Unified pattern enforced:
- test job: runs on all branches + PRs
- build-push job: only on main push, depends on test
- Proper env vars (GOPRIVATE, REGISTRY, IMAGE)
- Install Node.js before checkout
- Install docker only in build-push
- Docker login + build + push + prune
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #5
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.
Uses the proven pattern from riotpiao.com reference commit.
This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.
After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #4
## Problem
Monolithic test-build-push job runs all steps sequentially, with conditionals for push only on main. This makes it hard to see what failed and doesn't clearly separate concerns.
## Fix
Split into two jobs:
- **test**: Runs on all branches + PRs (go mod, vet, test, build binary)
- **build-push**: Runs only on main push after test passes
Move env vars to workflow level (cleaner, reused by both jobs).
## Result
- PRs: test job runs ✅ (no docker install, no registry push) ✅
- Main push: test → build-push → registry push ✅
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #3
Container override breaks docker socket access to dind sidecar.
Changes:
- Remove 'container: image: golang:1.26' (breaks dind socket access)
- Remove manual git config/checkout, use actions/checkout@v4
- Move docker.io install to conditional step before docker login
- Install Node.js for actions runtime
This workflow now works with the new runner setup (golang:1.26-bookworm label image with shared docker socket via dind sidecar). Resolves issues with docker build/push failing in CI.
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #2
Merge ci.yaml + build-push.yml into single CI pipeline. Single job: vet → test → build binary → build image → push. Image push gated on main push only. Fixed Dockerfile to golang:1.26, build cmd/worker, removed HTTP healthcheck.
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #1
- Configure git with oauth2 authentication using REGISTRY_PAT token
- Enables private module access and authenticated requests
- Integration tests now run in CI with proper authentication
- Graceful test fallback: tests run if Temporal accessible, skip if not
- Update TEMPORAL_USAGE.md documentation accordingly
rockandTest