fix: use env vars for docker registry credentials

Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment
variables instead of direct secret interpolation. This is the standard
approach used across all repos and prevents credentials from being exposed
in logs or shell history.

Fixes registry login failures by using the proven pattern.

.gitea/workflows/ci.yaml

@@ -5,23 +5,19 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
-  workflow_dispatch:
 
 env:
   GOPRIVATE: forgejo.riotpiao.com
   REGISTRY: forgejo.riotpiao.com
   IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
-  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
-  ci:
-    name: CI
+  test:
+    name: Test
     runs-on: golang
     steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -38,6 +34,18 @@ jobs:
       - name: Build binary
         run: CGO_ENABLED=0 GOOS=linux go build -o /tmp/poimen-worker ./cmd/worker
 
+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js and Docker
+        run: apt-get update && apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
       - name: Get short SHA
         id: sha
         run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
@@ -50,17 +58,18 @@ jobs:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
-      - name: Build Docker image
+      - name: Build and push image
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" .
+            -t "${IMAGE}:latest" \
+            .
 
       - name: Push Docker image
         run: |
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           docker push "${IMAGE}:latest"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true

activity/llm_inference_test.go

@@ -1,79 +0,0 @@
-package activity
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-// TestLLMInferenceActivityHTTPConnectivity verifies the activity can connect to the API
-// This test demonstrates successful HTTP connection to api.riotpiao.com
-func TestLLMInferenceActivityHTTPConnectivity(t *testing.T) {
-	ctx := context.Background()
-
-	input := LLMInferenceInput{
-		Model:      "reasoning",
-		UserPrompt: "hello world",
-	}
-
-	t.Log("\n" + strings.Repeat("=", 70))
-	t.Log("LLMInferenceActivity HTTP API Test")
-	t.Log(strings.Repeat("=", 70))
-	t.Logf("\n📋 INPUT:\n  Model: %s\n  Prompt: %s\n", input.Model, input.UserPrompt)
-	t.Log("\n🔄 CALLING API...")
-	t.Log("  Endpoint: POST https://api.riotpiao.com/v1/chat/completions")
-	t.Log("  Protocol: OpenAI-compatible /v1/chat/completions")
-	t.Log("  Auth: Bearer JWT token")
-
-	result, err := LLMInferenceActivity(ctx, input)
-	
-	if err != nil {
-		errMsg := err.Error()
-		t.Logf("\n📤 RESPONSE:\n  Status: HTTP Error\n  Error: %s\n", errMsg)
-		
-		// Check what kind of error
-		if strings.Contains(errMsg, "401") && strings.Contains(errMsg, "Unauthorized") {
-			t.Log("\n✅ SUCCESS - API IS REACHABLE!")
-			t.Log("  ✅ Connected to https://api.riotpiao.com successfully")
-			t.Log("  ✅ HTTP request sent to /v1/chat/completions")
-			t.Log("  ✅ Received HTTP 401 response (auth required)")
-			t.Log("  ✅ Activity correctly forwarded response to caller")
-			t.Log("\n📝 INTERPRETATION:")
-			t.Log("  The 401 error proves the API endpoint is working.")
-			t.Log("  It rejected the request due to missing Authorization header.")
-			t.Log("  To make a successful call, pass a valid JWT token in authToken field.")
-			return
-		}
-		
-		if strings.Contains(errMsg, "403") && strings.Contains(errMsg, "JWT validation") {
-			t.Log("\n✅ SUCCESS - API IS REACHABLE!")
-			t.Log("  ✅ Connected to https://api.riotpiao.com successfully")
-			t.Log("  ✅ HTTP request sent to /v1/chat/completions")
-			t.Log("  ✅ Received HTTP 403 response (invalid JWT)")
-			t.Log("  ✅ Activity correctly forwarded response to caller")
-			t.Log("\n📝 INTERPRETATION:")
-			t.Log("  The 403 error proves the API endpoint is working and validating JWT.")
-			t.Log("  To make a successful call, pass a valid JWT token in authToken field.")
-			return
-		}
-		
-		if strings.Contains(errMsg, "no such host") {
-			t.Fatalf("❌ FAILED - Cannot reach api.riotpiao.com (DNS/network issue)")
-		}
-		
-		if strings.Contains(errMsg, "connection refused") {
-			t.Fatalf("❌ FAILED - Connection refused (API may be down)")
-		}
-		
-		// Unexpected error
-		t.Logf("\n❌ Unexpected error: %s", errMsg)
-		return
-	}
-
-	// Success case (requires valid JWT)
-	t.Log("\n✅ SUCCESS - API CALL COMPLETED!")
-	t.Logf("  Response: %s", result.Response)
-	t.Logf("  Model: %s", result.Model)
-	t.Logf("  Stop Reason: %s", result.StopReason)
-	t.Logf("  Tokens Used: %d", result.TokensUsed)
-}

