From f731482c634263b18e9dca0997cdb2a43649584d Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Fri, 20 Feb 2026 16:30:41 +0300 Subject: [PATCH 1/6] staging actions --- .github/actions/cancel-stack/action.yml | 2 +- .github/actions/deploy-client-stack/action.yml | 2 +- .github/actions/destroy/action.yml | 2 +- .github/actions/provision-parent-stack/action.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/cancel-stack/action.yml b/.github/actions/cancel-stack/action.yml index e601b4ba..5256b493 100644 --- a/.github/actions/cancel-stack/action.yml +++ b/.github/actions/cancel-stack/action.yml @@ -71,7 +71,7 @@ outputs: runs: using: 'docker' - image: 'docker://simplecontainer/github-actions:latest' + image: 'docker://simplecontainer/github-actions:staging' env: GITHUB_ACTION_TYPE: 'cancel-stack' STACK_NAME: ${{ inputs.stack-name }} diff --git a/.github/actions/deploy-client-stack/action.yml b/.github/actions/deploy-client-stack/action.yml index 534006b9..b435f2dd 100644 --- a/.github/actions/deploy-client-stack/action.yml +++ b/.github/actions/deploy-client-stack/action.yml @@ -69,7 +69,7 @@ outputs: runs: using: 'docker' - image: 'docker://simplecontainer/github-actions:latest' + image: 'docker://simplecontainer/github-actions:staging' env: GITHUB_ACTION_TYPE: 'deploy-client-stack' STACK_NAME: ${{ inputs.stack-name }} diff --git a/.github/actions/destroy/action.yml b/.github/actions/destroy/action.yml index ef28e893..8fadc740 100644 --- a/.github/actions/destroy/action.yml +++ b/.github/actions/destroy/action.yml @@ -72,7 +72,7 @@ outputs: runs: using: 'docker' - image: 'docker://simplecontainer/github-actions:latest' + image: 'docker://simplecontainer/github-actions:staging' env: GITHUB_ACTION_TYPE: 'destroy' STACK_NAME: ${{ inputs.stack-name }} diff --git a/.github/actions/provision-parent-stack/action.yml b/.github/actions/provision-parent-stack/action.yml index 7e3e5ec3..9042038f 100644 --- a/.github/actions/provision-parent-stack/action.yml +++ b/.github/actions/provision-parent-stack/action.yml @@ -62,7 +62,7 @@ outputs: runs: using: 'docker' - image: 'docker://simplecontainer/github-actions:latest' + image: 'docker://simplecontainer/github-actions:staging' env: GITHUB_ACTION_TYPE: 'provision-parent-stack' STACK_NAME: ${{ inputs.stack-name }} From 1fff689223c2deff54723feea4a60ddcc7e32f21 Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Fri, 20 Feb 2026 16:31:23 +0300 Subject: [PATCH 2/6] use smaller agent --- .github/workflows/branch.yaml | 2 +- .github/workflows/build-staging.yml | 2 +- .github/workflows/push.yaml | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/branch.yaml b/.github/workflows/branch.yaml index d68e6966..a046bf95 100644 --- a/.github/workflows/branch.yaml +++ b/.github/workflows/branch.yaml @@ -12,7 +12,7 @@ permissions: jobs: build: name: Build simple-container in branch - runs-on: blacksmith-32vcpu-ubuntu-2204 + runs-on: blacksmith-8vcpu-ubuntu-2204 outputs: cicd-bot-telegram-token: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-token }} cicd-bot-telegram-chat-id: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-chat-id }} diff --git a/.github/workflows/build-staging.yml b/.github/workflows/build-staging.yml index 220db104..419c23a7 100644 --- a/.github/workflows/build-staging.yml +++ b/.github/workflows/build-staging.yml @@ -9,7 +9,7 @@ on: jobs: build-staging: name: Build Staging Image - runs-on: blacksmith-32vcpu-ubuntu-2204 + runs-on: blacksmith-8vcpu-ubuntu-2204 outputs: cicd-bot-telegram-token: ${{ steps.prepare-additional-secrets.outputs.cicd-bot-telegram-token }} cicd-bot-telegram-chat-id: ${{ steps.prepare-additional-secrets.outputs.cicd-bot-telegram-chat-id }} diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index b85f7070..9d2218ee 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -31,7 +31,7 @@ jobs: build: name: Build and