feat(webhook): Forgejo package webhook → ArgoCD image promotion #55

Merged

rock merged 1 commits from harness/54-package-webhook-promotion into main

2026-09-28 02:45:43 +00:00

Author	SHA1	Message	Date
Admin Bot	1a122b0046	feat(webhook): Forgejo package webhook \u2192 ArgoCD image promotion (#54 ) CI / CI (pull_request) Successful in 2m11s Details Replaces ArgoCD Image Updater with a webhook-driven approach. When Forgejo fires X-Gitea-Event: package (action: created, type: container): 1. Extract image owner+name+version from payload 2. Look up in static promotion table (10 images \u2192 ArgoCD apps) 3. Fetch digest from Forgejo registry v2 API (Basic auth, REGISTRY_PAT) 4. Read-modify-write ArgoCD Application CR via k8s API (in-cluster SA token) - kustomize: JSON Patch /spec/sources[N]/kustomize/images - helm: JSON Patch /spec/source/helm/parameters (runner.image.*) 5. Send Gotify notification with promotion result Key design: - Raw http.Client only \u2014 no client-go dependency - context.Context propagated through all outbound calls - Retry up to 3x on 409 Conflict (concurrent poimen-toolkit promotions) - Request ID per invocation for log correlation - Promotion table covers: api-gw, portfolio, poimen (3 sources), poimen-toolkit (2 images), forgejo-runner-{golang,node,rust} RBAC: ClusterRole image-promoter (get+patch applications.argoproj.io) bound to api-gateway SA NetworkPolicy: egress to cicd:3000 (registry) + default:443 (k8s API) Deployment: REGISTRY_PAT from forgejo-registry-pat secret 13 tests in promoter_test.go, all pass Closes #54	2026-09-28 10:41:53 +08:00

Author

SHA1

Message

Date

Admin Bot

1a122b0046

feat(webhook): Forgejo package webhook \u2192 ArgoCD image promotion (#54 )

CI / CI (pull_request) Successful in 2m11s

Details

Replaces ArgoCD Image Updater with a webhook-driven approach.

When Forgejo fires X-Gitea-Event: package (action: created, type: container):
1. Extract image owner+name+version from payload
2. Look up in static promotion table (10 images \u2192 ArgoCD apps)
3. Fetch digest from Forgejo registry v2 API (Basic auth, REGISTRY_PAT)
4. Read-modify-write ArgoCD Application CR via k8s API (in-cluster SA token)
   - kustomize: JSON Patch /spec/sources[N]/kustomize/images
   - helm:      JSON Patch /spec/source/helm/parameters (runner.image.*)
5. Send Gotify notification with promotion result

Key design:
- Raw http.Client only \u2014 no client-go dependency
- context.Context propagated through all outbound calls
- Retry up to 3x on 409 Conflict (concurrent poimen-toolkit promotions)
- Request ID per invocation for log correlation
- Promotion table covers: api-gw, portfolio, poimen (3 sources), poimen-toolkit (2 images), forgejo-runner-{golang,node,rust}

RBAC: ClusterRole image-promoter (get+patch applications.argoproj.io) bound to api-gateway SA
NetworkPolicy: egress to cicd:3000 (registry) + default:443 (k8s API)
Deployment: REGISTRY_PAT from forgejo-registry-pat secret
13 tests in promoter_test.go, all pass

Closes #54

2026-09-28 10:41:53 +08:00