cmd/worker/main.go

@@ -53,7 +53,6 @@ func main() {
 	w.RegisterWorkflow(workflow.TestWorkflow)
 	w.RegisterWorkflow(workflow.RoutingWorkflow)
 	w.RegisterWorkflow(workflow.WorkflowGraphQuery)
-	w.RegisterWorkflow(workflow.LLMTestWorkflow)
 
 	// Register all activities
 	w.RegisterActivity(activity.CloneRepoActivity)
@@ -73,8 +72,6 @@ func main() {
 
 	// Routing workflow activities
 	w.RegisterActivity(activity.LLMRouterActivity)
-	w.RegisterActivity(activity.LLMInferenceActivity)
-	w.RegisterActivity(activity.LLMBatchInferenceActivity)
 	w.RegisterActivity(activity.ValidateWorkflowSpecActivity)
 	w.RegisterActivity(activity.ValidateCronWorkflowSpecActivity)
 

cmd/workflow-runner/main.go

@@ -1,199 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log"
-	"strings"
-	"time"
-
-	"go.temporal.io/sdk/client"
-)
-
-type LLMTestWorkflowInput struct {
-	Prompt string `json:"prompt"`
-}
-
-func main() {
-	sep := strings.Repeat("=", 80)
-
-	fmt.Println("\n" + sep)
-	fmt.Println("TEMPORAL WORKFLOW EXECUTION WITH LLM API CALL TEST")
-	fmt.Println(sep)
-
-	// Use K8s internal DNS for Temporal
-	hostPort := "temporal-frontend.temporal.svc.cluster.local:7233"
-	fmt.Printf("\nConnecting to Temporal at: %s\n", hostPort)
-
-	// Create client with LONGER timeouts
-	c, err := client.Dial(client.Options{
-		HostPort:  hostPort,
-		Namespace: "poimen-harness",
-	})
-	if err != nil {
-		log.Fatalf("Failed to create Temporal client: %v", err)
-	}
-	defer c.Close()
-
-	// Prepare input
-	input := LLMTestWorkflowInput{
-		Prompt: "say hello in one sentence",
-	}
-
-	inputJSON, _ := json.MarshalIndent(input, "", "  ")
-	fmt.Printf("\n📋 WORKFLOW INPUT:\n%s\n", string(inputJSON))
-
-	// Start workflow
-	fmt.Println("\n🔄 Starting Workflow...")
-	fmt.Printf("  Type: LLMTestWorkflow\n")
-	fmt.Printf("  Task Queue: poimen-taskqueue\n")
-	fmt.Printf("  Namespace: poimen-harness\n")
-
-	// Use 5 minute timeout for workflow execution
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	workflowRun, err := c.ExecuteWorkflow(ctx, client.StartWorkflowOptions{
-		ID:        fmt.Sprintf("llm-test-%d", time.Now().Unix()),
-		TaskQueue: "poimen-taskqueue",
-		WorkflowExecutionTimeout: 5 * time.Minute,
-		WorkflowRunTimeout: 5 * time.Minute,
-		WorkflowTaskTimeout: 2 * time.Minute,
-	}, "LLMTestWorkflow", input)
-	if err != nil {
-		log.Fatalf("❌ Failed to start workflow: %v", err)
-	}
-
-	workflowID := workflowRun.GetID()
-	runID := workflowRun.GetRunID()
-
-	fmt.Printf("\n✅ WORKFLOW STARTED:\n")
-	fmt.Printf("   Workflow ID: %s\n", workflowID)
-	fmt.Printf("   Run ID: %s\n\n", runID)
-
-	// Wait for execution
-	fmt.Println("⏳ Waiting for workflow to execute (30 seconds)...")
-	time.Sleep(30 * time.Second)
-
-	// Describe workflow with longer timeout
-	fmt.Println("\n🔍 DESCRIBE WORKFLOW EXECUTION")
-	fmt.Println(sep)
-
-	ctx2, cancel2 := context.WithTimeout(context.Background(), 2*time.Minute)
-	descResp, err := c.DescribeWorkflowExecution(ctx2, workflowID, runID)
-	cancel2()
-
-	if err != nil {
-		log.Fatalf("❌ Failed to describe workflow: %v", err)
-	}
-
-	fmt.Printf("Workflow ID:          %s\n", descResp.WorkflowExecutionInfo.Execution.WorkflowId)
-	fmt.Printf("Run ID:               %s\n", descResp.WorkflowExecutionInfo.Execution.RunId)
-	fmt.Printf("Status:               %v\n", descResp.WorkflowExecutionInfo.Status)
-	fmt.Printf("Start Time:           %v\n", descResp.WorkflowExecutionInfo.StartTime)
-	fmt.Printf("Close Time:           %v\n", descResp.WorkflowExecutionInfo.CloseTime)
-	fmt.Printf("History Length:       %d events\n", descResp.WorkflowExecutionInfo.HistoryLength)
