Add Forgejo Actions deploy pipeline #1

Merged

jqueuniet merged 5 commits from feat/deploy-process into main 2026-10-23 23:06:07 +02:00

Conversation 0 Commits 5 Files changed 5 +171

jqueuniet commented 2026-09-20 10:06:21 +02:00

Owner

Copy link

Summary

• Builds the site and publishes a container image to the Forgejo package registry on every branch push and every v* tag (plus manual workflow_dispatch)
• Containerfile is single-stage, COPY-only, cross-built for arm64 with buildah unprivileged from an x86_64 runner — the JS build happens separately in the build job, so the image build never needs to execute an arm64 binary
• latest tracks releases only (v* tag pushes); branch pushes get a floating tag named after the branch; every push also gets an immutable sha-<short> tag — computed by scripts/compute-image-tags.sh, unit-tested in scripts/compute-image-tags.test.sh and now run in CI
• Scope stops at publishing the image — running it (NixOS config) is a separate, existing workflow untouched here

Test plan

• npm run build (typecheck + vite build) passes
• scripts/compute-image-tags.test.sh passes (branch, sanitized-branch, and version-tag cases)
• yamllint .forgejo/workflows/deploy.yml — no structural issues (3 pre-existing cosmetic warnings only)
• Local cross-arch build verified: buildah-equivalent build of Containerfile produces a genuine arm64/linux image (confirmed via inspect), with dist/ and nginx.conf landing correctly (confirmed via create+cp, since the resulting binary can't execute on this x86_64 host)
• Not yet verified: the actual git.lordran.net runner building/pushing an image for the first time (buildah has never run there before) — trigger via workflow_dispatch after merge to confirm

Claude-Session: https://claude.ai/code/session_01DwLQcBa7NumJTmN4fxeJey

## Summary - Builds the site and publishes a container image to the Forgejo package registry on every branch push and every `v*` tag (plus manual `workflow_dispatch`) - `Containerfile` is single-stage, COPY-only, cross-built for arm64 with `buildah` unprivileged from an x86_64 runner — the JS build happens separately in the `build` job, so the image build never needs to execute an arm64 binary - `latest` tracks releases only (`v*` tag pushes); branch pushes get a floating tag named after the branch; every push also gets an immutable `sha-<short>` tag — computed by `scripts/compute-image-tags.sh`, unit-tested in `scripts/compute-image-tags.test.sh` and now run in CI - Scope stops at publishing the image — running it (NixOS config) is a separate, existing workflow untouched here ## Test plan - [x] `npm run build` (typecheck + vite build) passes - [x] `scripts/compute-image-tags.test.sh` passes (branch, sanitized-branch, and version-tag cases) - [x] `yamllint .forgejo/workflows/deploy.yml` — no structural issues (3 pre-existing cosmetic warnings only) - [x] Local cross-arch build verified: `buildah`-equivalent build of `Containerfile` produces a genuine `arm64/linux` image (confirmed via inspect), with `dist/` and `nginx.conf` landing correctly (confirmed via `create`+`cp`, since the resulting binary can't execute on this x86_64 host) - [ ] Not yet verified: the actual `git.lordran.net` runner building/pushing an image for the first time (buildah has never run there before) — trigger via `workflow_dispatch` after merge to confirm Claude-Session: https://claude.ai/code/session_01DwLQcBa7NumJTmN4fxeJey

jqueuniet added 4 commits 2026-09-20 10:06:21 +02:00

feat: add image tag computation script 7bdbb52b62

feat: add container image definition for the built site d544ad1cd3

feat: add deploy workflow to build and publish the container image 5fa4aa1e8d

fix: fail loudly on empty image tags and run the tag-script test in CI ... bbf2ab1a11

Compute image tags swallowed script failures (echo always exits 0),
letting the workflow report green while publishing nothing. Add an
explicit empty-tags guard there and a defense-in-depth check before
the build step.

Also run scripts/compute-image-tags.test.sh in the build job so a
regression in that script — a hard dependency of every publish — is
actually gated by CI instead of sitting untested.

Claude-Session: https://claude.ai/code/session_01DwLQcBa7NumJTmN4fxeJey

jqueuniet referenced this pull request from a commit 2026-10-23 23:02:30 +02:00

fix: authenticate registry push with a package-scoped token

jqueuniet added 1 commit 2026-10-23 23:02:30 +02:00

fix: authenticate registry push with a package-scoped token ... 966d338f92

Forgejo Actions ignores the GitHub-style `permissions:` block, and its
automatic GITHUB_TOKEN is repository-scoped with no write:package
capability - so the publish-image job's `buildah push` was rejected by
the registry and nothing was ever published (run #1 on
feat/deploy-process: build and image build succeeded, push failed).

Authenticate with a Forgejo access token scoped to write:package,
stored as the repo secret REGISTRY_TOKEN, and drop the dead
permissions block.

jqueuniet merged commit 966d338f92 into main 2026-10-23 23:06:07 +02:00

jqueuniet deleted branch feat/deploy-process 2026-10-23 23:06:07 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

jqueuniet/dm2-web-editor!1

No description provided.