|
---
|
|
kind: pipeline
|
|
type: docker
|
|
name: build-and-deploy-service
|
|
|
|
platform:
|
|
os: linux
|
|
arch: arm64
|
|
|
|
workspace:
|
|
path: /drone/src
|
|
|
|
volumes:
|
|
- name: dockersock
|
|
host:
|
|
path: /var/run/docker.sock
|
|
|
|
steps:
|
|
- name: fetch-tags
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- apk add --no-cache git
|
|
- git fetch --tags
|
|
- |
|
|
# Get latest Git tag and trim newline
|
|
LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null | tr -d '\n')
|
|
echo "Latest Git tag fetched: $LATEST_TAG"
|
|
|
|
# Save to file for downstream steps
|
|
echo "$LATEST_TAG" > /drone/src/LATEST_TAG.txt
|
|
|
|
# Read back for verification
|
|
IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
|
|
echo "Image tag read from file: $IMAGE_TAG"
|
|
|
|
# Validate
|
|
if [ -z "$IMAGE_TAG" ]; then
|
|
echo "No git tags found! Cannot continue."
|
|
exit 1
|
|
fi
|
|
|
|
- name: check-remote-image
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
|
|
- echo "Checking if aetos/<app>:$IMAGE_TAG exists on remote Docker..."
|
|
- echo "Existing Docker tags for aetos/<app>:"
|
|
- docker images --format "{{.Repository}}:{{.Tag}}" | grep "^aetos/<app>" || echo "(none)"
|
|
- |
|
|
if docker image inspect aetos/<app>:$IMAGE_TAG > /dev/null 2>&1; then
|
|
echo "Docker image aetos/<app>:$IMAGE_TAG already exists; skipping build"
|
|
exit 78
|
|
else
|
|
echo "Docker image aetos/<app>:$IMAGE_TAG not found; proceeding to build..."
|
|
fi
|
|
|
|
- name: quality-gate
|
|
image: python:3.13-slim
|
|
environment:
|
|
PIP_REPO_URL:
|
|
from_secret: PIP_REPO_URL
|
|
PIP_USERNAME:
|
|
from_secret: PIP_USERNAME
|
|
PIP_PASSWORD:
|
|
from_secret: PIP_PASSWORD
|
|
commands:
|
|
- pip install --upgrade pip
|
|
- pip install --extra-index-url "https://$PIP_USERNAME:$PIP_PASSWORD@$PIP_REPO_URL/simple" -r requirements.txt
|
|
- pip install black ruff mypy
|
|
- echo "Running quality gate..."
|
|
- python -m black --check .
|
|
- python -m ruff check .
|
|
- python -m mypy .
|
|
- python -m pytest
|
|
|
|
- name: build-image
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
environment:
|
|
PIP_REPO_URL:
|
|
from_secret: PIP_REPO_URL
|
|
PIP_USERNAME:
|
|
from_secret: PIP_USERNAME
|
|
PIP_PASSWORD:
|
|
from_secret: PIP_PASSWORD
|
|
commands:
|
|
- IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
|
|
- echo "Building Docker image aetos/<app>:$IMAGE_TAG ..."
|
|
- |
|
|
docker build \
|
|
--network=host \
|
|
--build-arg PIP_REPO_URL="$PIP_REPO_URL" \
|
|
--build-arg PIP_USERNAME="$PIP_USERNAME" \
|
|
--build-arg PIP_PASSWORD="$PIP_PASSWORD" \
|
|
-t aetos/<app>:$IMAGE_TAG \
|
|
-t aetos/<app>:latest \
|
|
/drone/src
|
|
|
|
- name: push-image
|
|
image: docker:24
|
|
environment:
|
|
REGISTRY_HOST:
|
|
from_secret: REGISTRY_HOST
|
|
REGISTRY_USER:
|
|
from_secret: REGISTRY_USER
|
|
REGISTRY_PASS:
|
|
from_secret: REGISTRY_PASS
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
|
|
- echo "Logging into registry $REGISTRY_HOST ..."
|
|
- echo "$REGISTRY_PASS" | docker login $REGISTRY_HOST -u "$REGISTRY_USER" --password-stdin
|
|
- echo "Tagging images with registry prefix..."
|
|
- docker tag aetos/<app>:$IMAGE_TAG $REGISTRY_HOST/aetos/<app>:$IMAGE_TAG
|
|
- docker tag aetos/<app>:$IMAGE_TAG $REGISTRY_HOST/aetos/<app>:latest
|
|
- echo "Pushing aetos/<app>:$IMAGE_TAG ..."
|
|
- docker push $REGISTRY_HOST/aetos/<app>:$IMAGE_TAG
|
|
- echo "Pushing aetos/<app>:latest ..."
|
|
- docker push $REGISTRY_HOST/aetos/<app>:latest
|
|
|
|
- name: stop-old
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- echo "Stopping old container..."
|
|
- docker rm -f <app> || true
|
|
|
|
- name: run-container
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
environment:
|
|
<ENV_VAR>:
|
|
from_secret: <ENV_VAR>
|
|
commands:
|
|
- IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
|
|
- echo "Starting container aetos/<app>:$IMAGE_TAG ..."
|
|
- |
|
|
docker run -d \
|
|
--name <app> \
|
|
-p <host-port>:<container-port> \
|
|
--add-host private-pi:192.168.1.111 \
|
|
--restart always \
|
|
-e <ENV_VAR>=$<ENV_VAR> \
|
|
aetos/<app>:$IMAGE_TAG
|
|
|
|
trigger:
|
|
event:
|
|
- tag
|
|
|
|
---
|
|
kind: pipeline
|
|
type: docker
|
|
name: build-and-deploy-site
|
|
|
|
platform:
|
|
os: linux
|
|
arch: arm64
|
|
|
|
workspace:
|
|
path: /drone/src
|
|
|
|
volumes:
|
|
- name: dockersock
|
|
host:
|
|
path: /var/run/docker.sock
|
|
|
|
steps:
|
|
- name: build-image
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- echo "Building Docker image for aetos/<site>..."
|
|
- docker build -t aetos/<site>:latest .
|
|
|
|
- name: push-image
|
|
image: docker:24
|
|
environment:
|
|
REGISTRY_HOST:
|
|
from_secret: REGISTRY_HOST
|
|
REGISTRY_USER:
|
|
from_secret: REGISTRY_USER
|
|
REGISTRY_PASS:
|
|
from_secret: REGISTRY_PASS
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- echo "Logging into registry $REGISTRY_HOST ..."
|
|
- echo "$REGISTRY_PASS" | docker login $REGISTRY_HOST -u "$REGISTRY_USER" --password-stdin
|
|
- docker tag aetos/<site>:latest $REGISTRY_HOST/aetos/<site>:latest
|
|
- echo "Pushing image to $REGISTRY_HOST..."
|
|
- docker push $REGISTRY_HOST/aetos/<site>:latest
|
|
|
|
- name: stop-old
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- echo "Stopping old container..."
|
|
- docker rm -f <site> || true
|
|
|
|
- name: run-container
|
|
image: docker:24
|
|
volumes:
|
|
- name: dockersock
|
|
path: /var/run/docker.sock
|
|
commands:
|
|
- echo "Starting aetos/<site>:latest ..."
|
|
- |
|
|
docker run -d \
|
|
--name <site> \
|
|
-p <host-port>:<container-port> \
|
|
--restart always \
|
|
aetos/<site>:latest
|
|
|
|
trigger:
|
|
event:
|
|
- push
|