Simplify CI/CD: use Forgejo built-in token for registry push

2026-08-23 16:03:28 -07:00
parent 3723db2327
commit dcb684e3e2
2 changed files with 148 additions and 31 deletions
@@ -17,45 +17,39 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      
-      - name: Build
+      - name: Run cargo build
        run: cargo build --workspace
      
-      - name: Test
+      - name: Run cargo test
        run: cargo test --all

-  build:
-    name: Build Image
+  build-image:
+    name: Build and Push Image
    runs-on: rust
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Build Docker image
+        run: |
+          docker build \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
+            -f Dockerfile .
+          
+          echo "Built images:"
+          docker images | grep "${{ env.IMAGE_NAME }}"
      
-      - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=
-            type=raw,value=latest
-      
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Login to registry and push
+        run: |
+          # Use Forgejo's actor token which has registry access
+          echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} \
+            -u ${{ github.actor }} --password-stdin
+          
+          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          
+          echo "Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
@@ -0,0 +1,123 @@
+# CI/CD Setup — Forgejo Actions Registry Credentials
+
+## Required Configuration
+
+The CI pipeline (`.forgejo/workflows/build.yaml`) automatically builds and pushes Docker images on each push to `main`. However, it requires registry credentials to be configured as repository secrets.
+
+### Setup Steps
+
+#### 1. **Get Registry Credentials**
+
+From the homelab setup:
+```bash
+# Get ci-bot token (or use your personal access token)
+kubectl get secret -n poimen $(kubectl get secret -n poimen -l app.kubernetes.io/name=ci-bot -o name | head -1) -o jsonpath='{.data.token}' | base64 -d
+```
+
+Or use a personal Forgejo access token:
+- URL: https://forgejo.riotpiao.com/user/settings/tokens
+- Create token with `write:package` scope
+
+#### 2. **Set Repository Secrets**
+
+Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets**
+
+Add two secrets:
+- **`REGISTRY_USER`**: `ci-bot` (or your username)
+- **`REGISTRY_TOKEN`**: `<token-from-step-1>`
+
+#### 3. **Verify Setup**
+
+Push a commit and check:
+```bash
+# Via web UI
+https://git.riotpiao.com/rock/poimen-memory/actions
+
+# Or check if image exists
+docker pull forgejo.riotpiao.com/rock/poimen-memory:latest
+```
+
+---
+
+## How It Works
+
+```
+┌─────────────────┐
+│  Push to main   │
+└────────┬────────┘
+         │
+         ↓
+┌─────────────────────────────────────────┐
+│  Forgejo Actions (rust runner)          │
+│  1. cargo build --workspace             │
+│  2. cargo test --all                    │
+└────────┬────────────────────────────────┘
+         │
+         ↓ (only if tests pass)
+┌─────────────────────────────────────────┐
+│  Build Docker Image                     │
+│  docker build -t forgejo.../latest .    │
+└────────┬────────────────────────────────┘
+         │
+         ↓
+┌─────────────────────────────────────────┐
+│  Push to Registry                       │
+│  docker login + push                    │
+│  Uses: REGISTRY_USER + REGISTRY_TOKEN   │
+└────────┬────────────────────────────────┘
+         │
+         ↓
+┌─────────────────────────────────────────┐
+│  ArgoCD Detects Image                   │
+│  Syncs k8s/app/ with new image          │
+└────────┬────────────────────────────────┘
+         │
+         ↓
+┌─────────────────────────────────────────┐
+│  K8s Deployment                         │
+│  Pulls new image, restarts pods         │
+└─────────────────────────────────────────┘
+```
+
+---
+
+## Troubleshooting
+
+### Build Fails During Tests
+- Check workflow logs: https://git.riotpiao.com/rock/poimen-memory/actions
+- Run locally: `cargo test --all`
+
+### Image Not Pushing
+- Verify `REGISTRY_TOKEN` secret is set correctly
+- Check docker login error in workflow logs
+- Ensure token has `write:package` scope
+
+### ArgoCD Not Syncing
+```bash
+kubectl get application -n argocd poimen-memory-app -o yaml | grep -A 5 status
+```
+
+---
+
+## Manual Alternative
+
+If CI is not working, you can push manually:
+
+```bash
+# From homelab machine (has registry access)
+cd ~/workplace/Poimen/memory
+cargo build --release
+docker build -t forgejo.riotpiao.com/rock/poimen-memory:latest .
+docker push forgejo.riotpiao.com/rock/poimen-memory:latest
+```
+
+But the goal is **zero-touch CI/CD**, so set up the secrets once and forget about it.
+
+---
+
+## Status
+
+- ✅ Workflow file: `.forgejo/workflows/build.yaml`
+- ✅ ArgoCD App: `k8s/argocd/memory-app.yaml`
+- ⏳ **Required**: Set `REGISTRY_USER` and `REGISTRY_TOKEN` secrets
+- ⏳ Then: Push to main, watch image build and deploy automatically