32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# OCI E2E runner
|
|
|
|
`cicd-tool e2e` is a read-only verifier: it uses `kubectl get` and HTTP GET
|
|
only. It never applies resources, reconciles Flux, or calls bootstrap/rebuild.
|
|
It emits one JSON result and exits non-zero when a check fails.
|
|
|
|
Supply explicit resource identifiers and credential-free URLs. The runner waits
|
|
independently (bounded by `--timeout`, maximum ten minutes) for Flux
|
|
Kustomizations and an ExternalSecret `Ready=True`, a terminal PipelineRun,
|
|
the preview response sentinel, and exactly one open Forgejo promotion PR for
|
|
the supplied branch. It reads the Forgejo token only from `--promotion-token-env`
|
|
or `--promotion-token-file`; do not pass tokens or credential-bearing URLs.
|
|
|
|
```sh
|
|
cicd-tool e2e \
|
|
--kubeconfig /run/secrets/kubeconfig \
|
|
--flux-kustomization flux-system/tekton \
|
|
--external-secret tekton-pipelines/forgejo-webhook \
|
|
--pipelinerun tekton-pipelines/<run-name> \
|
|
--preview-url https://<preview-host>/ \
|
|
--preview-sentinel <non-secret-sentinel> \
|
|
--promotion-pulls-url https://<forgejo>/api/v1/repos/<owner>/<manifests>/pulls \
|
|
--promotion-owner <owner> \
|
|
--promotion-head maidn/promotion-<app>-<sha> \
|
|
--promotion-token-env FORGEJO_TOKEN
|
|
```
|
|
|
|
Build the portable OCI runner with `docker build -t maidn-e2e-runner .`.
|
|
Mount the kubeconfig and optional token file read-only; ensure they are readable
|
|
by the image's non-root user. The build context excludes known secret-bearing
|
|
bootstrap inputs.
|