From d23d70050089e8f73e9c541b29a609693d9340b2 Mon Sep 17 00:00:00 2001
From: root <ezach.me@gmail.com>
Date: Mon, 7 Sep 2026 14:36:53 +0700
Subject: [PATCH] fix: update SIDATA CI/CD workflow

---
 .gitea/workflows/deploy.yaml | 327 ++++++++++++++++++++++-------------
 1 file changed, 203 insertions(+), 124 deletions(-)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index a4245bf..13a4dd9 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -10,45 +10,53 @@ build-and-deploy:
 runs-on: ubuntu-latest
 
 env:
-  # ============================================================
-  # Proxy
-  # ============================================================
   HTTP_PROXY: http://10.15.3.20:80
   HTTPS_PROXY: http://10.15.3.20:80
   http_proxy: http://10.15.3.20:80
   https_proxy: http://10.15.3.20:80
 
-  # ============================================================
-  # Internal network - bypass proxy
-  # ============================================================
-  NO_PROXY: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
+  NO_PROXY: >-
+    localhost,127.0.0.1,
+    10.15.39.0/24,
+    10.81.2.0/24,
+    10.42.0.0/16,
+    10.43.0.0/16,
+    registry-nexus-bpkd.drc-bpkd.data-center.id,
+    registry-bpkd.drc-bpkd.data-center.id,
+    .drc-bpkd.data-center.id,
+    .bpkd.jakarta.go.id
 
-  no_proxy: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
+  no_proxy: >-
+    localhost,127.0.0.1,
+    10.15.39.0/24,
+    10.81.2.0/24,
+    10.42.0.0/16,
+    10.43.0.0/16,
+    registry-nexus-bpkd.drc-bpkd.data-center.id,
+    registry-bpkd.drc-bpkd.data-center.id,
+    .drc-bpkd.data-center.id,
+    .bpkd.jakarta.go.id
 
 steps:
 
-  # ============================================================
-  # 1. Check workspace
-  # ============================================================
+  # ==========================================================
+  # 1. WORKSPACE
+  # ==========================================================
   - name: Check Workspace
     shell: bash
     run: |
       set -e
 
       echo "=========================================="
-      echo "WORKSPACE"
+      echo "CHECK WORKSPACE"
       echo "=========================================="
 
       pwd
       echo ""
 
-      echo "Files:"
+      echo "Repository files:"
       ls -la
 
-      echo ""
-      echo "Git:"
-      git status || true
-
       echo ""
       echo "Dockerfile:"
       test -f Dockerfile
@@ -57,35 +65,38 @@ steps:
       echo ""
       echo "Kubernetes:"
       test -d k8s
-      ls -la k8s/
+      find k8s -maxdepth 2 -type f -print
 
-  # ============================================================
-  # 2. Check Container Engine
-  # ============================================================
+  # ==========================================================
+  # 2. CONTAINER ENGINE
+  # ==========================================================
   - name: Check Container Engine
     shell: bash
     run: |
       set -e
 
       echo "=========================================="
-      echo "CONTAINER ENGINE"
+      echo "CHECK CONTAINER ENGINE"
       echo "=========================================="
 
-      echo "Docker:"
+      echo "Docker executable:"
       which docker
+
+      echo ""
+      echo "Docker version:"
       docker --version
 
       echo ""
-      echo "Docker server:"
+      echo "Engine:"
       docker version
 
       echo ""
       echo "Docker socket:"
       ls -l /var/run/docker.sock
 
-  # ============================================================
-  # 3. Check Nexus Connectivity
-  # ============================================================
+  # ==========================================================
+  # 3. REGISTRY CONNECTIVITY
+  # ==========================================================
   - name: Check Nexus Connectivity
     shell: bash
     run: |
@@ -101,24 +112,30 @@ steps:
       getent hosts "$REGISTRY"
 
       echo ""
-      echo "HTTPS:"
-      curl \
+      echo "HTTPS /v2/:"
+
+      HTTP_CODE=$(curl \
         --silent \
         --show-error \
         --output /tmp/nexus-response.txt \
-        --write-out "HTTP_STATUS=%{http_code}\n" \
+        --write-out "%{http_code}" \
         --connect-timeout 10 \
-        "https://${REGISTRY}/v2/" || true
+        --max-time 30 \
+        "https://${REGISTRY}/v2/" || true)
 