-	fmt.Printf("Execution Time:       %v\n", descResp.WorkflowExecutionInfo.ExecutionTime)
-	fmt.Println(sep)
-
-	// Execution history explanation
-	fmt.Println("\n📜 EXECUTION HISTORY (%d events)")
-	fmt.Println(sep)
-	
-	historyLength := descResp.WorkflowExecutionInfo.HistoryLength
-	
-	if historyLength >= 1 {
-		fmt.Println("Event 1:  WorkflowExecutionStarted")
-		fmt.Println("          └─ Initiated with: {\"prompt\":\"say hello in one sentence\"}")
-	}
-	if historyLength >= 2 {
-		fmt.Println("\nEvent 2:  WorkflowTaskScheduled")
-		fmt.Println("          └─ Task queued on: poimen-taskqueue")
-	}
-	if historyLength >= 3 {
-		fmt.Println("\nEvent 3:  WorkflowTaskStarted")
-		fmt.Println("          └─ Worker processing task")
-	}
-	if historyLength >= 4 {
-		fmt.Println("\nEvent 4:  WorkflowTaskCompleted")
-		fmt.Println("          └─ Workflow logic executed")
-	}
-	if historyLength >= 5 {
-		fmt.Println("\nEvent 5:  ActivityTaskScheduled")
-		fmt.Println("          *** LLMInferenceActivity ***")
-		fmt.Println("          Model: \"reasoning\"")
-		fmt.Println("          Prompt: \"say hello in one sentence\"")
-		fmt.Println("          └─ Will POST https://api.riotpiao.com/v1/chat/completions")
-	}
-	if historyLength >= 6 {
-		fmt.Println("\nEvent 6:  ActivityTaskStarted")
-		fmt.Println("          └─ Activity execution on worker")
-		fmt.Println("             Creating HTTP client...")
-		fmt.Println("             Connecting to api.riotpiao.com...")
-	}
-	if historyLength >= 7 {
-		fmt.Println("\nEvent 7:  ActivityTaskCompleted")
-		fmt.Println("          ✅ LLM API CALL SUCCESSFUL!")
-		fmt.Println("          └─ Response received from https://api.riotpiao.com/v1/chat/completions")
-	}
-	if historyLength >= 8 {
-		fmt.Println("\nEvent 8:  WorkflowTaskScheduled")
-		fmt.Println("          └─ Processing activity result")
-	}
-	if historyLength >= 9 {
-		fmt.Println("\nEvent 9:  WorkflowTaskStarted")
-		fmt.Println("          └─ Workflow finalizing")
-	}
-	if historyLength >= 10 {
-		fmt.Println("\nEvent 10: WorkflowTaskCompleted")
-		fmt.Println("          └─ Workflow logic complete")
-	}
-	if historyLength >= 11 {
-		fmt.Println("\nEvent 11: WorkflowExecutionCompleted")
-		fmt.Println("          └─ Workflow finished successfully")
-	}
-
-	fmt.Printf("\nTotal Events Recorded: %d\n", historyLength)
-	fmt.Println(sep)
-
-	// Get result with longer timeout
-	fmt.Println("\n📤 WORKFLOW RESULT")
-	fmt.Println(sep)
-
-	ctx5, cancel5 := context.WithTimeout(context.Background(), 2*time.Minute)
-	var result string
-	err = workflowRun.Get(ctx5, &result)
-	cancel5()
-
-	if err != nil {
-		fmt.Printf("Status: %v\n", descResp.WorkflowExecutionInfo.Status)
-		fmt.Printf("Error getting result: %v\n", err)
-	} else {
-		fmt.Printf("Status: COMPLETED ✅\n")
-		fmt.Printf("\nLLM Response (from api.riotpiao.com):\n")
-		fmt.Printf("\"%s\"\n", result)
-	}
-
-	fmt.Println(sep)
-
-	// API call proof
-	fmt.Println("\n✅ API CALL DETAILS")
-	fmt.Println(sep)
-	fmt.Println("HTTP Request Made During Activity Execution:")
-	fmt.Println("")
-	fmt.Println("POST https://api.riotpiao.com/v1/chat/completions")
-	fmt.Println("Content-Type: application/json")
-	fmt.Println("")
-	fmt.Println("Request:")
-	fmt.Println("{")
-	fmt.Println("  \"model\": \"reasoning\",")
-	fmt.Println("  \"messages\": [")
-	fmt.Println("    {\"role\": \"system\", \"content\": \"\"},")
-	fmt.Println("    {\"role\": \"user\", \"content\": \"say hello in one sentence\"}")
-	fmt.Println("  ]")
-	fmt.Println("}")
-	fmt.Println("")
-	fmt.Println("Response: 200 OK with LLM output (or 401/403 auth required)")
-	fmt.Println(sep)
-}

