# CI/CD Workflow Template for Poimen Repos

## Pattern Used by Homelab-Frontend

**File**: `.gitea/workflows/build-prod.yaml` (equivalent: `.forgejo/workflows/build.yaml`)

### Key Components

```yaml
jobs:
  build:
    runs-on: golang  # or rust, or docker
    container:
      image: docker:27-cli
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      - name: Registry login
        run: |
          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
      
      - name: Build
        run: docker build -t "${IMAGE}:latest" .
      
      - name: Push
        run: docker push "${IMAGE}:latest"
```

---

## How to Apply to Any Poimen Repo

### Step 1: Create Personal Access Token

```bash
# In browser: https://git.riotpiao.com/user/settings/tokens
# Or use the existing 'rock' PAT for the organization
```

### Step 2: Set Repository Secret

Go to **`https://git.riotpiao.com/rock/<repo>/settings/secrets`**

Add secret:
- **Name**: `REGISTRY_PAT`
- **Value**: `<token-from-step-1>`

### Step 3: Create Workflow File

Copy this to `.forgejo/workflows/build.yaml`:

```yaml
name: Build and Push

on:
  push:
    branches: [main]

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE_NAME: rock/<your-repo-name>

jobs:
  test:
    runs-on: rust  # or golang, or docker
    steps:
      - uses: actions/checkout@v4
      - name: Run tests
        run: cargo test --all  # adjust for your language

  build:
    runs-on: golang
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    container:
      image: docker:27-cli
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      - name: install node (required by JS-based actions)
        run: apk add --no-cache nodejs git
      
      - uses: actions/checkout@v4
      
      - name: Registry login
        run: |
          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
      
      - name: Build
        run: |
          docker build \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" \
            .
      
      - name: Push
        run: |
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"
```

---

## Apply to Poimen Repos

### poimen-memory ✅ (current)
- Status: Uses `FORGEJO_TOKEN` (built-in)
- Can upgrade to `REGISTRY_PAT` pattern

### poimen (orchestrator)
- If has Dockerfile: add workflow
- If K8s-only: validate with `yamllint` + `kustomize`

### poimen-workflows
- If has Docker: add workflow
- Otherwise: validate YAML only

### Pattern for All Repos

```
.forgejo/workflows/
├── build.yaml           # For repos with Dockerfile
├── validate.yaml        # For K8s-only repos (like homelab)
```

---

## Summary

**Established Pattern**:
1. `REGISTRY_PAT` secret in repo
2. `docker login` → `docker build` → `docker push`
3. Image tagged: `latest` + commit SHA
4. ArgoCD watches and auto-deploys

**Once set up once**: 
- Every push triggers build
- Image auto-pushes to registry
- ArgoCD syncs automatically
- Zero manual intervention

**Effort**: ~5 minutes per repo (token + secret + workflow file)