homelab-k3s/.gitea/workflows/deploy.yaml

name: Validate and Deploy to K3s

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install kubectl
        run: |
          if ! command -v kubectl &> /dev/null; then
            ARCH=$(uname -m)
            if [ "$ARCH" = "aarch64" ]; then
              ARCH="arm64"
            elif [ "$ARCH" = "x86_64" ]; then
              ARCH="amd64"
            fi
            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
            chmod +x kubectl
            sudo mv kubectl /usr/local/bin/
          fi
          kubectl version --client          

      - name: Configure kubectl
        run: |
          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
            exit 1
          fi
          mkdir -p $HOME/.kube
          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
          chmod 600 $HOME/.kube/config
          kubectl config current-context          

      - name: Server-side dry-run of full kustomization
        run: |
          kubectl apply -k . --dry-run=server          

  deploy:
    needs: validate
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install kubectl
        run: |
          if ! command -v kubectl &> /dev/null; then
            ARCH=$(uname -m)
            if [ "$ARCH" = "aarch64" ]; then
              ARCH="arm64"
            elif [ "$ARCH" = "x86_64" ]; then
              ARCH="amd64"
            fi
            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
            chmod +x kubectl
            sudo mv kubectl /usr/local/bin/
          fi
          kubectl version --client          

      - name: Configure kubectl
        run: |
          if [ -z "${{ secrets.KUBECONFIG }}" ]; then
            echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080."
            exit 1
          fi
          mkdir -p $HOME/.kube
          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
          chmod 600 $HOME/.kube/config
          kubectl config current-context          

      - name: Apply kustomization
        run: |
          kubectl apply -k .          

      - name: Wait for rollouts
        run: |
          set -e
          kubectl rollout status deploy/bitwarden-vaultwarden -n bitwarden --timeout=10m
          kubectl rollout status deploy/searxng-1723974683 -n default --timeout=10m
          kubectl rollout status deploy/home-assistant -n home-assistant --timeout=15m
          kubectl rollout status deploy/nginx -n nginx --timeout=10m
          kubectl rollout status deploy/pihole -n pihole --timeout=10m
          kubectl rollout status deploy/unbound -n pihole --timeout=10m
          kubectl rollout status deploy/unifiedstreaming -n unified-streaming --timeout=10m          

      - name: Deployment summary
        if: always()
        run: |
          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          for ns in bitwarden default home-assistant nginx pihole unified-streaming; do
            kubectl get deployments -n $ns >> $GITHUB_STEP_SUMMARY || true
          done
          echo '```' >> $GITHUB_STEP_SUMMARY