release simple-container - runs-on: blacksmith-32vcpu-ubuntu-2204 + runs-on: blacksmith-8vcpu-ubuntu-2204 needs: prepare outputs: cicd-bot-telegram-token: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-token }} @@ -39,7 +39,7 @@ jobs: steps: - uses: actions/checkout@v4 - uses: fregante/setup-git-user@v2 - - name: install sc tool (latest release) + - name: install sc tool (latest release) shell: bash run: |- # Install latest SC release to get secrets for embeddings generation @@ -53,7 +53,7 @@ jobs: ${{ secrets.SC_CONFIG }} EOF sc secrets reveal - - name: get openai key + - name: get openai key id: get-openai-key run: | echo "openai-key=$(sc stack secret-get -s dist openai-api-key 2>/dev/null || echo '')" >> $GITHUB_OUTPUT From a4a8e5ea26432b0fe2ade2053783d3ca8dc4cd3f Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Fri, 20 Feb 2026 17:35:15 +0300 Subject: [PATCH 3/6] build caddy for staging --- .github/workflows/build-staging.yml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-staging.yml b/.github/workflows/build-staging.yml index 419c23a7..49c458fa 100644 --- a/.github/workflows/build-staging.yml +++ b/.github/workflows/build-staging.yml @@ -104,13 +104,31 @@ jobs: --push \ . + - name: Build and push caddy staging image + env: + DOCKER_BUILDKIT: 1 + run: | + # Build and push caddy staging image with BuildKit caching + # Tag with both 'staging' and the full VERSION (e.g., staging-219-20260220-093856) + docker buildx build \ + --platform linux/amd64 \ + --cache-from type=gha \ + --cache-to type=gha,mode=max \ + --file caddy.Dockerfile \ + --tag simplecontainer/caddy:staging \ + --tag simplecontainer/caddy:$VERSION \ + --push \ + . + - name: Image built successfully run: | - echo "🎉 GitHub Actions staging image built successfully with BuildKit + GitHub Actions caching!" + echo "🎉 GitHub Actions and Caddy staging images built successfully with BuildKit + GitHub Actions caching!" echo "" - echo "🚀 The staging image is now available:" - echo " simplecontainer/github-actions:staging" + echo "🚀 The staging images are now available:" + echo " simplecontainer/github-actions:staging" echo " simplecontainer/github-actions:${{ github.ref_name }}" + echo " simplecontainer/caddy:staging" + echo " simplecontainer/caddy:$VERSION" echo "" echo "📦 Built with version: $VERSION" echo "✅ Your GitHub Actions will now use the updated staging image with your latest changes!" From 06988b2c9702942695aba2a12337aa91846b4637 Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Fri, 20 Feb 2026 18:00:03 +0300 Subject: [PATCH 4/6] trying to add safe.directory config to gh actions before actually cloning project --- cmd/github-actions/main.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/cmd/github-actions/main.go b/cmd/github-actions/main.go index 49e477c4..a57dd1ef 100644 --- a/cmd/github-actions/main.go +++ b/cmd/github-actions/main.go @@ -293,6 +293,19 @@ func initializeSubmodules(ctx context.Context, log logger.Logger, workDir, token log.Info(ctx, "Git submodules detected - initializing and updating...") + // Fix for "detected dubious ownership" error - add workDir to safe.directory + safeDirCmd := []string{"git", "config", "--global", "--add", "safe.directory", workDir} + if err := runGitCommand(ctx, log, workDir, safeDirCmd); err != nil { + log.Debug(ctx, "Failed to add safe.directory config: %v", err) + // Continue anyway - this is best-effort + } + + // Also add wildcard to cover any nested submodule directories + wildcardCmd := []string{"git", "config", "--global", "--add", "safe.directory", "*"} + if err := runGitCommand(ctx, log, workDir, wildcardCmd); err != nil { + log.Debug(ctx, "Failed to add wildcard safe.directory: %v", err) + } + // Configure submodules to use the authenticated URL // This ensures submodules use the same token for authentication submoduleUpdateCmd := []string{ From 354b6fcd9ab852f28c09891470574ab38b9d6a34 Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Fri, 20 Feb 2026 19:00:00 +0300 Subject: [PATCH 5/6] trying to fix git submodules --- cmd/github-actions/main.