neiam /feedpug

feedpub

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

Images: ghcr.io from GitHub, the forge registry from .forgejo

37afa2b · Gabe Morell · 2026-10-27 02:21

✓ android / android (push) ✓ ci / image (push) ✓ ci / test (push) ✓ image / image (push)

6 files +63 -29

Message

{commit_body(@commit)}

Files changed

added .forgejo/workflows/image.yml

+58 −0

@@ -0,0 +1,58 @@

	1	+# The forge's copy of the image publish. .github/workflows/ci.yml's
	2	+# image job pushes to ghcr.io (and the other public registries), but only
	3	+# when it runs on GitHub; here the image goes to the forge's bundled
	4	+# registry (CI_REGISTRY), as camerite and gitgud do: <registry>/<owner>/<repo>.
	5	+#
	6	+# No secrets. The forge injects CI_REGISTRY and accepts the per-job
	7	+# github.token for push to this repository's own image path.
	8	+#
	9	+# No test gate: this workflow can't `needs:` ci.yml's test job (mix precommit),
	10	+# and the Dockerfile compiles the release itself.
	11	+name: image
	12	+
	13	+on:
	14	+ push:
	15	+ branches: [master]
	16	+ tags: ['v*']
	17	+ workflow_dispatch:
	18	+
	19	+jobs:
	20	+ image:
	21	+ if: github.server_url != 'https://github.com'
	22	+ runs-on: arc-runner-set
	23	+ permissions:
	24	+ contents: read
	25	+ packages: write
	26	+ steps:
	27	+ - uses: actions/checkout@v4
	28	+ - uses: docker/setup-buildx-action@v3
	29	+
	30	+ # The username is ignored by the token endpoint, but login-action
	31	+ # requires it to be non-empty.
	32	+ - name: Log in to the forge registry
	33	+ uses: docker/login-action@v3
	34	+ with:
	35	+ registry: ${{ vars.CI_REGISTRY }}
	36	+ username: gitgud-actions
	37	+ password: ${{ github.token }}
	38	+
	39	+ - id: meta
	40	+ uses: docker/metadata-action@v5
	41	+ with:
	42	+ images: ${{ vars.CI_REGISTRY }}/${{ github.repository }}
	43	+ tags: \|
	44	+ type=ref,event=branch
	45	+ type=semver,pattern={{version}}
	46	+ type=semver,pattern={{major}}.{{minor}}
	47	+ type=sha
	48	+ type=raw,value=latest,enable={{is_default_branch}}
	49	+
	50	+ - uses: docker/build-push-action@v6
	51	+ with:
	52	+ context: .
	53	+ platforms: linux/amd64
	54	+ push: true
	55	+ tags: ${{ steps.meta.outputs.tags }}
	56	+ labels: ${{ steps.meta.outputs.labels }}
	57	+ cache-from: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache
	58	+ cache-to: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache,mode=max

modified .github/workflows/ci.yml

+5 −29

@@ -62,7 +62,11 @@ jobs:

62	62	# format, test (which creates + migrates the test DB).
63	63	- run: mix precommit
64	64
	65	+ # The public registries from GitHub only. The forge reads
	66	+ # .github/workflows too, and there .forgejo/workflows/image.yml
	67	+ # publishes to the forge's own registry instead.
65	68	image:
	69	+ if: github.server_url == 'https://github.com'
66	70	needs: test
67	71	runs-on: arc-runner-set
68	72	permissions:

@@ -72,35 +76,8 @@ jobs:

72	76	- uses: actions/checkout@v4
73	77	- uses: docker/setup-buildx-action@v3
74	78
75		− # An unset CI_REGISTRY resolves to the empty string, and
76		− # login-action then silently defaults to docker.io while
77		− # metadata-action builds a nonsense "/owner/repo" reference. Say
78		− # what is missing instead.
79		− - name: Check the registry variable is set
80		− env:
81		− CI_REGISTRY: ${{ vars.CI_REGISTRY }}
82		− run: \|
83		− set -euo pipefail
84		− if [ -z "${CI_REGISTRY:-}" ]; then
85		− echo "CI_REGISTRY is not set for this repository." >&2
86		− echo "Set it as an organisation-level Actions variable (the" >&2
87		− echo "registry hostname), the same one gitgud builds against." >&2
88		− exit 1
89		− fi
90		− echo "pushing to $CI_REGISTRY"
91		−
92		− # GHCR uses the built-in token. Docker Hub and Quay creds come from
	79	+ # GHCR uses a stored token (GHCR_TOKEN). Docker Hub and Quay creds come from
93	80	# org-wide secrets (DOCKERHUB_USER/DOCKERHUB_TOKEN, QUAY_USERNAME/QUAY_TOKEN).
94		− # The forge's own registry: no stored credential, the per-job token
95		− # is authorized to push this repository's own image path.
96		− - name: Log in to the forge registry
97		− if: github.event_name != 'pull_request'
98		− uses: docker/login-action@v3
99		− with:
100		− registry: ${{ vars.CI_REGISTRY }}
101		− username: ci
102		− password: ${{ github.token }}
103		−
104	81	- name: Log in to GHCR
105	82	if: github.event_name != 'pull_request'
106	83	uses: docker/login-action@v3

@@ -129,7 +106,6 @@ jobs:

129	106	uses: docker/metadata-action@v5
130	107	with:
131	108	images: \|
132		− ${{ vars.CI_REGISTRY }}/${{ github.repository }}
133	109	ghcr.io/${{ github.repository }}
134	110	docker.io/neiam/feedpug
135	111	quay.io/neiam/feedpug

Parents: 3488b6a