From f459ae5a5dbd808e7ea9702492a02439ff6d3607 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Sun, 23 Aug 2026 16:03:28 -0700 Subject: [PATCH] Simplify CI/CD: use Forgejo built-in token for registry push --- .forgejo/workflows/build.yaml | 56 +++++++--------- CI-SETUP.md | 123 ++++++++++++++++++++++++++++++++++ 2 files changed, 148 insertions(+), 31 deletions(-) create mode 100644 CI-SETUP.md diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml index 0d631ea..0e78144 100644 --- a/.forgejo/workflows/build.yaml +++ b/.forgejo/workflows/build.yaml @@ -17,45 +17,39 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Build + - name: Run cargo build run: cargo build --workspace - - name: Test + - name: Run cargo test run: cargo test --all - build: - name: Build Image + build-image: + name: Build and Push Image runs-on: rust needs: test if: github.event_name == 'push' && github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - name: Build Docker image + run: | + docker build \ + -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \ + -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \ + -f Dockerfile . + + echo "Built images:" + docker images | grep "${{ env.IMAGE_NAME }}" - - name: Login to Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ secrets.REGISTRY_USER }} - password: ${{ secrets.REGISTRY_TOKEN }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=sha,prefix= - type=raw,value=latest - - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: . - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max + - name: Login to registry and push + run: | + # Use Forgejo's actor token which has registry access + echo "${{ secrets.FORGEJO_TOKEN }}" | docker login ${{ env.REGISTRY }} \ + -u ${{ github.actor }} --password-stdin + + docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest + docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} + + echo "Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" + env: + FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }} diff --git a/CI-SETUP.md b/CI-SETUP.md new file mode 100644 index 0000000..34fa2c3 --- /dev/null +++ b/CI-SETUP.md @@ -0,0 +1,123 @@ +# CI/CD Setup — Forgejo Actions Registry Credentials + +## Required Configuration + +The CI pipeline (`.forgejo/workflows/build.yaml`) automatically builds and pushes Docker images on each push to `main`. However, it requires registry credentials to be configured as repository secrets. + +### Setup Steps + +#### 1. **Get Registry Credentials** + +From the homelab setup: +```bash +# Get ci-bot token (or use your personal access token) +kubectl get secret -n poimen $(kubectl get secret -n poimen -l app.kubernetes.io/name=ci-bot -o name | head -1) -o jsonpath='{.data.token}' | base64 -d +``` + +Or use a personal Forgejo access token: +- URL: https://forgejo.riotpiao.com/user/settings/tokens +- Create token with `write:package` scope + +#### 2. **Set Repository Secrets** + +Go to: **https://git.riotpiao.com/rock/poimen-memory/settings/secrets** + +Add two secrets: +- **`REGISTRY_USER`**: `ci-bot` (or your username) +- **`REGISTRY_TOKEN`**: `` + +#### 3. **Verify Setup** + +Push a commit and check: +```bash +# Via web UI +https://git.riotpiao.com/rock/poimen-memory/actions + +# Or check if image exists +docker pull forgejo.riotpiao.com/rock/poimen-memory:latest +``` + +--- + +## How It Works + +``` +┌─────────────────┐ +│ Push to main │ +└────────┬────────┘ + │ + ↓ +┌─────────────────────────────────────────┐ +│ Forgejo Actions (rust runner) │ +│ 1. cargo build --workspace │ +│ 2. cargo test --all │ +└────────┬────────────────────────────────┘ + │ + ↓ (only if tests pass) +┌─────────────────────────────────────────┐ +│ Build Docker Image │ +│ docker build -t forgejo.../latest . │ +└────────┬────────────────────────────────┘ + │ + ↓ +┌─────────────────────────────────────────┐ +│ Push to Registry │ +│ docker login + push │ +│ Uses: REGISTRY_USER + REGISTRY_TOKEN │ +└────────┬────────────────────────────────┘ + │ + ↓ +┌─────────────────────────────────────────┐ +│ ArgoCD Detects Image │ +│ Syncs k8s/app/ with new image │ +└────────┬────────────────────────────────┘ + │ + ↓ +┌─────────────────────────────────────────┐ +│ K8s Deployment │ +│ Pulls new image, restarts pods │ +└─────────────────────────────────────────┘ +``` + +--- + +## Troubleshooting + +### Build Fails During Tests +- Check workflow logs: https://git.riotpiao.com/rock/poimen-memory/actions +- Run locally: `cargo test --all` + +### Image Not Pushing +- Verify `REGISTRY_TOKEN` secret is set correctly +- Check docker login error in workflow logs +- Ensure token has `write:package` scope + +### ArgoCD Not Syncing +```bash +kubectl get application -n argocd poimen-memory-app -o yaml | grep -A 5 status +``` + +--- + +## Manual Alternative + +If CI is not working, you can push manually: + +```bash +# From homelab machine (has registry access) +cd ~/workplace/Poimen/memory +cargo build --release +docker build -t forgejo.riotpiao.com/rock/poimen-memory:latest . +docker push forgejo.riotpiao.com/rock/poimen-memory:latest +``` + +But the goal is **zero-touch CI/CD**, so set up the secrets once and forget about it. + +--- + +## Status + +- ✅ Workflow file: `.forgejo/workflows/build.yaml` +- ✅ ArgoCD App: `k8s/argocd/memory-app.yaml` +- ⏳ **Required**: Set `REGISTRY_USER` and `REGISTRY_TOKEN` secrets +- ⏳ Then: Push to main, watch image build and deploy automatically