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/cmd/github-actions/main.go b/cmd/github-actions/main.go index a57dd1ef..1f1e6474 100644 --- a/cmd/github-actions/main.go +++ b/cmd/github-actions/main.go @@ -349,7 +349,16 @@ func runGitCommandWithAuth(ctx context.Context, log logger.Logger, dir string, a cmd.Dir = dir cmd.Env = env if output, err := cmd.CombinedOutput(); err != nil { - log.Debug(ctx, "Failed to configure submodule URL rewrite: %s", string(output)) + log.Debug(ctx, "Failed to configure submodule URL rewrite (HTTPS): %s", string(output)) + // Continue anyway - this is a best-effort configuration + } + + // Also rewrite SSH URLs (git@github.com:) to use HTTPS with token + cmd = exec.Command("git", "config", "--local", "url."+submoduleConfig+".insteadOf", "git@github.com:") + cmd.Dir = dir + cmd.Env = env + if output, err := cmd.CombinedOutput(); err != nil { + log.Debug(ctx, "Failed to configure submodule URL rewrite (SSH): %s", string(output)) // Continue anyway - this is a best-effort configuration } } From 3c33f5cab980188c31d71bb912d059ff1ae02b56 Mon Sep 17 00:00:00 2001 From: Universe Ops Date: Sun, 22 Feb 2026 01:37:04 +0300 Subject: [PATCH 6/6] fix k8s label values --- .../pulumi/kubernetes/simple_container.go | 30 +++++++++++++++++-- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/pkg/clouds/pulumi/kubernetes/simple_container.go b/pkg/clouds/pulumi/kubernetes/simple_container.go index f8463943..ad2057fc 100644 --- a/pkg/clouds/pulumi/kubernetes/simple_container.go +++ b/pkg/clouds/pulumi/kubernetes/simple_container.go @@ -64,6 +64,30 @@ func sanitizeK8sResourceName(name string) string { return sanitized } +// sanitizeK8sLabelValue sanitizes a value to be valid for Kubernetes labels +// Kubernetes label values must be empty or consist of alphanumeric characters, '-', '_' or '.', +// and must start and end with an alphanumeric character +func sanitizeK8sLabelValue(value string) string { + if value == "" { + return value + } + + // Replace forward slashes with hyphens (common in stack paths like "/demo/root") + sanitized := strings.ReplaceAll(value, "/", "-") + // Replace other invalid characters with hyphens + reg := regexp.MustCompile(`[^a-zA-Z0-9\-_\.]`) + sanitized = reg.ReplaceAllString(sanitized, "-") + // Remove leading/trailing hyphens, underscores, or dots to ensure alphanumeric start/end + sanitized = strings.Trim(sanitized, "-_.") + + // If the result is empty after sanitization, provide a default + if sanitized == "" { + sanitized = "unknown" + } + + return sanitized +} + type SimpleContainerArgs struct { // required properties Namespace string `json:"namespace" yaml:"namespace"` @@ -146,18 +170,18 @@ func NewSimpleContainer(ctx *sdk.Context, args *SimpleContainerArgs, opts ...sdk // Add parentEnv labels for custom stacks if args.ParentEnv != nil && lo.FromPtr(args.ParentEnv) != "" && lo.FromPtr(args.ParentEnv) != args.ScEnv { - appLabels[LabelParentEnv] = lo.FromPtr(args.ParentEnv) + appLabels[LabelParentEnv] = sanitizeK8sLabelValue(lo.FromPtr(args.ParentEnv)) appLabels[LabelCustomStack] = "true" } // Add parent-stack and client-stack labels if provided if args.ParentStack != nil && *args.ParentStack != "" { - appLabels[LabelParentStack] = *args.ParentStack + appLabels[LabelParentStack] = sanitizeK8sLabelValue(*args.ParentStack) } // Note: client-stack is typically same as parent-stack in nested scenarios // but can be different in more complex hierarchies if args.ParentStack != nil && *args.ParentStack != "" { - appLabels[LabelClientStack] = *args.ParentStack + appLabels[LabelClientStack] = sanitizeK8sLabelValue(*args.ParentStack) } appAnnotations := map[string]string{