riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(webhook): Forgejo package webhook → ArgoCD image promotion #55

Merged
rock merged 1 commits from harness/54-package-webhook-promotion into main 2026-09-28 02:45:43 +00:00
Conversation 0 Commits 1 Files Changed 7
+968 -9
rock commented 2026-09-28 02:42:17 +00:00
Owner
Copy Link
Copy Source

Closes #54

Replaces ArgoCD Image Updater with webhook-driven promotion.

What changed

File Change
internal/webhook/promoter.go NEW — ImagePromoter + promotion table (10 entries)
internal/webhook/promoter_test.go NEW — 13 tests
internal/webhook/forgejo.go package event routed to ImagePromoter
k8s/rbac.yaml NEW — ClusterRole image-promoter + ClusterRoleBinding
k8s/deployment.yaml REGISTRY_PAT env var
k8s/network-policy.yaml egress cicd:3000 + default:443
k8s/kustomization.yaml rbac.yaml added

homelab repo changes needed

See comment on issue #54 for exact YAML.

Closes #54 Replaces ArgoCD Image Updater with webhook-driven promotion. ## What changed | File | Change | |---|---| | `internal/webhook/promoter.go` | NEW — ImagePromoter + promotion table (10 entries) | | `internal/webhook/promoter_test.go` | NEW — 13 tests | | `internal/webhook/forgejo.go` | package event routed to ImagePromoter | | `k8s/rbac.yaml` | NEW — ClusterRole image-promoter + ClusterRoleBinding | | `k8s/deployment.yaml` | REGISTRY_PAT env var | | `k8s/network-policy.yaml` | egress cicd:3000 + default:443 | | `k8s/kustomization.yaml` | rbac.yaml added | ## homelab repo changes needed See comment on issue #54 for exact YAML.
rock added 1 commit 2026-09-28 02:42:18 +00:00
feat(webhook): Forgejo package webhook \u2192 ArgoCD image promotion (#54)
CI / CI (pull_request) Successful in 2m11s
Details
1a122b0046 
Replaces ArgoCD Image Updater with a webhook-driven approach.

When Forgejo fires X-Gitea-Event: package (action: created, type: container):
1. Extract image owner+name+version from payload
2. Look up in static promotion table (10 images \u2192 ArgoCD apps)
3. Fetch digest from Forgejo registry v2 API (Basic auth, REGISTRY_PAT)
4. Read-modify-write ArgoCD Application CR via k8s API (in-cluster SA token)
   - kustomize: JSON Patch /spec/sources[N]/kustomize/images
   - helm:      JSON Patch /spec/source/helm/parameters (runner.image.*)
5. Send Gotify notification with promotion result

Key design:
- Raw http.Client only \u2014 no client-go dependency
- context.Context propagated through all outbound calls
- Retry up to 3x on 409 Conflict (concurrent poimen-toolkit promotions)
- Request ID per invocation for log correlation
- Promotion table covers: api-gw, portfolio, poimen (3 sources), poimen-toolkit (2 images), forgejo-runner-{golang,node,rust}

RBAC: ClusterRole image-promoter (get+patch applications.argoproj.io) bound to api-gateway SA
NetworkPolicy: egress to cicd:3000 (registry) + default:443 (k8s API)
Deployment: REGISTRY_PAT from forgejo-registry-pat secret
13 tests in promoter_test.go, all pass

Closes #54
rock merged commit 23fff1006a into main 2026-09-28 02:45:43 +00:00
rock deleted branch harness/54-package-webhook-promotion 2026-09-28 02:45:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#55