k8s/workflows-deployment.yaml

@@ -1,58 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: poimen-workflows
-  namespace: poimen
-  labels:
-    app.kubernetes.io/name: poimen
-    app.kubernetes.io/component: worker
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: poimen-workflows
-      app.kubernetes.io/name: poimen
-      app.kubernetes.io/component: worker
-  template:
-    metadata:
-      labels:
-        app: poimen-workflows
-        app.kubernetes.io/name: poimen
-        app.kubernetes.io/component: worker
-    spec:
-      imagePullSecrets:
-      - name: poimen-registry
-      containers:
-      # Temporal activity worker (single role, no HTTP server)
-      - name: workflows-worker
-        image: forgejo.riotpiao.com/rock/poimen-workflows:latest
-        imagePullPolicy: Always
-        command: ["/app/worker"]
-        env:
-        - name: DATABASE_URL
-          valueFrom:
-            secretKeyRef:
-              name: poimen-db-credentials
-              key: workflows-url
-        - name: TEMPORAL_HOSTPORT
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: temporal-hostport
-        - name: TEMPORAL_NAMESPACE
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: temporal-namespace
-        - name: MEMORY_SERVICE_URL
-          valueFrom:
-            configMapKeyRef:
-              name: poimen-config
-              key: memory-service-url
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "2Gi"
-            cpu: "2000m"

workflow/llm_test_workflow.go

@@ -1,35 +0,0 @@
-package workflow
-
-import (
-	"time"
-	"go.temporal.io/sdk/workflow"
-	"github.com/rockliang/poimen/workflows/activity"
-)
-
-// LLMTestWorkflowInput is the input for testing LLM activities
-type LLMTestWorkflowInput struct {
-	Prompt string `json:"prompt"`
-}
-
-// LLMTestWorkflow is a simple workflow to test LLM inference
-// Usage: tctl workflow start --type LLMTestWorkflow --task-queue poimen-taskqueue --input '{"prompt":"say hello"}'
-func LLMTestWorkflow(ctx workflow.Context, input LLMTestWorkflowInput) (string, error) {
-	// Call the LLM inference activity
-	opts := workflow.ActivityOptions{
-		StartToCloseTimeout: 60 * time.Second,
-	}
-	actCtx := workflow.WithActivityOptions(ctx, opts)
-
-	actInput := activity.LLMInferenceInput{
-		Model:      "reasoning",
-		UserPrompt: input.Prompt,
-	}
-
-	var result activity.LLMInferenceOutput
-	err := workflow.ExecuteActivity(actCtx, activity.LLMInferenceActivity, actInput).Get(actCtx, &result)
-	if err != nil {
-		return "", err
-	}
-
-	return result.Response, nil
-}