eho/register-referentie

Fork 0

Files

Niek Otten 9ff7937055

CI / lint (pull_request) Successful in 50s

Details

CI / build (pull_request) Successful in 40s

Details

CI / unit (pull_request) Successful in 45s

Details

CI / compose-smoke (pull_request) Failing after 3m31s

Details

fix(infra): bake config into images so compose-smoke passes on CI (refs #30 )

Root cause of the compose-smoke failure (found in the runner logs):

  oz-init-1 | CommandError: Yaml file
              `/app/setup_configuration/data.yaml` does not exist.

The ubuntu-latest runner runs the job inside a container, so
`docker compose up` starts the stack as SIBLING containers via the host
daemon. A relative bind mount (./openzaak/setup_configuration) resolves to
a path inside the job container that the daemon can't see, so Docker mounts
an empty dir and the init container can't find data.yaml. The same trap hit
nrc-init (data.yaml), flowable-init (the BPMN) and keycloak (realm import).

Fix: bake the assets into small derived images instead of bind-mounting:
  - infra/openzaak/Dockerfile        -> register-referentie/openzaak:dev
  - infra/opennotificaties/Dockerfile-> register-referentie/opennotificaties:dev
  - infra/keycloak/Dockerfile        -> register-referentie/keycloak:dev
  - flowable-init: build.dockerfile_inline bakes workflows/registratie.bpmn

Base versions stay build args (OPENZAAK_TAG / OPENNOTIFICATIES_TAG), so the
pinning is unchanged. Applied to both the consolidated compose and the
per-service composes, so local Podman and CI use one mechanism — no bind
mounts, no SELinux `:z`, no world-readable requirement.

Verified locally: `podman build` of the OpenZaak and BPMN images produces
the file at the expected in-container path.

Docs: docs/runbooks/gitea-actions-gotchas.md explains the DinD bind-mount
trap and the bake fix; openzaak.md and ci.md point at it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-24 13:06:56 +02:00

3.2 KiB

Raw Blame History

CI runbook — Gitea Actions

Status: active. The workflow .gitea/workflows/ci.yaml runs on Gitea's hosted ubuntu-latest runner — no self-hosted runner required. make ci is still the local gate — it runs the exact same checks (the workflow calls the same make targets).

The pipeline

.gitea/workflows/ci.yaml runs on every push and pull request to main. Each job calls a make target — the single source of truth for the checks, so local and CI cannot drift:

Job	Target	Needs
`lint`	`make lint` → `dotnet format … --verify-no-changes`	.NET 10 SDK
`build`	`make build` → `dotnet build … -c Release`	.NET 10 SDK
`unit`	`make unit` → `dotnet test … -c Release`	.NET 10 SDK
`compose-smoke`	`make smoke` → compose up `--wait` → `curl /health` → `down`	container engine + compose v2

All uses: references are absolute, tag-pinned URLs (https://github.com/actions/checkout@v4, https://github.com/actions/setup-dotnet@v4) per CLAUDE.md §8.7 and §15 — Gitea Actions resolves them from GitHub.

compose-smoke runs on a containerized runner. Workspace bind mounts do not reach the sibling containers Compose starts, so config/assets are baked into derived images instead of being mounted. If you add a service that needs a repo file at runtime, bake it — don't bind-mount it. See gitea-actions-gotchas.md.

Running CI locally (`make ci`)

Until the runner exists, run the full pipeline yourself before pushing:

make ci          # lint + build + unit + smoke — what the pipeline runs
make lint        # or a single stage
make smoke       # compose up --wait, curl /health, tear down

Prerequisites: .NET 10 SDK, a container engine with Compose v2, and curl.

On a rootless Podman box (the default dev setup here), the smoke target needs the Podman API socket and a Compose provider:

systemctl --user enable --now podman.socket            # start the API socket
ln -sf "$(command -v podman)" ~/.local/bin/docker      # docker -> podman shim
# install Docker Compose v2 into ~/.local/bin as `docker-compose` (the provider)

The Makefile auto-points DOCKER_HOST at /run/user/$(id -u)/podman/podman.sock when that socket exists and DOCKER_HOST is unset, so make smoke "just works" locally while leaving real Docker hosts / CI runners untouched.

Runner: `ubuntu-latest`

All jobs run on Gitea's hosted ubuntu-latest runner — no self-hosted runner setup is required. The hosted runner ships with Docker and Docker Compose v2, so make smoke (docker compose … up --wait) works without extra configuration.

If Gitea's hosted runners are unavailable and a self-hosted fallback is needed, register an act_runner with the ubuntu-latest label:

VER=0.2.11
curl -fsSL -o /usr/local/bin/act_runner \
  "https://dl.gitea.com/act_runner/${VER}/act_runner-${VER}-linux-amd64"
chmod +x /usr/local/bin/act_runner

act_runner register --no-interactive \
  --instance https://git.labs.respellion.tech \
  --token <REGISTRATION_TOKEN> \
  --name respellion-ci-1 \
  --labels "ubuntu-latest:docker://node:20-bookworm"

act_runner daemon

3.2 KiB Raw Blame History

CI runbook — Gitea Actions

The pipeline

Running CI locally (make ci)

Runner: ubuntu-latest

3.2 KiB

Raw Blame History

Running CI locally (`make ci`)

Runner: `ubuntu-latest`