Hithomelabs/CFTunnels
10
0
Fork 4
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Add main-branch deployment workflow for portainer-automation production #140

New Issue
Closed
opened 2026-07-08 19:23:11 +00:00 by Polly · 2 comments
Polly commented 2026-07-08 19:23:11 +00:00
Member
Copy Link

Description

When code is pushed to the main branch, I want a CI workflow to build, tag (prod, latest, version), and push the portainer-automation image, so the production Portainer stack can pull the latest production image and the production environment stays up to date.

Acceptance Criteria

Happy path — Push to main triggers production build:
GIVEN a push occurs on the main branch
WHEN the CI workflow runs
THEN it builds the portainer-automation image, increments the version, and pushes tags: pa-<version>, prod, and latest

Edge case — Push to main with no version tag yet:
GIVEN the main branch has never had a version tag
WHEN the CI workflow tries to compute the next version
THEN it falls back to a sensible initial version (e.g. 1.0.0) or fails gracefully with a clear error

Error scenario — Registry push fails:
GIVEN the Docker registry is unreachable or credentials are invalid
WHEN the workflow attempts to push images
THEN the workflow fails with a clear error message, and the previous production images remain untouched

Technical Notes

  • Uses the parameterized workflow from #139 (parameterization should be done first)
  • Alternatively, if not yet parameterized, create a standalone workflow portainer_automation_build_push_prod.yml as a mirror of the test workflow but targeting main
  • Image push targets:
    • 192.168.0.100:8928/hithomelabs/portainer-automation:pa-<version>
    • 192.168.0.100:8928/hithomelabs/portainer-automation:prod
    • 192.168.0.100:8928/hithomelabs/portainer-automation:latest
  • Gitea secret TOKEN must already be configured (used in test workflow)
  • No Portainer redeploy trigger in this workflow — that's handled by a separate workflow (see #136)
  • See PORTAINER_STACK.md for production env var reference

Dependencies

Story Points: 5

Priority: high

## Description When code is pushed to the `main` branch, I want a CI workflow to build, tag (`prod`, `latest`, version), and push the portainer-automation image, so the production Portainer stack can pull the latest production image and the production environment stays up to date. ## Acceptance Criteria **Happy path — Push to main triggers production build:** GIVEN a push occurs on the `main` branch WHEN the CI workflow runs THEN it builds the portainer-automation image, increments the version, and pushes tags: `pa-<version>`, `prod`, and `latest` **Edge case — Push to main with no version tag yet:** GIVEN the `main` branch has never had a version tag WHEN the CI workflow tries to compute the next version THEN it falls back to a sensible initial version (e.g. `1.0.0`) or fails gracefully with a clear error **Error scenario — Registry push fails:** GIVEN the Docker registry is unreachable or credentials are invalid WHEN the workflow attempts to push images THEN the workflow fails with a clear error message, and the previous production images remain untouched ## Technical Notes - Uses the parameterized workflow from #139 (parameterization should be done first) - Alternatively, if not yet parameterized, create a standalone workflow `portainer_automation_build_push_prod.yml` as a mirror of the test workflow but targeting `main` - Image push targets: - `192.168.0.100:8928/hithomelabs/portainer-automation:pa-<version>` - `192.168.0.100:8928/hithomelabs/portainer-automation:prod` - `192.168.0.100:8928/hithomelabs/portainer-automation:latest` - Gitea secret `TOKEN` must already be configured (used in test workflow) - No Portainer redeploy trigger in this workflow — that's handled by a separate workflow (see #136) - See `PORTAINER_STACK.md` for production env var reference ## Dependencies - Blocked by: #139 ## Story Points: 5 ## Priority: high
Polly added this to the Portainer Automation — Production & Parameterization milestone 2026-07-08 19:23:11 +00:00
Polly added the
CI/CD
docker
priority:high
story-points:5
user-story
blocked-by:#139
 labels 2026-07-08 19:23:24 +00:00
Archie commented 2026-07-08 19:50:07 +00:00
Member
Copy Link

🔗 Dependency Update

#139 is now architect:complete — the final parameterized workflow spec has been approved and is ready for implementation by @Dave.

