From e0e5585d7cb82c83c6e27a246e69076f4e9d4499 Mon Sep 17 00:00:00 2001
From: Dalton Alvarenga <dalton.alvarenga@familiapires.com.br>
Date: Wed, 6 May 2026 09:42:07 -0300
Subject: [PATCH] fix(ci): build remoto via Cloud Build (sem docker local) +
 gke auth plugin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Step container do act-runner não consegue conectar no docker daemon
(dind sidecar usa tcp://localhost:2375 mas o step roda em network
isolada). Cloud Build resolve sem precisar configurar networking do
runner — bonus: build em VM linux/amd64 sem cross-compile.
---
 .gitea/workflows/cd.yml | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 1468922..e1307bb 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -14,16 +14,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Imagem default do runner (node:18-bullseye) não traz docker CLI nem kubectl —
-      # instalamos sob demanda. Eventualmente isso vai pra imagem custom do runner.
-      - name: Install docker CLI + kubectl
+      # Instala kubectl + auth plugin (gcloud já vem via setup-gcloud).
+      # Build é feito remoto via Cloud Build (não precisa Docker no runner).
+      - name: Install kubectl + gke-auth-plugin
         run: |
           apt-get update -qq
-          apt-get install -y -qq docker.io
-          KVER=$(curl -sL https://dl.k8s.io/release/stable.txt)
-          curl -sL "https://dl.k8s.io/release/${KVER}/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl
-          chmod +x /usr/local/bin/kubectl
-          docker --version && kubectl version --client=true
+          apt-get install -y -qq apt-transport-https ca-certificates gnupg curl
+          curl -fsSL https://packages.cloud.google.com/apt/doc/apt-key.gpg | gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+          echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" > /etc/apt/sources.list.d/google-cloud-sdk.list
+          apt-get update -qq
+          apt-get install -y -qq kubectl google-cloud-cli-gke-gcloud-auth-plugin
+          kubectl version --client=true
 
       - name: Auth GCP
         uses: google-github-actions/auth@v2
@@ -35,21 +36,16 @@ jobs:
         with:
           project_id: ${{ secrets.GCP_PROJECT }}
 
-      - name: Configure Docker auth
-        run: gcloud auth configure-docker ${{ secrets.AR_LOCATION }}-docker.pkg.dev --quiet
-
-      - name: Build image
+      - name: Build & push (Cloud Build, sem Docker local)
         run: |
           IMG="${IMAGE_BASE}/${{ gitea.event.repository.name }}:lab-${{ gitea.run_number }}"
-          docker build --platform=linux/amd64 -t "$IMG" .
+          gcloud builds submit --tag "$IMG" --project=${{ secrets.GCP_PROJECT }} --timeout=30m
           echo "IMG=$IMG" >> $GITHUB_ENV
 
-      - name: Push image (apenas em push pra master/main)
-        if: github.event_name == 'push'
-        run: docker push "$IMG"
-
       - name: Deploy hml2 (apenas em push pra master/main)
         if: github.event_name == 'push'
+        env:
+          USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
         run: |
           gcloud container clusters get-credentials ${{ secrets.GKE_CLUSTER }} --region ${{ secrets.GKE_REGION }} --project ${{ secrets.GCP_PROJECT }}
           NS=${{ secrets.K8S_NAMESPACE }}
@@ -64,7 +60,7 @@ jobs:
           if kubectl get deployment "$DEPLOYMENT" -n "$NS" >/dev/null 2>&1; then
             CONTAINER=$(kubectl get deployment "$DEPLOYMENT" -n "$NS" -o jsonpath='{.spec.template.spec.containers[0].name}')
             kubectl set image deployment/"$DEPLOYMENT" -n "$NS" "$CONTAINER=$IMG"
-            kubectl rollout status deployment/"$DEPLOYMENT" -n "$NS" --timeout=300s
+            kubectl rollout status deployment/"$DEPLOYMENT" -n "$NS" --timeout=600s
           else
             echo "Deployment $DEPLOYMENT não existe no ns $NS — pulei set image (provavelmente é o 1º deploy e o kubectl apply acabou de criar)"
           fi