fix: use origin/main workflow with env vars for registry credentials

Resolved merge conflicts by using current origin/main workflow which: - Includes test job (npm ci + npm test) - Has delete old latest image step - Uses --build-arg for COMMIT_SHA - Uses env vars for registry credentials (FORGEJO_REGISTRY_USER/TOKEN) All features from main preserved, registry login fixed.
fix: use env vars for docker registry credentials
2026-09-06 23:40:51 -07:00 · 2026-09-06 23:37:56 -07:00 · 2026-09-06 23:34:54 -07:00 · 2026-09-06 23:25:35 -07:00
4 changed files with 48 additions and 11 deletions
@@ -1,12 +1,14 @@
-name: Build & Push Portfolio Image
+name: CI
 on:
  push:
-    branches:
+    branches: [main]
      - main
  pull_request:
-    branches:
+    branches: [main]
-      - main
+
 env:
  REGISTRY: forgejo.riotpiao.com
  IMAGE: forgejo.riotpiao.com/rock/portfolio
 jobs:
  test:
@@ -30,9 +32,6 @@ jobs:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: node
    env:
      REGISTRY: forgejo.riotpiao.com
      IMAGE: forgejo.riotpiao.com/rock/portfolio
    steps:
      - name: Install Node.js and Docker
        run: |
@@ -0,0 +1,27 @@
 apiVersion: ENC[AES256_GCM,data:Qv8=,iv:v6kMpvgzkpGdOzuwurpWhVJG8dqjHG55mZebDs0PeWs=,tag:9W00OTNe1kQ9mA/l0eSINg==,type:str]
 kind: ENC[AES256_GCM,data:TUqF1gRXmGmc,iv:ettHZPLG+Jw29TuSmeUNi4DsK944JNgvmu6hry3osSo=,tag:CbtvTOVxpWivW6UyO7MrLA==,type:str]
 metadata:
    name: ENC[AES256_GCM,data:0YEEc2oqKeGjWr7C0eAzz0dZft0=,iv:BnCIMRZAsDdW3IxIAhsj/WrZNCipG5qT1kfnuQykt20=,tag:EFjanh4e6T5bQX6dupXRgw==,type:str]
    namespace: ENC[AES256_GCM,data:MheF93lBY58x,iv:Mp64W8Beu+q8NiQTtUhpAxwcfT4JPkLenjh7ljJaGak=,tag:ves1LGuzj1QGY1OpqF560g==,type:str]
    labels:
        app.kubernetes.io/name: ENC[AES256_GCM,data:i+aoOfomVrFm,iv:/g+F6ZaWDvzjjv4P35rgcBMSSAyrTyWymm//KVRrpYg=,tag:UIn8tKERKolTYq/bVdQ+iA==,type:str]
 data:
    #ENC[AES256_GCM,data:9whKTa+VQQtYnOrrTanXJpPZltIEiAh029xIu9YhAqcaXQ2I6XTmCU8LqyNrQKNw5CWJJg0F,iv:Sm5T9g2aJQz0qrNzA1B8QBGRkio6u5AAc+hWoUIs0bU=,tag:jxZ0llX6pKYBsvtRxCdgaA==,type:comment]
    #ENC[AES256_GCM,data:XLVVNIgolPDi5pkm/S6IZJHZIj+84b/1VTwLCnrePwFmDrIfRdJAG7LbxWFmRJtaO2TEHnd2FEHIEg==,iv:YkfB3Q26+PHqd+51gAZOXoJKPpvIeT5wN0Ye10spdYM=,tag:spTTVuE52SvDuTo3LQXqOw==,type:comment]
    LLM_API_URL: ENC[AES256_GCM,data:dJRd+J1ovECOIctWhwMYuhv3rReqmwUHkcN8fxtxLfohIqg8/LOsPw5FE2B9GrEzjnYwTcku6vyvb+CCCJMLmDE=,iv:23Jo8dgWeMLX+uYyFQXPa1cHqKVTPs6qHI4i/Go6lTY=,tag:KuRtrTdzKk3uf9ph5Qp5Nw==,type:str]
    LLM_MODEL: ENC[AES256_GCM,data:lRDaz2Fey+2czl3K1Qju/82XNw==,iv:nJR+wNNGKDCkYdToEfERqYZdVS34TmVvMVRjLHYFgE8=,tag:XOiZmi9k+54yJm4ofUiXFw==,type:str]
 sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWEpWNFQ4TXNlSG5NcVFB
            Tll2OUFFUjV4RDAvOE5ZSWRZZE5YL2xGYkY4CjI4SFp5OXJlcHd0WG9vTVFwM2do
            YVVleVhCam9qeGVhL05xMG5mMWorNWMKLS0tIHU4MVNuSjkwNkNKTi93OXFkQlJh
            Y28wbW9uK21zYzNWUzE2MzJKN0t2cFUKlgVpvion4Qg7DFw/arUZupyy1d7I59P4
            njaeu0pTj6StNiZfHhCguVWpYBECnSaF5A4aoLFbUFVpdL/JC8V2GQ==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
    lastmodified: "2026-09-07T06:23:56Z"
    mac: ENC[AES256_GCM,data:2ufxupBbFbV08JJoN3ySbehsCqmAfNt6anUeaWg4JlxvTN+51yd8NeW76HJ8yo0MSf7FjjnX83CHeuVmcJaIXcTTFjKW4Dp3Ww5LYq9PESQu6ywoeXSfsrYH+T1WKAUCJq/HJOYHTvnpS4zSnHfDA8madHWjJI3/Hl1haC0cKyE=,iv:/Xv//b2mBrr+Rye01YNjvdUp4zLi/+Ly+4RCqG2RO+s=,tag:g+7rr4dxXbkATSBVQ4l0Wg==,type:str]
