pleroma/pleroma-fe
2
2
Fork 4
Code Issues 344 Pull requests 27 Projects Releases Packages Wiki Activity

PR Woodpecker CI workflow #3477

Open
phnt wants to merge 13 commits from phnt/pleroma-fe:woodpecker-pr-ci into develop
pull from: phnt/pleroma-fe:woodpecker-pr-ci
merge into: pleroma:develop
Conversation 5 Commits 13 Files changed 6 +111 -3
phnt commented 2026-02-16 15:13:44 +00:00
Owner
Copy link

This should be the whole PR workflow from Gitlab minus E2E test which needs a Pleroma Docker image, which does not exist yet. Soon™ after BE also receives a similar PR pipeline.
Publishing fo releases from develop/stable/tagged is not implemented here and will come after PR pipelines are both merged.

Also runs the workflows except changelog on push to default branch.

Pre-merge

  • The test workflow depends on a 3rd-party plugin which isn't that popular for uploading failed test artifacts. I've looked through it, and it doesn't seem to do whacky things, but just in case the version is pinned to the current latest version, this also means:
  • Creating a Forgejo user that has write access to "packages", but shouldn't have write access to anything else. Probably doesn't even need read access to anything else. This user has to be a member of the pleroma organization
  • Creating pleroma-ci-user secret for the organization in Woodpecker where the name of the bot account is stored
  • Creating pleroma-ci-password secret for the organization in Woodpecker where the password for the bot account is stored
  • Pipelines should be at minimum required be manually approved when coming from forks. Ideally all pipelines should be manually approved thanks to possibility of leaking secrets with malicious PRs, that includes from maintainers.

Not really a fan of the 3rd-party dependency. Other ways that don't require a 3rd-party plugin welcome :)

cc @lambadalambda I don't wanna meddle with the CI backend even though I probably have the perms.

This should be the whole PR workflow from Gitlab minus E2E test which needs a Pleroma Docker image, which does not exist yet. Soon™ after BE also receives a similar PR pipeline. **Publishing fo releases from develop/stable/tagged is not implemented here and will come after PR pipelines are both merged.** Also runs the workflows except `changelog` on push to default branch. # Pre-merge * The `test` workflow depends on a [3rd-party plugin](https://woodpecker-ci.org/plugins/gitea-generic-package) which isn't that popular for uploading failed test artifacts. I've looked through it, and it doesn't seem to do whacky things, but just in case the version is pinned to the current latest version, this also means: - [ ] Creating a Forgejo user that has write access to "packages", but shouldn't have write access to anything else. Probably doesn't even need read access to anything else. This user has to be a member of the `pleroma` organization - [ ] Creating pleroma-ci-user secret for the organization in Woodpecker where the name of the bot account is stored - [ ] Creating pleroma-ci-password secret for the organization in Woodpecker where the password for the bot account is stored - [ ] **Pipelines should be at minimum required be manually approved when coming from forks. Ideally all pipelines should be manually approved thanks to possibility of leaking secrets with malicious PRs, that includes from maintainers.** Not really a fan of the 3rd-party dependency. Other ways that don't require a 3rd-party plugin welcome :) cc @lambadalambda I don't wanna meddle with the CI backend even though I probably have the perms.
phnt commented 2026-02-16 16:39:58 +00:00
Author
Owner
Copy link

Also I guess before this gets merged, agents should be tagged accordingly for the himem test workflow so I can add it as a label here. Filtering by platform is done automatically I think, after

label:
  - platform: linux/amd64

is added to the workflow.

Also I guess before this gets merged, agents should be tagged accordingly for the himem test workflow so I can add it as a label here. Filtering by platform is done automatically I think, after ``` label: - platform: linux/amd64 ``` is added to the workflow.
hj commented 2026-03-02 21:21:42 +00:00
Owner
Copy link

How does one deploy a runner for woodpecker ci?

How does one deploy a runner for woodpecker ci?
phnt commented 2026-03-02 21:30:43 +00:00
Author
Owner
Copy link

Install docker, download docker image, mount the host Docker socket to the container and that's it.

Platform restrictions are handled by default.

There are two ways you can register it.

  1. Shared global secret for all agents
  2. Per-agent secret added in woodpecker server settings.

Runner tagging and the secret are handled via an env variable to the container.

Here's how I ran one locally when testing this:

podman run --rm -v ~/.local/src/woodpecker:/etc/woodpecker -v /run/user/1000/podman/podman.sock:/var/run/docker.sock -v /tmp/woodpecker:/tmp -e "WOODPECKER_AGENT_SECRET=sekrit" -e "WOODPECKER_SERVER=<probably ci.pleroma.com:9000>" -e "WOODPECKER_AGENT_LABELS=memory=high" docker.io/woodpeckerci/woodpecker-agent:v3.13.0

Additionally enabling WOODPECKER_GRPC_SECURE=true is also probably a good idea.

