CI/CD Workflow Template for Poimen Repos

Pattern Used by Homelab-Frontend

File: .gitea/workflows/build-prod.yaml (equivalent: .forgejo/workflows/build.yaml)

Key Components

jobs:
  build:
    runs-on: golang  # or rust, or docker
    container:
      image: docker:27-cli
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      - name: Registry login
        run: |
          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
      
      - name: Build
        run: docker build -t "${IMAGE}:latest" .
      
      - name: Push
        run: docker push "${IMAGE}:latest"

How to Apply to Any Poimen Repo

Step 1: Create Personal Access Token

# In browser: https://git.riotpiao.com/user/settings/tokens
# Or use the existing 'rock' PAT for the organization

Step 2: Set Repository Secret

Go to https://git.riotpiao.com/rock/<repo>/settings/secrets

Add secret:

Name: REGISTRY_PAT
Value: <token-from-step-1>

Step 3: Create Workflow File

Copy this to .forgejo/workflows/build.yaml:

name: Build and Push

on:
  push:
    branches: [main]

env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE_NAME: rock/<your-repo-name>

jobs:
  test:
    runs-on: rust  # or golang, or docker
    steps:
      - uses: actions/checkout@v4
      - name: Run tests
        run: cargo test --all  # adjust for your language

  build:
    runs-on: golang
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    container:
      image: docker:27-cli
      volumes:
        - /docker-certs/client:/docker-certs/client:ro
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_TLS_VERIFY: "1"
      DOCKER_CERT_PATH: /docker-certs/client
    steps:
      - name: install node (required by JS-based actions)
        run: apk add --no-cache nodejs git
      
      - uses: actions/checkout@v4
      
      - name: Registry login
        run: |
          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
            --username rock --password-stdin
        env:
          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
      
      - name: Build
        run: |
          docker build \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}" \
            .
      
      - name: Push
        run: |
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"

Apply to Poimen Repos

poimen-memory ✅ (current)

Status: Uses FORGEJO_TOKEN (built-in)
Can upgrade to REGISTRY_PAT pattern

poimen (orchestrator)

If has Dockerfile: add workflow
If K8s-only: validate with yamllint + kustomize

poimen-workflows

If has Docker: add workflow
Otherwise: validate YAML only

Pattern for All Repos

.forgejo/workflows/
├── build.yaml           # For repos with Dockerfile
├── validate.yaml        # For K8s-only repos (like homelab)

Summary

Established Pattern:

REGISTRY_PAT secret in repo
docker login → docker build → docker push
Image tagged: latest + commit SHA
ArgoCD watches and auto-deploys

Once set up once:

Every push triggers build
Image auto-pushes to registry
ArgoCD syncs automatically
Zero manual intervention

Effort: ~5 minutes per repo (token + secret + workflow file)

3.7 KiB Raw Blame History