- Remove sops section that breaks vanilla kustomize parsing
- SOPS decryption handled by ArgoCD repo-server ksops plugin
- Allows Image Updater to run 'kustomize edit set image' without errors
- Image Updater can now update portfolio:latest tag in images section
- Add images section so kustomize can properly update portfolio image tag
- Keep sops field for ArgoCD's ksops plugin to decrypt secrets
- Allows Image Updater to detect and sync latest image builds
- Add images section to properly track portfolio image for kustomize
- Remove problematic sops field that breaks kustomize edit commands
- Allows Image Updater to properly update image tags via kustomize
- SOPS decryption should be handled by ArgoCD plugin, not kustomization
- Add argocd-image-updater annotations to auto-detect :latest image changes
- Updater will poll registry and trigger ArgoCD sync when new build pushed
- Deployment pulls latest image on pod restart
Enables automatic updates without manual ArgoCD sync
Unify CI/CD workflow and fix pnpm v12 compatibility issues. This PR addresses the ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION failure that was blocking builds on fresh package releases.
- Add --ignore-scripts flag to pnpm install
- Prevents ERR_PNPM_IGNORED_BUILDS from unrs-resolver
- Build scripts not needed during dependency install phase
- Compilation handled by 'pnpm run build' step
- Pin pnpm to v12.3.4 via packageManager field for reproducible builds
- Set minimum-release-age=0 to allow fresh package installs
- Update CI workflow to use corepack install (respects pinned version)
- Remove frozen-lockfile to regenerate for v12 format
Fixes ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION on [email protected].0
Fix registry login by passing FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment variables instead of direct secret interpolation.
This is the reference implementation pattern used across all repos.
This prevents credentials from being exposed in logs or shell history while keeping the standard docker login approach.
After merge + org-level secrets configured:
- All repos inherit FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN
- CI validates credentials exist before docker login
- Image pushed to registry on main push
---------
Co-authored-by: Story Crater Bot <[email protected]>
Reviewed-on: #3
Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments
Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy
Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap
- Change name to 'CI' (consistent with template)
- Move REGISTRY, IMAGE to workflow-level env (shared by both jobs)
- Compact 'on:' branches syntax
- Maintain all service-specific features (Delete old latest, build-arg)
No functional change, pure standardization to match template pattern.
Changes:
- Add 'pull_request' trigger (test-only on PRs)
- Separate 'test' job (npm ci + npm test)
- Separate 'build-push' job with condition: push to main only
- Remove redundant Node.js install in push job
- Proper dependency chain: test → build-push on main
Now: PRs run tests without pushing. Main pushes build image to registry.
Missing env vars caused LLM calls to fail even with valid OAuth tokens.
Now pod has:
- Auth credentials (Authentik client_id/secret/token_url) ✅
- LLM endpoint (api.riotpiao.com/v1/chat/completions) ✅
- Model (qwen2.5:3b-instruct) ✅
Chat API will now successfully authenticate and call LLM gateway.
- Installs docker.io on node runner (base forgejo/runner:6 lacks it)
- Adds image prune step after push to clean unused images
- Squashes 5 previous failed CI attempts into single working fix
- Handle getAccessToken failure gracefully
- Support LLM_API_TOKEN env var for local dev (bypasses OAuth)
- Better error messages for missing credentials
- Add lib/auth.ts: OAuth client with token caching
- Use client_credentials grant with portfolio-agent service account
- Mount portfolio-agent-oidc secret for credentials
- Remove static LLM_API_TOKEN dependency
Story Crater Bot
rock