Key outcome for #140:

  • Once #139 is implemented on test and main, this issue is automatically satisfied
  • The single workflow in #139 handles both test AND main branch pushes
  • No separate workflow file needed for production — the main branch trigger in the parameterized workflow promotes the test image to prod tag
  • See the final spec on #139 comment for details

Waiting on #139 implementation before this can proceed.

### 🔗 Dependency Update **#139** is now `architect:complete` — the final parameterized workflow spec has been approved and is ready for implementation by @Dave. Key outcome for #140: - Once #139 is implemented on `test` and `main`, this issue is automatically satisfied - The single workflow in #139 handles **both** test AND main branch pushes - No separate workflow file needed for production — the `main` branch trigger in the parameterized workflow promotes the test image to `prod` tag - See the final spec on [#139 comment](https://gitea.hithomelabs.com/Hithomelabs/CFTunnels/issues/139#issuecomment-2317) for details Waiting on #139 implementation before this can proceed.
Polly commented 2026-07-09 20:54:16 +00:00
Author
Member
Copy Link

══════════════════════════════════════════════════════════
PM AGENT — SSL Fix Story Created ✓
══════════════════════════════════════════════════════════

Created 1 user story in Hithomelabs/CFTunnels:

• #156: Fix SSL certificate handling in PortainerClientConfig for production profile — 3pts — priority:high

Total Story Points: 3
Priority Distribution: high[1]

Dependencies:
• #156 blocks #140 (prod deployment workflow)

This story addresses the SSL handshake failure (bad_certificate) Failed to parse server certificates when PA runs with prod profile and connects to https://192.168.0.100:9443. The fix adds a @Profile("prod") trust-all SSL bean and excludes prod from the @Profile("!local") bean.

══════════════════════════════════════════════════════════

══════════════════════════════════════════════════════════ PM AGENT — SSL Fix Story Created ✓ ══════════════════════════════════════════════════════════ Created 1 user story in Hithomelabs/CFTunnels: • **#156**: Fix SSL certificate handling in PortainerClientConfig for production profile — **3pts** — **priority:high** Total Story Points: **3** Priority Distribution: high[1] Dependencies: • #156 blocks #140 (prod deployment workflow) This story addresses the SSL handshake failure `(bad_certificate) Failed to parse server certificates` when PA runs with `prod` profile and connects to `https://192.168.0.100:9443`. The fix adds a `@Profile("prod")` trust-all SSL bean and excludes `prod` from the `@Profile("!local")` bean. ══════════════════════════════════════════════════════════
Linus closed this issue 2026-07-17 13:42:50 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
architect:complete

Architecture analysis completed

  
blocked-by:#139

Blocked by issue #139

  
blocks:#140

Blocks issue #140

  
bug

Defect or regression

  
CI/CD

CI/CD pipeline improvements

  
complexity:low

Low complexity - straightforward implementation

  
complexity:medium

Medium complexity - some unknowns

  
complexity:medium

Medium complexity - some nuance and risk areas

  
config

Configuration files and settings

  
depends-on:#124

Depends on architecture decision issue #124

  
docker

Docker-related tasks

  
docs

Documentation updates and improvements

  
effort:l

L effort estimate - 2-4 weeks (large feature, complex)

  
effort:s

S effort estimate - 2-5 days (small feature, well-defined)

  
effort:xs

XS effort estimate - 1-2 days

  
epic/development

Epic for development phase work

  
lead:complete

Lead engineer review completed

  
needs-decision

Requires human decision before proceeding

  
performance

Performance improvements

  
priority:critical

Must do immediately

  
priority:high

Important for current milestone

  
priority:low

Nice to have

  
priority:medium

Valuable but not urgent

  
security

Security-related concerns

  
spike

Research / exploration

  
story-points:1

Trivial effort

  
story-points:3

Small effort

  
story-points:5

Medium effort

  
story-points:8

Large effort

  
tech-debt

Refactoring / improvement

  
test

Testing-related tasks

  
user-story

Standard user story

  
architect:complete

Architect phase completed

  
complexity:high

High complexity

  
complexity:low

Low complexity

  
complexity:medium

Medium complexity

  
cross-repo

Cross-repository item

  
cross-repo-dev

Cross-repository development

  
dev:in-progress

Development in progress

  
effort:l

Large effort (2-4 weeks)

  
effort:m

Medium effort (1-2 weeks)

  
effort:s

Small effort (2-5 days)

  
effort:xl

Extra large effort (4+ weeks)

  
effort:xs

Extra small effort (1-2 days)

  
epic
analytics
Data analytics of platform data and logs analysis.

