ci: deploy Hugo blog to k3s via Podman + k8s API

- Use Podman (daemonless) instead of Docker for building images
- kubeconfig stored as Gitea secret KUBECONFIG_B64
- RBAC: hugo-deployer SA for k8s API access
- Gitea Registry enabled for container storage

.gitea/workflows/deploy.yml

@@ -14,7 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
 
     steps:
       - name: Checkout
@@ -29,26 +28,50 @@ jobs:
       - name: Hugo Build
         run: hugo --minify
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Install Podman
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq podman fuse-overlayfs
+          # Configure Podman for Gitea Registry
+          mkdir -p /etc/containers/registries.conf.d
+          cat > /etc/containers/registries.conf.d/gitea-registry.conf <<REGCFG
+          [[registry]]
+          location = "${{ env.REGISTRY }}"
+          insecure = true
+          REGCFG
 
-      - name: Login to Gitea Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: luochen570
-          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and Push with Podman
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          # Login to Gitea Registry
+          echo "$REGISTRY_TOKEN" | \
+            podman login ${{ env.REGISTRY }} -u luochen570 --password-stdin
 
-      - name: Build and Push Docker Image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          # Build image (daemonless!)
+          podman build -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} .
+          podman tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
 
+          # Push
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+
       - name: Deploy to k3s
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
         run: |
-          kubectl set image deployment/hugo-blog -n hugo \
+          # Decode kubeconfig
+          echo "$KUBECONFIG_B64" | base64 -d > /tmp/kubeconfig.json
+
+          # Download kubectl
+          curl -fsSLO "https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl"
+          chmod +x kubectl
+
+          # Rollout new image
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            set image deployment/hugo-blog -n hugo \
             nginx=${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            rollout status deployment/hugo-blog -n hugo --timeout=120s