fix: move workflows from .forgejo/workflows to .gitea/workflows

.forgejo/workflows/*.yaml never creates an action_run on push on this Forgejo instance (1.27.0) -- confirmed directly in the action_run table across multiple probe pushes. .gitea/workflows fires immediately with an identical spec. This is why build.yaml never once executed.
2026-08-21 11:36:34 -07:00
parent e71034c3ef
commit dac1a5da4b
4 changed files with 12 additions and 19 deletions
@@ -0,0 +1,57 @@
+# Forgejo Actions build — push image on main only.
+# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
+# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
+# Enabled by Stage 1 (B, C1).
+name: Build
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
+jobs:
+  build:
+    name: Build and push image
+    runs-on: docker
+    container:
+      image: docker:27-cli
+      # The runner's dind sidecar shares the pod network and the mTLS cert
+      # emptyDir, so the daemon is reachable on localhost with the client certs
+      # dind generated at startup.
+      options: --network host
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
+
+      - name: Build
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            .
+
+      - name: Push
+        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Report digest
+        run: |
+          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
@@ -0,0 +1,47 @@
+# Forgejo Actions CI — verification only (vet, test, build).
+# Build and push happens in build.yaml on main push.
+#
+# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/.
+# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com)
+# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run
+# row on push, not once, for any repo -- confirmed both from application logs
+# (silent, no error) and directly in the action_run table. A .gitea/workflows
+# file with an identical job spec fires immediately. .github/workflows also
+# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on
+# kmsvc-manage both got action_run rows despite matching no runner) -- so
+# .forgejo/workflows/ specifically appears unsupported on this instance/version,
+# not workflow detection being off in general.
+#
+# runs-on: docker matches the only label the cluster runner declares.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  verify:
+    name: Test, vet, build
+    runs-on: docker
+    container:
+      image: golang:1.25-bookworm
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: go vet
+        run: go vet ./...
+
+      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
+      - name: go test -race
+        run: go test ./... -race
+
+      - name: Static build
+        run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
+
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+        continue-on-error: true
@@ -1,9 +0,0 @@
-name: ProbeGitea
-on:
-  push:
-    branches: [main]
-jobs:
-  noop:
-    runs-on: docker
-    steps:
-      - run: echo hi