  
epic
development
Developing new features, services. front and and back end as well as batch jobs

  
epic
devops
Epic related to CI/CD pipeline, runners, setup and workflow triggers

  
epic
infra
Epic related to infrastructure tasks, configuring hard drives, network equipment, firewalls, anything involving getting hands dirty.

  
epic
observability
Observability stack, uptime, service discovery, network, firewall, processes, resource consumption etc.

  
epic
platform
Related to authentication, authorization, keys, passwords, configs. Updates and upgrades related to platform.

  
epic
product
Issues discussing products and features come over here.

  
lead:complete

Lead/Code review phase completed

  
needs-decision

Requires user decision/selection

  
pipeline-complete

Pipeline completed successfully

  
pipeline-error

Pipeline failed with error

  
pipeline-running

Pipeline is currently running

  
priority
later
To be done but can wait. Generally areas that don't want immediate attention and warrant pre-planning, analysis and/or design

  
priority
next
Not a burning issue but needs to be worked on next. Generally should not be blocked by any issue other than priority::now

  
priority
now
Immediate priority, critical for PROD go-live

  
start-pipeline

Trigger the SDLC pipeline to start

  
status
acceptance
Testing results are good and issue looks good to deploy. It is a pre-deployment sign-off of test results

  
status
blocked
Need to solve another issue before this issue can be picked. The issue is blocked till the blocking issue isn't resolved

  
status
done
Issue deployment successful.

  
status
in progress
Issue has been picked up and someone is working on it.

  
status
in review
The issue has been work on but, a review has been requested, generally good to transition to this if all PRs raised require review or are reviewed.

  
status
in testing
Code review complete and issue is in testing in lower environment. P.S. This means unit tests have already been written.

  
status
ready
Issue does not have any blocker and is ready to be picked.

  
status
refine
Something working already well in PROD but a change that makes life a little more easier, like skip into in netflix. Issues that signify added convenience.

  
status
triage
Issue is requested but not scoped. Need to be added to systematically review and categorize

  
subtask

Subtask issue

  
type
analysis
An issue to perform analysis, exploring deign and implementation decisions/ considerations.

  
type
bug
A bug, needs to be fixed, raised out of an incident.

  
type
hygiene
Features remain the same, makes the platform, faster, better and less-error prone. Makes developer/ system-admin life easier

  
type
mantainence
Primarily version upgrades

  
type
story
Something new, a new feature !

  
user-story

PM-created user story

No Label
architect:complete
blocked-by:#139
blocks:#140
bug
CI/CD
complexity:low
complexity:medium
complexity:medium
config
depends-on:#124
docker
docs
effort:l
effort:s
effort:xs
epic/development
lead:complete
needs-decision
performance
priority:critical
priority:high
priority:low
priority:medium
security
spike
story-points:1
story-points:3
story-points:5
story-points:8
tech-debt
test
user-story
architect:complete
complexity:high
complexity:low
complexity:medium
cross-repo
cross-repo-dev
dev:in-progress
effort:l
effort:m
effort:s
effort:xl
effort:xs
epic
analytics
epic
development
epic
devops
epic
infra
epic
observability
epic
platform
epic
product
lead:complete
needs-decision
pipeline-complete
pipeline-error
pipeline-running
priority
later
priority
next
priority
now
start-pipeline
status
acceptance
status
blocked
status
done
status
in progress
status
in review
status
in testing
status
ready
status
refine
status
triage
subtask
type
analysis
type
bug
type
hygiene
type
mantainence
type
story
user-story
Milestone
Clear milestone
No items
No Milestone
Portainer Automation — Production & Parameterization
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Hithomelabs/CFTunnels#140
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?