feat: switch image-updater to digest-based :latest tracking

All image-updater annotations now use update-strategy: digest with
allow-tags: ^latest$ and write-back-method: argocd. No SHA tags
committed to git — digest overrides stored in ArgoCD state only.

- poimen: git write-back → argocd, removed git-branch
- portfolio: newest-build SHA → digest latest
- api-gateway: newest-build SHA → digest latest

.gitea/workflows/build-runner-images.yml

@@ -1,93 +0,0 @@
-name: Build & Push Runner Images
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:  # Manual trigger
-  schedule:
-    - cron: '0 2 * * 0'  # Weekly on Sunday 2 AM UTC (ensure fresh images)
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-
-jobs:
-  build-runner-images:
-    name: Build & Push All Runner Images
-    runs-on: golang
-    steps:
-      - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get short SHA
-        id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      - name: Registry login
-        run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
-            --username "${REGISTRY_USER}" --password-stdin
-        env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
-
-      - name: Build and push Golang runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-golang"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.golang \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed golang runner"
-
-      - name: Build and push Node runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-node"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.node \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed node runner"
-
-      - name: Build and push Rust runner image
-        run: |
-          IMAGE="${REGISTRY}/rock/forgejo-runner-rust"
-          echo "Building: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          
-          docker build --no-cache \
-            -f k8s/infra/forgejo-runner-images/Dockerfile.rust \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-          
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
-          echo "✓ Pushed rust runner"
-
-      - name: Prune unused images
-        run: docker image prune -a --force 2>&1 | tail -3 || true
-
-      - name: Summary
-        run: |
-          echo "=== Runner Images Built and Pushed ===" 
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
-          echo "✓ forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"

k8s/argocd/apps/55-api-gateway.yaml

@@ -38,8 +38,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "7"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
-    argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/gw.update-strategy: digest
-    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab

k8s/argocd/apps/60-applications.yaml

@@ -248,8 +248,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "8"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
-    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/app.update-strategy: digest
-    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab

k8s/argocd/apps/70-poimen.yaml

@@ -10,14 +10,13 @@ metadata:
       memory=forgejo.riotpiao.com/rock/poimen-memory
       workflows=forgejo.riotpiao.com/rock/poimen-workflows
       frontend=forgejo.riotpiao.com/rock/poimen-frontend
-    argocd-image-updater.argoproj.io/memory.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/memory.update-strategy: digest
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
-    argocd-image-updater.argoproj.io/workflows.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/workflows.update-strategy: digest
-    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
-    argocd-image-updater.argoproj.io/frontend.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
-    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
-    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/write-back-method: argocd
-    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   sources:

k8s/infra/forgejo-runner-images/Dockerfile.golang

@@ -1,12 +0,0 @@
-FROM golang:1.26-bookworm
-
-# Install Node.js, npm, and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN go version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Golang 1.26 + Node.js + Docker CLI pre-installed"

k8s/infra/forgejo-runner-images/Dockerfile.node

@@ -1,12 +0,0 @@
-FROM node:22-bookworm
-
-# Node.js already installed, add Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Node.js 22 + Docker CLI pre-installed"

k8s/infra/forgejo-runner-images/Dockerfile.rust

@@ -1,12 +0,0 @@
-FROM rust:1-bookworm
-
-# Add Node.js and Docker CLI
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    nodejs npm docker.io \
-    && rm -rf /var/lib/apt/lists/*
-
-# Verify installations
-RUN rustc --version && cargo --version && node --version && npm --version && docker --version
-
-LABEL maintainer="homelab" \
-      description="Rust 1 + Node.js + Docker CLI pre-installed"

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -60,15 +60,11 @@ spec:
       containers:
         - name: runner
           image: {{ .Values.runner.image.repository }}:{{ .Values.runner.image.tag }}
-          command: ["sh", "-c", "forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
+          command: ["sh", "-c", "while ! wget -q -O- http://localhost:2375/_ping >/dev/null 2>&1; do echo 'waiting for dind...'; sleep 2; done; echo 'dind ready'; forgejo-runner daemon --config /etc/forgejo-runner/config.yaml"]
           workingDir: /data
           env:
             - name: DOCKER_HOST
-              value: tcp://localhost:2376
+              value: tcp://localhost:2375
-            - name: DOCKER_TLS_VERIFY
-              value: "1"
-            - name: DOCKER_CERT_PATH
-              value: /docker-certs/client
           volumeMounts:
             - name: runner-data
               mountPath: /data
@@ -91,7 +87,7 @@ spec:
             privileged: true    # required for DinD; cicd namespace is labelled privileged
           env:
             - name: DOCKER_TLS_CERTDIR
-              value: /docker-certs
+              value: ""
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs