Building a Forgejo Actions Runner on Podman for AsciiDoc Course Releases

# Build environment for my AsciiDoc trainings.
#
# Bundles everything resources/make/common.mk needs so a Forgejo Actions
# runner can build a course exactly like a local `make rebuild` does:
# asciidoctor-pdf/-revealjs/-diagram, decktape + Chromium, monolith, and
# the ImageMagick/cowsay toolchain used by scripts/mkcow + scripts/mkfp.
#
# Build from the root of the `resources` repo:
#   podman build -t build-env -f Containerfile .
#
FROM debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive \
	LANG=en_DK.utf8 \
	LC_ALL=en_DK.utf8 \
	PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"

RUN apt-get update && apt-get install -y --no-install-recommends \
		locales \
		ruby ruby-dev build-essential \
		python3 \
		git zip unzip curl ca-certificates jq \
		cowsay imagemagick fontconfig \
		chromium \
		nodejs npm \
		&& sed -i -e '/en_DK.UTF-8/s/^# //' -e '/en_US.UTF-8/s/^# //' -e '/nl_NL.UTF-8/s/^# //' /etc/locale.gen \
	&& locale-gen \
	&& sed -i 's/rights="none" pattern="@\*"\/>/rights="read" pattern="@*"\/>/' /etc/ImageMagick-6/policy.xml \
	&& rm -rf /var/lib/apt/lists/*

# decktape renders the reveal.js decks to PDF (resources/scripts/prt).
# Pinned to the version known to work with this reveal.js.
RUN npm install -g decktape@3.16.1

# monolith inlines the standalone presentation HTML (resources/make/common.mk
# `standalone` target). Prebuilt binary - no Rust toolchain needed in the image.
ARG MONOLITH_VERSION=v2.10.1
RUN curl -fsSL -o /usr/local/bin/monolith \
		"https://github.com/Y2Z/monolith/releases/download/${MONOLITH_VERSION}/monolith-gnu-linux-x86_64" \
	&& chmod +x /usr/local/bin/monolith

# Asciidoctor toolchain, pinned to the versions verified locally.
RUN gem install --no-document \
		asciidoctor:2.0.26 \
		asciidoctor-pdf:2.3.24 \
		asciidoctor-revealjs:5.2.0 \
		asciidoctor-diagram:3.2.1 \
		rouge:5.0.0

# Debian's `imagemagick` package is v6, which has no `magick` binary at all -
# that entry point is IM7-only. scripts/mkcow calls `magick` unconditionally
# (unlike scripts/mkfp, which already detects v6 vs v7 and falls back to
# `convert`), so give it a `magick` it can call: `-list ...` maps to the v6
# `identify -list ...`, everything else maps to `convert` (how IM7's `magick`
# behaves when the first argument isn't a recognized subcommand keyword).
RUN printf '%s\n' \
		'#!/bin/sh' \
		'if [ "$1" = "-list" ]; then shift; exec identify -list "$@"; fi' \
		'exec convert "$@"' \
		> /usr/local/bin/magick \
	&& chmod +x /usr/local/bin/magick

# Fonts used both by the reveal.js/PDF themes and, by name, by ImageMagick
# in scripts/mkcow + scripts/mkfp (FreeSans, SauceCodePro-NFM-SemiBold).
COPY fonts/*.ttf /usr/share/fonts/truetype/atcomp/
RUN fc-cache -f \
	&& magick -list font | grep -qx '  Font: FreeSans' \
	&& magick -list font | grep -qx '  Font: SauceCodePro-NFM-SemiBold'

# decktape/puppeteer can't use Chromium's setuid sandbox inside a container.
RUN printf '%s\n' \
		'#!/bin/sh' \
		'exec /usr/bin/chromium --no-sandbox --disable-dev-shm-usage "$@"' \
		> /usr/local/bin/chromium-nosandbox \
	&& chmod +x /usr/local/bin/chromium-nosandbox
ENV CHROME_PATH=/usr/local/bin/chromium-nosandbox

cd resources
podman build -t build-env -f Containerfile .

name: release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  release:
    runs-on: asciidoctor
    steps:
      - name: Check out course
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify tag is on main
        run: |
          git fetch origin main:refs/remotes/origin/main
          if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then
            echo "Tag ${{ github.ref_name }} is not on main, aborting." >&2
            exit 1
          fi

      - name: Verify tag matches settings.adoc version
        run: |
          VERSION=$(awk '$1 == ":revnumber:" { print $2 }' settings.adoc)
          if [ "${{ github.ref_name }}" != "$VERSION" ]; then
            echo "Pushed tag ${{ github.ref_name }} does not match settings.adoc revnumber $VERSION" >&2
            exit 1
          fi

      - name: Check out shared resources
        env:
          RESOURCES_TOKEN: ${{ secrets.RUNNER_TOKEN }}
        run: |
          rm -rf ../resources
          git clone --depth 1 "https://x-access-token:${RESOURCES_TOKEN}@git.example.com/training_adoc/resources.git" ../resources

      - name: Build zip
        run: make zip

      - name: Create release and upload zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          API="https://git.example.com/api/v1/repos/${{ github.repository }}"
          TAG="${{ github.ref_name }}"

          RELEASE_ID=$(curl -sS -f -X POST -H "Authorization: token $GITHUB_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"target_commitish\":\"${{ github.sha }}\"}" \
            "$API/releases" | jq -r .id)

          NAME=$(awk '$1 == ":docname:" { print $2 }' settings.adoc)
          VERSION=$(awk '$1 == ":revnumber:" { print $2 }' settings.adoc)

          for zip in training_${NAME}_${VERSION}*.zip; do
            [ -e "$zip" ] || continue
            echo "Uploading $zip"
            curl -sS -f -X POST -H "Authorization: token $GITHUB_TOKEN" \
              -H "Content-Type: application/zip" \
              --data-binary "@$zip" \
              "$API/releases/$RELEASE_ID/assets?name=$zip"
          done