57_Wolve
7faa9098de
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates with AUTO_REBOOT=idle (reboots only when no SSH active) and opt-in Alpine stable-branch upgrades - generic + per-deployment cloud-init; Gitea release workflow on tag - README/LICENSE/.gitignore/.gitattributes (force LF); repo URLs -> Gitea
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
# Gitea Actions: on a version tag (vX.Y.Z), build the self-extracting bundle
|
|
# and publish it as a release asset. Make the release public (Gitea per-repo
|
|
# setting) and the bundle is downloadable without granting repo access.
|
|
#
|
|
# Requirements:
|
|
# - A registered Gitea act_runner whose labels include the `runs-on` value
|
|
# below (adjust if yours differ, e.g. self-hosted).
|
|
# - A repo/org secret named TOKEN_GITEA holding a Gitea access token with
|
|
# write:repository scope (Settings -> Applications -> Generate Token).
|
|
# NOTE: Gitea reserves the GITEA_ prefix, so the name can't start with it;
|
|
# TOKEN_GITEA is fine.
|
|
|
|
name: Release bundle
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
bundle:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout (full history + tags)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Build self-extracting bundle
|
|
run: |
|
|
bash build-bundle.sh "${GITHUB_REF_NAME}"
|
|
ls -l dist/
|
|
|
|
- name: Create release and attach the bundle
|
|
uses: https://gitea.com/actions/release-action@main
|
|
with:
|
|
files: |-
|
|
dist/automations-bundle.sh
|
|
api_key: '${{ secrets.TOKEN_GITEA }}'
|
|
# title/body default to the tag; uncomment to customize:
|
|
# title: 'automations ${{ github.ref_name }}'
|