⭐
Log in to mark this repository.
Build the service image on the forge too
e3082fa · Gabriel Morell · 2026-09-13 02:38
Message
{commit_body(@commit)}
Files changed
added
.forgejo/workflows/image.yml
+69
−0
@@ -0,0 +1,69 @@
| 1 | +# Builds the service image and pushes it to the forge's own OCI | |
| 2 | +# registry, on every push to master. This is the .gitlab-ci.yml kaniko | |
| 3 | +# job ported across: same Dockerfile, same "one image per push to | |
| 4 | +# master, tagged :latest" contract that keel polls for. | |
| 5 | +# | |
| 6 | +# No secrets. The per-job token is accepted by the registry's /v2/token | |
| 7 | +# endpoint and authorized to push this repository's own image path, the | |
| 8 | +# same deal the F-Droid and apt registries give. | |
| 9 | +# | |
| 10 | +# `.gitlab-ci.yml` stays where it is — origin is still GitLab, and that | |
| 11 | +# pipeline still runs there. | |
| 12 | +name: image | |
| 13 | +on: | |
| 14 | + push: | |
| 15 | + branches: [master] | |
| 16 | + | |
| 17 | +jobs: | |
| 18 | + image: | |
| 19 | + runs-on: self-hosted | |
| 20 | + steps: | |
| 21 | + - uses: actions/checkout@v4 | |
| 22 | + | |
| 23 | + - uses: docker/setup-buildx-action@v3 | |
| 24 | + | |
| 25 | + # An unset CI_REGISTRY resolves to the empty string, and | |
| 26 | + # login-action then silently defaults to docker.io while | |
| 27 | + # metadata-action builds a nonsense "/owner/repo" reference. Say | |
| 28 | + # what is missing instead. | |
| 29 | + - name: Check the registry variable is set | |
| 30 | + env: | |
| 31 | + CI_REGISTRY: ${{ vars.CI_REGISTRY }} | |
| 32 | + run: | | |
| 33 | + set -euo pipefail | |
| 34 | + if [ -z "${CI_REGISTRY:-}" ]; then | |
| 35 | + echo "CI_REGISTRY is not set for this repository." >&2 | |
| 36 | + echo "Set it as an organisation-level Actions variable (the" >&2 | |
| 37 | + echo "registry hostname), the same one gitgud builds against." >&2 | |
| 38 | + exit 1 | |
| 39 | + fi | |
| 40 | + echo "pushing to $CI_REGISTRY" | |
| 41 | + | |
| 42 | + # The username is ignored by the token endpoint but login-action | |
| 43 | + # requires it to be non-empty. | |
| 44 | + - uses: docker/login-action@v3 | |
| 45 | + with: | |
| 46 | + registry: ${{ vars.CI_REGISTRY }} | |
| 47 | + username: ci | |
| 48 | + password: ${{ github.token }} | |
| 49 | + | |
| 50 | + # Push to the job's OWN repo path (<registry>/<owner>/<repo>); the | |
| 51 | + # per-job token only grants push there. | |
| 52 | + - uses: docker/metadata-action@v5 | |
| 53 | + id: meta | |
| 54 | + with: | |
| 55 | + images: ${{ vars.CI_REGISTRY }}/${{ github.repository }} | |
| 56 | + tags: | | |
| 57 | + type=sha,format=long | |
| 58 | + type=ref,event=branch | |
| 59 | + type=raw,value=latest,enable={{is_default_branch}} | |
| 60 | + | |
| 61 | + - uses: docker/build-push-action@v6 | |
| 62 | + with: | |
| 63 | + context: . | |
| 64 | + file: ./Dockerfile | |
| 65 | + push: true | |
| 66 | + tags: ${{ steps.meta.outputs.tags }} | |
| 67 | + labels: ${{ steps.meta.outputs.labels }} | |
| 68 | + cache-from: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache | |
| 69 | + cache-to: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache,mode=max |
Parents: 772eeea