feat: switch image-updater to digest-based :latest tracking

All image-updater annotations now use update-strategy: digest with allow-tags: ^latest$ and write-back-method: argocd. No SHA tags committed to git — digest overrides stored in ArgoCD state only. - poimen: git write-back → argocd, removed git-branch - portfolio: newest-build SHA → digest latest - api-gateway: newest-build SHA → digest latest
revert: remove unsupported buildOptions (ArgoCD v3.4.5 doesn't support it)
2026-09-07 18:19:46 -07:00 · 2026-09-07 17:49:58 -07:00 · 2026-09-07 17:47:03 -07:00 · 2026-09-07 13:22:09 -07:00 · 2026-09-07 13:20:20 -07:00 · 2026-09-07 13:18:54 -07:00
4 changed files with 14 additions and 19 deletions
@@ -38,8 +38,8 @@ metadata:
    argocd.argoproj.io/sync-wave: "7"
    # ArgoCD Image Updater - auto-update on new image push
    argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
-    argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/gw.update-strategy: digest
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^latest$
    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
  project: homelab
@@ -248,8 +248,8 @@ metadata:
    argocd.argoproj.io/sync-wave: "8"
    # ArgoCD Image Updater - auto-update on new image push
    argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
-    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/app.update-strategy: digest
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^latest$
    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
  project: homelab
@@ -10,14 +10,13 @@ metadata:
      memory=forgejo.riotpiao.com/rock/poimen-memory
      workflows=forgejo.riotpiao.com/rock/poimen-workflows
      frontend=forgejo.riotpiao.com/rock/poimen-frontend
-    argocd-image-updater.argoproj.io/memory.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/workflows.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/frontend.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/write-back-method: git
-    argocd-image-updater.argoproj.io/git-branch: main
+    argocd-image-updater.argoproj.io/memory.update-strategy: digest
+    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/workflows.update-strategy: digest
+    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
+    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
  project: homelab
  sources:
@@ -60,15 +60,11 @@ spec:
      containers:
        - name: runner
          image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
+          command: ["sh", "-c", "while ! wget -q -O- http://localhost:2375/_ping >/dev/null 2>&1; do echo 'waiting for dind...'; sleep 2; done; echo 'dind ready'; forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
          workingDir: /data
          env:
            - name: DOCKER_HOST
-              value: tcp://localhost:2376
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
+              value: tcp://localhost:2375
          volumeMounts:
            - name: runner-data
              mountPath: /data
@@ -91,7 +87,7 @@ spec:
            privileged: true    # required for DinD; cicd namespace is labelled privileged
          env:
            - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
          volumeMounts:
            - name: docker-certs
              mountPath: /docker-certs
Author	SHA1	Message	Date
rock	8983720d3a	feat: switch image-updater to digest-based :latest tracking All image-updater annotations now use update-strategy: digest with allow-tags: ^latest$ and write-back-method: argocd. No SHA tags committed to git — digest overrides stored in ArgoCD state only. - poimen: git write-back → argocd, removed git-branch - portfolio: newest-build SHA → digest latest - api-gateway: newest-build SHA → digest latest	2026-09-07 18:19:46 -07:00
rock	f13ee1ba21	revert: remove unsupported buildOptions (ArgoCD v3.4.5 doesn't support it) - buildOptions field not available in ArgoCD v3.4.5 - SOPS decryption already handled by repo-server ksops plugin - Revert to simple kustomize config - Portfolio Application can now sync properly	2026-09-07 17:49:58 -07:00
rock	99bd163f0b	fix: enable ksops plugin for portfolio Application - Add kustomize config with --enable-alpha-plugins to support ksops - Allows ArgoCD to properly decrypt SOPS-encrypted files - Fixes Image Updater compatibility with sops field in kustomization.yaml	2026-09-07 17:47:03 -07:00
rock	e28e3cae81	fix: wait for dind to be ready before starting runner daemon	2026-09-07 13:22:09 -07:00
rock	febfb055ae	fix: use tcp://localhost:2375 for dind (no TLS, no socket permission issues)	2026-09-07 13:20:20 -07:00
rock	9d61c42b99	fix: run runner as root to access dind socket	2026-09-07 13:18:54 -07:00
rock	594e752d47	fix: runner uses unix socket instead of TLS TCP for dind Job containers spawned by the runner run inside dind. With TCP+TLS (tcp://localhost:2376), localhost inside those containers doesn't reach the dind sidecar. Unix socket at /run/docker.sock works because both runner and dind share the /run emptyDir. Also disables DOCKER_TLS_CERTDIR so dind creates the socket instead of only listening on TLS TCP.	2026-09-07 13:16:49 -07:00
rock	1a8e87131b	ci: fix runner labels + CoreDNS rewrite + cleanup - Runners use public images (code.forgejo.org/forgejo/runner:6) - Labels pull from Docker Hub: golang:1.26, node:22, rust:1-bookworm - Add CoreDNS api.riotpiao.com rewrite - Fix runner re-registration to keep labels in sync - Add unified CI pattern docs to CLAUDE.example.md - Remove dead .forgejo/ workflow dir (Forgejo uses .gitea/)	2026-09-07 13:01:56 -07:00