-      cat /tmp/nexus-response.txt || true
+      echo "HTTP status: ${HTTP_CODE}"
 
-      echo ""
-      echo "Nexus registry endpoint dapat diuji."
-      echo "HTTP 401 untuk /v2/ tanpa login adalah NORMAL."
+      if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "401" ]; then
+        echo "Nexus connectivity OK."
+      else
+        echo "ERROR: Nexus tidak dapat diakses."
+        cat /tmp/nexus-response.txt || true
+        exit 1
+      fi
 
-  # ============================================================
-  # 4. Check Registry Secrets
-  # ============================================================
+  # ==========================================================
+  # 4. CHECK SECRETS
+  # ==========================================================
   - name: Check Registry Secrets
     shell: bash
     env:
@@ -134,21 +151,14 @@ steps:
       echo "REGISTRY_USER length: ${#REGISTRY_USER}"
       echo "REGISTRY_PASSWORD length: ${#REGISTRY_PASSWORD}"
 
-      if [ -z "$REGISTRY_USER" ]; then
-        echo "ERROR: REGISTRY_USER kosong."
-        exit 1
-      fi
+      test -n "$REGISTRY_USER"
+      test -n "$REGISTRY_PASSWORD"
 
-      if [ -z "$REGISTRY_PASSWORD" ]; then
-        echo "ERROR: REGISTRY_PASSWORD kosong."
-        exit 1
-      fi
+      echo "Registry secrets OK."
 
-      echo "Registry secrets tersedia."
-
-  # ============================================================
-  # 5. Login Nexus
-  # ============================================================
+  # ==========================================================
+  # 5. LOGIN NEXUS
+  # ==========================================================
   - name: Login Nexus
     shell: bash
     env:
@@ -163,9 +173,6 @@ steps:
       echo "LOGIN NEXUS"
       echo "=========================================="
 
-      echo "Registry: $REGISTRY"
-      echo "Username length: ${#REGISTRY_USER}"
-
       printf '%s' "$REGISTRY_PASSWORD" | \
         docker login "$REGISTRY" \
           --username "$REGISTRY_USER" \
@@ -173,9 +180,9 @@ steps:
 
       echo "Login Nexus berhasil."
 
-  # ============================================================
-  # 6. Pull Base Image
-  # ============================================================
+  # ==========================================================
+  # 6. PULL BASE IMAGE
+  # ==========================================================
   - name: Pull Base Image
     shell: bash
     run: |
@@ -191,15 +198,14 @@ steps:
 
       docker pull "$BASE_IMAGE"
 
-      echo ""
-      echo "Base image berhasil."
-
       docker image inspect "$BASE_IMAGE" \
         --format 'Image ID: {{.Id}}'
 
-  # ============================================================
-  # 7. Build SIDATA
-  # ============================================================
+      echo "Base image OK."
+
+  # ==========================================================
+  # 7. BUILD
+  # ==========================================================
   - name: Build SIDATA
     shell: bash
     run: |
@@ -212,12 +218,13 @@ steps:
       test -f Dockerfile
 
       docker build \
-        --build-arg http_proxy="$http_proxy" \
-        --build-arg https_proxy="$https_proxy" \
+        --load \
         --build-arg HTTP_PROXY="$HTTP_PROXY" \
         --build-arg HTTPS_PROXY="$HTTPS_PROXY" \
-        --build-arg no_proxy="$no_proxy" \
+        --build-arg http_proxy="$http_proxy" \
+        --build-arg https_proxy="$https_proxy" \
         --build-arg NO_PROXY="$NO_PROXY" \
+        --build-arg no_proxy="$no_proxy" \
         -t sidata:latest .
 
       echo ""
@@ -226,9 +233,9 @@ steps:
       docker image inspect sidata:latest \
         --format 'Image ID: {{.Id}}'
 
