Unified pattern enforced:
- test job: runs on all branches + PRs
- build-push job: only on main push, depends on test
- Proper env vars (GOPRIVATE, REGISTRY, IMAGE)
- Install Node.js before checkout
- Install docker only in build-push
- Docker login + build + push + prune
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.
Uses the proven pattern from riotpiao.com reference commit.
This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.
After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #4
## Problem
Monolithic test-build-push job runs all steps sequentially, with conditionals for push only on main. This makes it hard to see what failed and doesn't clearly separate concerns.
## Fix
Split into two jobs:
- **test**: Runs on all branches + PRs (go mod, vet, test, build binary)
- **build-push**: Runs only on main push after test passes
Move env vars to workflow level (cleaner, reused by both jobs).
## Result
- PRs: test job runs ✅ (no docker install, no registry push) ✅
- Main push: test → build-push → registry push ✅
---------
Co-authored-by: Test <[email protected]>
Reviewed-on: #3