FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
(Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
(distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials
TASK ARCHITECTURE:
sidecar: gateway image (mounts config secret, runs on localhost)
step: curlimages/curl (runs integration-test.sh from ConfigMap)
TEST COVERAGE:
health, header validation, memory, s3, sqs, workflow, iam
Add integration test suite that tests against production cluster:
- Memory service (ingest, query)
- S3 adapter (list, put objects)
- SQS adapter (list queues with auth enforcement)
- Workflow adapter (gRPC ListWorkflowExecutions)
- IAM adapter (list users)
- Health endpoints (liveness, readiness)
Update CI/CD pipeline:
- Build new docker image from commit
- Push to registry with commit SHA and latest tags
- Deploy test job to cluster to run integration tests
- Tests run against actual production services
- Cleanup test resources after completion
Add Kubernetes Job manifest:
- Runs integration tests in dedicated pod
- Waits for gateway to be ready before testing
- Tests all adapters and downstream services
- Can be run manually: kubectl apply -f k8s/integration-test-job.yaml
- Single job (no split test/build-push)
- DOCKER_HOST=tcp://localhost:2375 for dind
- Build + push on PRs too (verify before merge)
- workflow_dispatch for manual trigger
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#4
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.
Uses the proven pattern from riotpiao.com reference commit.
This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.
After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push
---------
Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: rock/homelab-frontend#2
Container override breaks docker socket access to dind sidecar.
Changes:
- Remove 'container: image: golang:1.26-bookworm'
- Install Node.js before checkout (required by actions runtime)
- Install docker.io in build step (required for docker build/push)
Now works with shared docker socket via dind sidecar.
Problem: Push job used docker:27-cli override with explicit dind cert
mounting, but runner base changed to code.forgejo.org/forgejo/runner:6.
Alpine container couldn't access Debian runner's dind socket paths.
Fix:
- Remove container override, run on golang runner natively
- Install docker.io directly in push step (apt-get)
- Add docker image prune post-action to cleanup
This pattern matches riotpiao.com CI and works with current runner setup.
Adapters defined in config.yaml alongside routes and models.
Parsed by existing config loader, populated into registry at startup.
Removed: client-go deps, REST loader, informer, nginx proxy,
CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types).
Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.
actions/checkout@v4 is a JS action; Forgejo Actions runs it via node, which
neither golang:1.25-bookworm nor docker:27-cli ship. Every run since the
.gitea/workflows move has failed identically: 'exec: node: executable file
not found in $PATH' during the checkout step, before any real job step ran.
Verified locally against both exact images before pushing:
- golang:1.25-bookworm: apt-get install nodejs ca-certificates git -> node
v18.20.4, git 2.39.5.
- docker:27-cli: apk add nodejs git -> node v22.23.2, git 2.47.2, and
actions/checkout's dist/index.js actually executes afterward (confirmed
by invoking it directly) instead of failing on a missing binary.
- The Dockerfile itself builds clean end to end and the resulting image
serves /healthz, so checkout was the only remaining blocker in the path.
.forgejo/workflows/*.yaml never creates an action_run on push on this
Forgejo instance (1.27.0) -- confirmed directly in the action_run table
across multiple probe pushes. .gitea/workflows fires immediately with an
identical spec. This is why build.yaml never once executed.
Admin Bot
rockandAdmin Bot