feat: add ArgoCD Image Updater tracking for runner images

- Added Image Updater annotations to forgejo-runner Applications
- Image Updater now automatically tracks new images in Forgejo registry
- Update strategy: newest-build (latest commit SHA)
- Tag filter: commits (7-char SHA), latest, and v* releases
- Helm values track repository + tag separately for automatic updates
- Write-back via git (commits image updates to main branch)

Build and push custom runner images:
  docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
    -t forgejo.riotpiao.com/rock/forgejo-runner-golang:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
    -t forgejo.riotpiao.com/rock/forgejo-runner-rust:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
    -t forgejo.riotpiao.com/rock/forgejo-runner-node:latest .

  docker login forgejo.riotpiao.com
  docker push forgejo.riotpiao.com/rock/forgejo-runner-golang:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-rust:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-node:latest

Image Updater will then:
1. Detect new images in registry
2. Update values.yaml automatically
3. Commit changes to git
4. ArgoCD syncs the new image tags

k8s/argocd/apps/30-security.yaml

@@ -152,6 +152,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-golang
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -173,6 +180,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-node
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
@@ -197,6 +211,13 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-rust
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:

k8s/infra/forgejo-runner/values-node.yaml

@@ -5,6 +5,9 @@
 # node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
 # (homelab has no CI; custom runner images built manually if desired)
 runner:
+  image:
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-node
+    tag: "latest"  # Image Updater tracks and updates this
   name: node-runner
   # Custom image: node:22-bookworm + docker.io pre-installed
   labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"

k8s/infra/forgejo-runner/values-rust.yaml

@@ -8,6 +8,9 @@
 #   - Rust toolchain (via rustup)
 #   - Build essentials
 runner:
+  image:
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-rust
+    tag: "latest"  # Image Updater tracks and updates this
   name: rust-runner
   labels: "rust:docker://forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
 

k8s/infra/forgejo-runner/values.yaml

@@ -1,7 +1,7 @@
 runner:
   image:
-    repository: code.forgejo.org/forgejo/runner
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-golang
-    tag: "6"          # pin exact release before apply
+    tag: "latest"  # Image Updater tracks and updates this
   name: golang-runner
   # Custom image: docker:27-cli + Node.js + Go + build tools
   #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)