https://woodpecker-ci.org/docs/administration/configuration/agent

Install docker, download [docker image](https://hub.docker.com/layers/woodpeckerci/woodpecker-agent/v3.13.0/images/sha256-33fcd285789d16f431d674319342cb4e52c3eaad1c78d8fe5329db4b8feb51c1), mount the host Docker socket to the container and that's it. Platform restrictions are handled by default. There are two ways you can register it. 1. Shared global secret for all agents 2. Per-agent secret added in woodpecker server settings. Runner tagging and the secret are handled via an env variable to the container. Here's how I ran one locally when testing this: ``` podman run --rm -v ~/.local/src/woodpecker:/etc/woodpecker -v /run/user/1000/podman/podman.sock:/var/run/docker.sock -v /tmp/woodpecker:/tmp -e "WOODPECKER_AGENT_SECRET=sekrit" -e "WOODPECKER_SERVER=<probably ci.pleroma.com:9000>" -e "WOODPECKER_AGENT_LABELS=memory=high" docker.io/woodpeckerci/woodpecker-agent:v3.13.0 ``` Additionally enabling WOODPECKER_GRPC_SECURE=true is also probably a good idea. https://woodpecker-ci.org/docs/administration/configuration/agent
hj commented 2026-03-03 00:49:59 +00:00
Owner
Copy link

are you sure 9000 port exposed?

i'm getting transport: Error while dialing: dial tcp 178.156.170.121:9000: connect: connection refused

using docker-compose

version: "3.8"
services:
  woodpecker-agent:
    image: woodpeckerci/woodpecker-agent:v3
    command: agent
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WOODPECKER_SERVER=${WOODPECKER_SERVER}
      - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}

# VARIABLE=value #comment
WOODPECKER_AGENT_SECRET=<redacted>
WOODPECKER_SERVER=ci.pleroma.com:9000
are you sure 9000 port exposed? i'm getting `transport: Error while dialing: dial tcp 178.156.170.121:9000: connect: connection refused` using docker-compose ``` version: "3.8" services: woodpecker-agent: image: woodpeckerci/woodpecker-agent:v3 command: agent restart: always volumes: - /var/run/docker.sock:/var/run/docker.sock environment: - WOODPECKER_SERVER=${WOODPECKER_SERVER} - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET} ``` ``` # VARIABLE=value #comment WOODPECKER_AGENT_SECRET=<redacted> WOODPECKER_SERVER=ci.pleroma.com:9000 ```
phnt commented 2026-03-03 10:24:07 +00:00
Author
Owner
Copy link

I haven't done this on Pleroma's own Woodpecker instance, I did it on my own Gitea instance.

Your config should work once that port is opened. cc @lambadalambda

I haven't done this on Pleroma's own Woodpecker instance, I did it on my own Gitea instance. Your config should work once that port is opened. cc @lambadalambda
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u woodpecker-pr-ci:phnt-woodpecker-pr-ci
git switch phnt-woodpecker-pr-ci

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch develop
git merge --no-ff phnt-woodpecker-pr-ci
git switch phnt-woodpecker-pr-ci
git rebase develop
git switch develop
git merge --ff-only phnt-woodpecker-pr-ci
git switch phnt-woodpecker-pr-ci
git rebase develop
git switch develop
git merge --no-ff phnt-woodpecker-pr-ci
git switch develop
git merge --squash phnt-woodpecker-pr-ci
git switch develop
git merge --ff-only phnt-woodpecker-pr-ci
git switch develop
git merge phnt-woodpecker-pr-ci
git push origin develop
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
BE Request

   
Backlog

   
Better behavior

   
Blocked by deps

   
Bug

   
Code Review

   
Discussion

   
Doing

   
Feature Request / Enhancement

   
In the shining bright future maybe

   
It's complicated

   
MS Edge

   
Mememoon (or other niche browsers)

   
Missing API

   
Missing feature

   
Missing l10n/i18n

   
NL1

Instance Admin Dashboard

  
NL2

Improved Mobile Experience

  
NL4

Improved instance customization and QoL options

  
Need to verify on develop

   
RELEASE BLOCKER

   
Reassign or Close

   
Refactor

   
Regression

   
Safari

   
To Do

   
User story

   
Waiting on godot

   
accessibility

https://git.pleroma.social/pleroma/pleroma-fe/-/snippets/7746

  
better documentation

   
chore

   
confirmed

   
easy ticket

   
incident

Denotes a disruption to IT services and the associated issues require immediate attention

  
l10n update

   
mastoapi

   
mobile

   
needs design

   
needs-info

   
needs-review

   
stupid
No labels
BE Request
Backlog
Better behavior
Blocked by deps
Bug
Code Review
Discussion
Doing
Feature Request / Enhancement
In the shining bright future maybe
It's complicated
MS Edge
Mememoon (or other niche browsers)
Missing API
Missing feature
Missing l10n/i18n
NL1
NL2
NL4
Need to verify on develop
RELEASE BLOCKER
Reassign or Close
Refactor
Regression
Safari
To Do
User story
Waiting on godot
accessibility
better documentation
chore
confirmed
easy ticket
incident
l10n update
mastoapi
mobile
needs design
needs-info
needs-review
stupid
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma-fe!3477
No description provided.