    unencrypted_suffix: _unencrypted
    version: 3.13.2
@@ -42,11 +42,17 @@ spec:
            secretKeyRef:
              name: portfolio-agent-oidc
              key: TOKEN_URL
-        # LLM API configuration
+        # LLM API configuration (from encrypted ConfigMap)
        - name: LLM_API_URL
-          value: "https://api.riotpiao.com/v1/chat/completions"
+          valueFrom:
            configMapKeyRef:
              name: portfolio-llm-config
              key: LLM_API_URL
        - name: LLM_MODEL
-          value: "qwen2.5:3b-instruct"
+          valueFrom:
            configMapKeyRef:
              name: portfolio-llm-config
              key: LLM_MODEL
        ports:
        - name: http
          containerPort: 3000
@@ -3,6 +3,11 @@ kind: Kustomization
 namespace: portfolio
 resources:
 - namespace.yaml
 - configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
 # Decrypt secrets via SOPS before applying
 sops:
  version: 3
Author	SHA1	Message	Date
Story Crater Bot	22f5afdb58	fix: use origin/main workflow with env vars for registry credentials CI / Test (pull_request) Failing after 28s Details CI / Build & Push Image (pull_request) Skipped Details Resolved merge conflicts by using current origin/main workflow which: - Includes test job (npm ci + npm test) - Has delete old latest image step - Uses --build-arg for COMMIT_SHA - Uses env vars for registry credentials (FORGEJO_REGISTRY_USER/TOKEN) All features from main preserved, registry login fixed.	2026-09-06 23:40:51 -07:00
Story Crater Bot	b3e5d63e86	fix: use env vars for docker registry credentials	2026-09-06 23:37:56 -07:00
Story Crater Bot	1f66db0ba4	fix: validate registry credentials before docker login Add credential validation step to catch missing secrets early with clear error message. Use direct secret injection (not env vars) for better security. Isolate docker config to /tmp/docker-config.	2026-09-06 23:34:54 -07:00
Story Crater Bot	4ad8a4f4a4	fix: move LLM config to encrypted ConfigMap (CI-friendly) Build & Push Portfolio Image / Test (pull_request) Failing after 34s Details Build & Push Portfolio Image / Build & Push Image (pull_request) Skipped Details Problem: LLM_API_URL hardcoded to external HTTPS endpoint - https://api.riotpiao.com/v1/chat/completions (TLS hairpin through nginx) - Not externalizable for CI or environment-specific deployment Solution: Move to SOPS-encrypted ConfigMap with in-cluster endpoint - LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions - No TLS overhead, direct cluster communication - Encrypted for security (SOPS + age key) - Externalizable: CI can update values without app redeployment Changes: 1. Create configmap.enc.yaml (SOPS-encrypted) - Data: LLM_API_URL, LLM_MODEL - Encrypted with .sops.yaml age key 2. Update deployment.yaml - Change from 'value:' to 'valueFrom: configMapKeyRef' - Reference portfolio-llm-config ConfigMap 3. Update kustomization.yaml - Add configmap.enc.yaml to resources - Add sops: version: 3 for decryption Benefits: - ArgoCD auto-decrypts via SOPS before applying - CI can auto-patch ConfigMap without app changes - Environment-specific config (dev/staging/prod) - Secrets encrypted in git (never plain text)	2026-09-06 23:25:35 -07:00