ci: merge 3 workflows into single pipeline, add concurrency group

.gitea/workflows/build-prod.yaml

@@ -1,58 +0,0 @@
-# Build and push on main branch — triggered automatically when commits land on main.
-# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
-# Image: forgejo.riotpiao.com/rock/api-gateway:<commit-sha>
-#
-# ArgoCD auto-deploys to api namespace as revisions roll in.
-name: Build and push
-
-on:
-  push:
-    branches: [main]
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/api-gateway
-
-jobs:
-  build:
-    name: Build and push image
-    runs-on: golang
-    container:
-      image: docker:27-cli
-      volumes:
-        - /docker-certs/client:/docker-certs/client:ro
-    env:
-      DOCKER_HOST: tcp://localhost:2376
-      DOCKER_TLS_VERIFY: "1"
-      DOCKER_CERT_PATH: /docker-certs/client
-    steps:
-      - name: install node (required by JS-based actions)
-        run: apk add --no-cache nodejs git
-
-      - uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
-            --username rock --password-stdin
-        env:
-          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
-
-      - name: Build
-        run: |
-          docker build \
-            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-
-      - name: Push
-        run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"

.gitea/workflows/build.yaml

@@ -1,87 +0,0 @@
-# Forgejo Actions build — push image on main only.
-# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
-# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
-# Enabled by Stage 1 (B, C1).
-name: Build
-
-on:
-  push:
-    branches: [main]
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/api-gateway
-
-jobs:
-  build:
-    name: Build and push image
-    # golang, not a retired generic "docker" runner -- this repo is Go, and
-    # every runner now carries its own dind sidecar to build/push that
-    # repo's images. `container.image` below overrides the runner's own
-    # default (golang:1.26-bookworm) with docker:27-cli for this job only.
-    runs-on: golang
-    container:
-      image: docker:27-cli
-      # No `options: --network host` here -- act_runner ignores that per-job
-      # override and always decides the job container's network from its own
-      # config.yaml (container.network), which defaults to an isolated
-      # per-job bridge. Confirmed live: with that default, DOCKER_HOST=
-      # tcp://localhost:2376 resolved to the job container itself, not dind,
-      # so every command past `docker login` (which never touches DOCKER_HOST
-      # -- it only talks to the registry) failed with "Cannot connect to the
-      # Docker daemon". host networking is set once, for every job, in the
-      # runner's own Helm chart.
-      #
-      # The mTLS certs dind generates at startup are a separate gap: they
-      # live in an emptyDir mounted into the runner/dind containers, not into
-      # containers a workflow spins up. Job containers get no bind mounts at
-      # all unless the path is in the runner's container.valid_volumes
-      # allowlist (empty by default -- this exact mount was rejected until
-      # the runner's Helm chart added a config.yaml scoping valid_volumes to
-      # exactly this path).
-      volumes:
-        - /docker-certs/client:/docker-certs/client:ro
-    env:
-      DOCKER_HOST: tcp://localhost:2376
-      DOCKER_TLS_VERIFY: "1"
-      DOCKER_CERT_PATH: /docker-certs/client
-    steps:
-      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
-      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
-      # checkout step fails with "exec: node: executable file not found in
-      # $PATH" before any of the job's own steps run. Verified locally:
-      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
-      # git 2.47, and the checkout action's dist/index.js then actually
-      # executes (confirmed by running it directly) instead of failing on a
-      # missing binary.
-      - name: install node (required by JS-based actions)
-        run: apk add --no-cache nodejs git
-
-      - uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
-            --username rock --password-stdin
-        env:
-          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
-
-      - name: Build
-        run: |
-          docker build \
-            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            .
-
-      - name: Push
-        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-
-      - name: Report digest
-        run: |
-          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

.gitea/workflows/ci.yaml

@@ -1,19 +1,5 @@
-# Forgejo Actions CI — verification only (vet, test, build).
+# Single pipeline: verify → build → push.
-# Build and push happens in build.yaml on main push.
+# One workflow per push, one concurrency group per branch.
-#
-# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/.
-# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com)
-# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run
-# row on push, not once, for any repo -- confirmed both from application logs
-# (silent, no error) and directly in the action_run table. A .gitea/workflows
-# file with an identical job spec fires immediately. .github/workflows also
-# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on
-# kmsvc-manage both got action_run rows despite matching no runner) -- so
-# .forgejo/workflows/ specifically appears unsupported on this instance/version,
-# not workflow detection being off in general.
-#
-# runs-on: golang -- the generic "docker" runner was retired in favor of
-# per-language runners (golang/node/rust), each with its own dind sidecar.
 name: CI
 
 on:
@@ -22,18 +8,21 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
 jobs:
   verify:
-    name: Test, vet, build
+    name: Vet, test, build
     runs-on: golang
     container:
       image: golang:1.26-bookworm
     steps:
-      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
-      # `node`, which golang:1.26-bookworm doesn't ship. Without this the
-      # checkout step fails with "exec: node: executable file not found in
-      # $PATH" before any of the job's own steps run. Same fix already in use
-      # in kmsvc-manage's ci.yaml; carried over here.
       - name: install node (required by JS-based actions)
         run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
 
@@ -42,15 +31,53 @@ jobs:
       - name: go vet
         run: go vet ./...
 
-      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
       - name: go test -race
         run: go test ./... -race
 
-      - name: Static build
+      - name: Static build (smoke)
         run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
 
-      - name: govulncheck
+  push:
+    name: Build and push image
+    needs: verify
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: golang
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          SHORT_SHA=$(git rev-parse --short HEAD)
-          govulncheck ./...
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-        continue-on-error: true
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Build image
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"