feat(webhook): Forgejo package webhook → ArgoCD image promotion (#55)

Closes #54

Replaces ArgoCD Image Updater with webhook-driven promotion.

## What changed

| File | Change |
|---|---|
| `internal/webhook/promoter.go` | NEW — ImagePromoter + promotion table (10 entries) |
| `internal/webhook/promoter_test.go` | NEW — 13 tests |
| `internal/webhook/forgejo.go` | package event routed to ImagePromoter |
| `k8s/rbac.yaml` | NEW — ClusterRole image-promoter + ClusterRoleBinding |
| `k8s/deployment.yaml` | REGISTRY_PAT env var |
| `k8s/network-policy.yaml` | egress cicd:3000 + default:443 |
| `k8s/kustomization.yaml` | rbac.yaml added |

## homelab repo changes needed

See comment on issue #54 for exact YAML.

---------

Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #55

k8s/deployment.yaml

@@ -95,6 +95,12 @@ spec:
               name: gotify-webhook-secret
               key: forgejo-webhook-secret
               optional: true
+        - name: REGISTRY_PAT
+          valueFrom:
+            secretKeyRef:
+              name: forgejo-registry-pat
+              key: pat
+              optional: true
         volumeMounts:
         - name: config
           mountPath: /etc/gateway

k8s/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
 - deployment.yaml
 - network-policy.yaml
 - gateway-config-secret.yaml
+- rbac.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
 # forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.

k8s/network-policy.yaml

@@ -150,3 +150,19 @@ spec:
       port: 80
     - protocol: TCP
       port: 9000
+  # Allow to Forgejo registry v2 API (image digest lookup for promotion)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: cicd
+    ports:
+    - protocol: TCP
+      port: 3000
+  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: default
+    ports:
+    - protocol: TCP
+      port: 443

k8s/rbac.yaml

@@ -0,0 +1,28 @@
+# RBAC for api-gateway image promotion.
+# Grants the api-gateway ServiceAccount get+patch on ArgoCD Applications
+# so it can update kustomize.images / helm.parameters after a container push.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: image-promoter
+  labels:
+    app: api-gateway
+rules:
+- apiGroups: ["argoproj.io"]
+  resources: ["applications"]
+  verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: image-promoter-api-gateway
+  labels:
+    app: api-gateway
+subjects:
+- kind: ServiceAccount
+  name: api-gateway
+  namespace: api
+roleRef:
+  kind: ClusterRole
+  name: image-promoter
+  apiGroup: rbac.authorization.k8s.io