ci: deploy Hugo blog to k3s via Podman + k8s API

- Use Podman (daemonless) instead of Docker for building images
- kubeconfig stored as Gitea secret KUBECONFIG_B64
- RBAC: hugo-deployer SA for k8s API access
- Gitea Registry enabled for container storage

.gitea/workflows/deploy.yml

@@ -14,7 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
 
     steps:
       - name: Checkout
@@ -29,26 +28,50 @@ jobs:
       - name: Hugo Build
         run: hugo --minify
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Install Podman
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq podman fuse-overlayfs
+          # Configure Podman for Gitea Registry
+          mkdir -p /etc/containers/registries.conf.d
+          cat > /etc/containers/registries.conf.d/gitea-registry.conf <<REGCFG
+          [[registry]]
+          location = "${{ env.REGISTRY }}"
+          insecure = true
+          REGCFG
 
-      - name: Login to Gitea Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: luochen570
-          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Build and Push with Podman
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          # Login to Gitea Registry
+          echo "$REGISTRY_TOKEN" | \
+            podman login ${{ env.REGISTRY }} -u luochen570 --password-stdin
 
-      - name: Build and Push Docker Image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          # Build image (daemonless!)
+          podman build -t ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} .
+          podman tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }} \
             ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
 
+          # Push
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          podman push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+
       - name: Deploy to k3s
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
         run: |
-          kubectl set image deployment/hugo-blog -n hugo \
+          # Decode kubeconfig
+          echo "$KUBECONFIG_B64" | base64 -d > /tmp/kubeconfig.json
+
+          # Download kubectl
+          curl -fsSLO "https://dl.k8s.io/release/v1.32.0/bin/linux/amd64/kubectl"
+          chmod +x kubectl
+
+          # Rollout new image
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            set image deployment/hugo-blog -n hugo \
             nginx=${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+
+          ./kubectl --kubeconfig /tmp/kubeconfig.json \
+            rollout status deployment/hugo-blog -n hugo --timeout=120s

.gitignore

@@ -15,3 +15,4 @@ Thumbs.db
 # Hugo cache
 .hugo_build.lock
 resources/_gen/
+deploy/kubeconfig.json

deploy/deploy.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# hugo-blog deploy script
+# Runs on UC server: git pull -> hugo -> docker build+push -> kubectl rollout
+set -euo pipefail
+
+REPO_DIR="/root/hugo-blog"
+REGISTRY="git.luochen570.cn"
+IMAGE="luochen570/hugo-blog"
+NAMESPACE="hugo"
+DEPLOYMENT="hugo-blog"
+
+cd "$REPO_DIR"
+
+# 1. Pull latest
+echo "=== Pull latest ==="
+git fetch origin main
+LOCAL=$(git rev-parse HEAD)
+REMOTE=$(git rev-parse origin/main)
+if [ "$LOCAL" = "$REMOTE" ]; then
+  echo "Already up to date ($LOCAL). Nothing to do."
+  exit 0
+fi
+git merge --ff-only origin/main
+
+SHA=$(git rev-parse --short HEAD)
+echo "New commit: $SHA"
+
+# 2. Hugo build
+echo "=== Hugo build ==="
+hugo --minify -d public/
+
+# 3. Docker build and push
+echo "=== Docker build ==="
+docker build -t $REGISTRY/$IMAGE:$SHA -t $REGISTRY/$IMAGE:latest .
+
+echo "=== Docker push ==="
+docker login $REGISTRY -u luochen570 --password-stdin < ~/.config/gitea/token
+docker push $REGISTRY/$IMAGE:$SHA
+docker push $REGISTRY/$IMAGE:latest
+
+# 4. Deploy to k3s
+echo "=== k3s rollout ==="
+kubectl set image deployment/$DEPLOYMENT -n $NAMESPACE \
+  nginx=$REGISTRY/$IMAGE:$SHA
+kubectl rollout status deployment/$DEPLOYMENT -n $NAMESPACE --timeout=120s
+
+echo "=== Done: $SHA ==="