poimen-memory/CI-SETUP.md

# CI/CD Setup — Forgejo Actions Registry Credentials

## Required Configuration

The CI pipeline (`.forgejo/workflows/build.yaml`) automatically builds and pushes Docker images on each push to `main`. However, it requires registry credentials to be configured as repository secrets.

### Setup Steps

#### 1. **Get Registry Credentials**

From the homelab setup:
```bash
# Get ci-bot token (or use your personal access token)
kubectl get secret -n poimen $(kubectl get secret -n poimen -l app.kubernetes.io/name=ci-bot -o name | head -1) -o jsonpath='{.data.token}' | base64 -d
```

Or use a personal Forgejo access token:
- URL: https://forgejo.riotpiao.com/user/settings/tokens
- Create token with `write:package` scope

#### 2. **Set Repository Secrets**

Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets**

Add two secrets:
- **`REGISTRY_USER`**: `ci-bot` (or your username)
- **`REGISTRY_TOKEN`**: `<token-from-step-1>`

#### 3. **Verify Setup**

Push a commit and check:
```bash
# Via web UI
https://git.riotpiao.com/rock/poimen-memory/actions

# Or check if image exists
docker pull forgejo.riotpiao.com/rock/poimen-memory:latest
```

---

## How It Works

```
┌─────────────────┐
│  Push to main   │
└────────┬────────┘
         │
         ↓
┌─────────────────────────────────────────┐
│  Forgejo Actions (rust runner)          │
│  1. cargo build --workspace             │
│  2. cargo test --all                    │
└────────┬────────────────────────────────┘
         │
         ↓ (only if tests pass)
┌─────────────────────────────────────────┐
│  Build Docker Image                     │
│  docker build -t forgejo.../latest .    │
└────────┬────────────────────────────────┘
         │
         ↓
┌─────────────────────────────────────────┐
│  Push to Registry                       │
│  docker login + push                    │
│  Uses: REGISTRY_USER + REGISTRY_TOKEN   │
└────────┬────────────────────────────────┘
         │
         ↓
┌─────────────────────────────────────────┐
│  ArgoCD Detects Image                   │
│  Syncs k8s/app/ with new image          │
└────────┬────────────────────────────────┘
         │
         ↓
┌─────────────────────────────────────────┐
│  K8s Deployment                         │
│  Pulls new image, restarts pods         │
└─────────────────────────────────────────┘
```

---

## Troubleshooting

### Build Fails During Tests
- Check workflow logs: https://git.riotpiao.com/rock/poimen-memory/actions
- Run locally: `cargo test --all`

### Image Not Pushing
- Verify `REGISTRY_TOKEN` secret is set correctly
- Check docker login error in workflow logs
- Ensure token has `write:package` scope

### ArgoCD Not Syncing
```bash
kubectl get application -n argocd poimen-memory-app -o yaml | grep -A 5 status
```

---

## Manual Alternative

If CI is not working, you can push manually:

```bash
# From homelab machine (has registry access)
cd ~/workplace/Poimen/memory
cargo build --release
docker build -t forgejo.riotpiao.com/rock/poimen-memory:latest .
docker push forgejo.riotpiao.com/rock/poimen-memory:latest
```

But the goal is **zero-touch CI/CD**, so set up the secrets once and forget about it.

---

## Status

- ✅ Workflow file: `.forgejo/workflows/build.yaml`
- ✅ ArgoCD App: `k8s/argocd/memory-app.yaml`
- ⏳ **Required**: Set `REGISTRY_USER` and `REGISTRY_TOKEN` secrets
- ⏳ Then: Push to main, watch image build and deploy automatically