-  # ============================================================
-  # 8. Tag Image
-  # ============================================================
+  # ==========================================================
+  # 8. TAG
+  # ==========================================================
   - name: Tag SIDATA Image
     shell: bash
     env:
@@ -241,19 +248,17 @@ steps:
       SHA="${{ gitea.sha }}"
 
       echo "=========================================="
-      echo "TAG SIDATA"
+      echo "TAG IMAGE"
       echo "=========================================="
 
       docker tag sidata:latest "${IMAGE}:latest"
       docker tag sidata:latest "${IMAGE}:${SHA}"
 
-      echo "Image:"
-      echo "${IMAGE}:latest"
-      echo "${IMAGE}:${SHA}"
+      docker image ls | grep sidata
 
-  # ============================================================
-  # 9. Push Image
-  # ============================================================
+  # ==========================================================
+  # 9. PUSH
+  # ==========================================================
   - name: Push SIDATA Image
     shell: bash
     env:
@@ -266,18 +271,17 @@ steps:
       SHA="${{ gitea.sha }}"
 
       echo "=========================================="
-      echo "PUSH SIDATA"
+      echo "PUSH IMAGE"
       echo "=========================================="
 
       docker push "${IMAGE}:latest"
       docker push "${IMAGE}:${SHA}"
 
-      echo ""
-      echo "Push image berhasil."
+      echo "Push berhasil."
 
-  # ============================================================
-  # 10. Install kubectl
-  # ============================================================
+  # ==========================================================
+  # 10. INSTALL KUBECTL
+  # ==========================================================
   - name: Install kubectl
     shell: bash
     run: |
@@ -292,15 +296,17 @@ steps:
         --show-error \
         --fail \
         --connect-timeout 10 \
+        --max-time 30 \
         https://dl.k8s.io/release/stable.txt)
 
-      echo "kubectl version: ${KUBECTL_VERSION}"
+      echo "Version: $KUBECTL_VERSION"
 
       curl \
         --fail \
         --show-error \
         --location \
         --connect-timeout 10 \
+        --max-time 120 \
         "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
         -o kubectl
 
@@ -308,9 +314,9 @@ steps:
 
       ./kubectl version --client
 
-  # ============================================================
-  # 11. Configure Rancher
-  # ============================================================
+  # ==========================================================
+  # 11. CONFIGURE RANCHER
+  # ==========================================================
   - name: Configure Rancher
     shell: bash
     env:
@@ -324,24 +330,13 @@ steps:
       echo "CONFIGURE RANCHER"
       echo "=========================================="
 
-      if [ -z "$RANCHER_URL" ]; then
-        echo "ERROR: RANCHER_URL kosong."
-        exit 1
-      fi
-
-      if [ -z "$RANCHER_CLUSTER_ID" ]; then
-        echo "ERROR: RANCHER_CLUSTER_ID kosong."
-        exit 1
-      fi
-
-      if [ -z "$RANCHER_TOKEN" ]; then
-        echo "ERROR: RANCHER_TOKEN kosong."
-        exit 1
-      fi
+      test -n "$RANCHER_URL"
+      test -n "$RANCHER_CLUSTER_ID"
+      test -n "$RANCHER_TOKEN"
 
       SERVER="${RANCHER_URL%/}/k8s/clusters/${RANCHER_CLUSTER_ID}"
 
-      echo "Rancher server:"
+      echo "Rancher API:"
       echo "$SERVER"
 
       ./kubectl config set-cluster rancher-cluster \
@@ -357,16 +352,16 @@ steps:
 
       ./kubectl config use-context rancher-context
 
-  # ============================================================
-  # 12. Test Rancher
-  # ============================================================
+  # ==========================================================
+  # 12. TEST RANCHER
+  # ==========================================================
   - name: Test Rancher Connection
     shell: bash
     run: |
       set -e
 
       echo "=========================================="
-      echo "RANCHER CONNECTION"
+      echo "TEST RANCHER"
       echo "=========================================="
 
       ./kubectl cluster-info
@@ -375,13 +370,43 @@ steps:
       echo "Nodes:"
       ./kubectl get nodes
 
-  # ============================================================
-  # 13. Deploy Kubernetes
-  # ============================================================
-  - name: Deploy SIDATA to Kubernetes
+  # ==========================================================
+  # 13. CREATE NEXUS PULL SECRET
+  # ==========================================================
+  - name: Create Nexus Pull Secret
     shell: bash
     env:
       REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+      NAMESPACE="sidata"
+
+      echo "=========================================="
+      echo "CREATE NEXUS PULL SECRET"
+      echo "=========================================="
+
+      ./kubectl create namespace "$NAMESPACE" \
+        --dry-run=client \
+        -o yaml | ./kubectl apply -f -
+
+      ./kubectl create secret docker-registry nexus-registry \
+        --namespace="$NAMESPACE" \
+        --docker-server="$REGISTRY" \
+        --docker-username="$REGISTRY_USER" \
+        --docker-password="$REGISTRY_PASSWORD" \
+        --dry-run=client \
+        -o yaml | ./kubectl apply -f -
+
+      echo "Pull secret OK."
+
+  # ==========================================================
+  # 14. DEPLOY MANIFEST
+  # ==========================================================
+  - name: Deploy SIDATA
+    shell: bash
     run: |
       set -e
 
@@ -391,15 +416,57 @@ steps:
 
       test -d k8s
 
-      echo "Manifest:"
-      find k8s -maxdepth 1 -type f -print
+      find k8s -maxdepth 2 -type f -print
 
-      ./kubectl apply -f k8s/
+      ./kubectl apply \
+        --namespace=sidata \
+        -f k8s/
 
-  # ============================================================
-  # 14. Restart Deployment
-  # ============================================================
-  - name: Restart SIDATA Deployment
+  # ==========================================================
+  # 15. SET IMAGE
+  # ==========================================================
+  - name: Update SIDATA Image
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+      IMAGE="${REGISTRY}/${REGISTRY_USER}/sidata:${{ gitea.sha }}"
+
+      echo "=========================================="
+      echo "UPDATE IMAGE"
+      echo "=========================================="
+
+      echo "$IMAGE"
+
+      ./kubectl set image \
+        deployment/sidata \
+        sidata="$IMAGE" \
+        --namespace=sidata
+
+  # ==========================================================
+  # 16. IMAGE PULL SECRET
+  # ==========================================================
+  - name: Configure Image Pull Secret
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "CONFIGURE IMAGE PULL SECRET"
+      echo "=========================================="
+
+      ./kubectl patch deployment sidata \
+        --namespace=sidata \
+        --type=strategic \
+        -p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"nexus-registry"}]}}}}'
+
+  # ==========================================================
+  # 17. ROLLOUT
+  # ==========================================================
+  - name: Rollout SIDATA
     shell: bash
     run: |
       set -e
@@ -410,11 +477,12 @@ steps:
 
       ./kubectl rollout status \
         deployment/sidata \
+        --namespace=sidata \
         --timeout=180s
 
-  # ============================================================
-  # 15. Verify
-  # ============================================================
+  # ==========================================================
+  # 18. VERIFY
+  # ==========================================================
   - name: Verify SIDATA
     shell: bash
     run: |
@@ -426,19 +494,30 @@ steps:
 
       echo ""
       echo "Deployment:"
-      ./kubectl get deployment sidata -o wide
+      ./kubectl get deployment sidata \
+        --namespace=sidata \
+        -o wide
 
       echo ""
       echo "Pods:"
-      ./kubectl get pods -l app=sidata -o wide
+      ./kubectl get pods \
+        --namespace=sidata \
+        -l app=sidata \
+        -o wide
 
       echo ""
       echo "Service:"
-      ./kubectl get service sidata -o wide
+      ./kubectl get service \
+        --namespace=sidata \
+        -o wide
 
       echo ""
       echo "Ingress:"
-      ./kubectl get ingress -A
+      ./kubectl get ingress \
+        --namespace=sidata \
+        -o wide || true
 
       echo ""
-      echo "SIDATA deployment selesai."
\ No newline at end of file
+      echo "=========================================="
+      echo "SIDATA DEPLOYMENT SELESAI"
+      echo "=========================================="
\ No newline at end of file