actions/checkout@v4 is a JS action; Forgejo Actions runs it via node, which
neither golang:1.25-bookworm nor docker:27-cli ship. Every run since the
.gitea/workflows move has failed identically: 'exec: node: executable file
not found in $PATH' during the checkout step, before any real job step ran.
Verified locally against both exact images before pushing:
- golang:1.25-bookworm: apt-get install nodejs ca-certificates git -> node
v18.20.4, git 2.39.5.
- docker:27-cli: apk add nodejs git -> node v22.23.2, git 2.47.2, and
actions/checkout's dist/index.js actually executes afterward (confirmed
by invoking it directly) instead of failing on a missing binary.
- The Dockerfile itself builds clean end to end and the resulting image
serves /healthz, so checkout was the only remaining blocker in the path.
.forgejo/workflows/*.yaml never creates an action_run on push on this
Forgejo instance (1.27.0) -- confirmed directly in the action_run table
across multiple probe pushes. .gitea/workflows fires immediately with an
identical spec. This is why build.yaml never once executed.
Pushing empty commit to trigger the build job and confirm:
- CI job runs (vet, test, build)
- Build job runs (build and push with short SHA tag)
- Image lands in forgejo.riotpiao.com/rock/api-gateway:<short-sha>
- ci.yaml: vet, test, govulncheck only
- build.yaml: build and push to registry with commit short SHA tag
- No manifest write-back, no git push from CI
- Enabled by Stage 1 (B, C1)
- 2.3: unknown model errors (400 + RFC 9457 problem+json with valid_models)
- 2.5: GET /v1/models endpoint (derived from config, not hardcoded)
- 2.6: POST /v1/embeddings passthrough (body-based dispatch, no rewrite)
- 2.7: POST /v1/rerank with path rewrite (/v1/rerank → /rerank)
- wire proxy.Handler in main.go (was using dummy handler)
- 140+ tests passing, race detector clean
- all requests: client → nginx → gateway → upstreams
- ready for config deployment to go live
Build stage pinned to BUILDPLATFORM and GOARCH driven by TARGETARCH, so an
amd64 image builds natively from an arm64 workstation instead of running the
Go toolchain under QEMU. TARGETARCH defaults to amd64 — every cluster node is
amd64, and a plain docker build on arm64 would otherwise produce an image the
nodes cannot run.
- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit
SHA stamped via VERSION build arg.
- .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the
runner declares only the "docker" label. Verify job on every push; image
build and push gated to main.
- Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran.
- deployment.yaml: image from the Forgejo registry, forgejo-registry pull
secret, runAsUser 65532 to match distroless nonroot.
- kustomization.yaml: pin the tag in one place. Promoting a build is a
one-line newTag bump, never :latest.
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.
Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Story Crater Bot