neiam /oh-my-ex-oh-ircd

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

CI: build the images on the forge, push to ggr.neiam.co

596a44f · Gabriel Morell · 2026-10-27 15:08

✓ image / image (kubernetes) (push) ✓ image / image (standalone) (push)

3 files +86 -0

Message

{commit_body(@commit)}

Files changed

added .forgejo/workflows/image.yml

+86 −0

@@ -0,0 +1,86 @@

	1	+# Builds the release images and pushes them to the forge's own OCI
	2	+# registry (ggr.neiam.co) on every push to master — the .gitlab-ci.yml
	3	+# kaniko jobs, moved off GitLab's registry (r.g.gmp.io), whose S3 storage
	4	+# refused every push from 2026-10-23 on, so no image was published.
	5	+#
	6	+# The images land at <registry>/<owner>/<repo>, i.e.
	7	+# ggr.neiam.co/neiam/oh-my-ex-oh-ircd, with the tags the GitLab jobs used: one
	8	+# build per TLS_MODE, each tagged <mode>-master and <mode>-<short sha>,
	9	+# and standalone also :master and :latest (most VPS-style deploys want
	10	+# the in-process ACME path). The argo Deployment (argo-01-bos/neiam-ircd)
	11	+# runs :kubernetes-master; keel polls for it.
	12	+#
	13	+# No secrets. The per-job token is accepted by the registry's /v2/token
	14	+# endpoint and authorized to push this repository's own image path.
	15	+name: image
	16	+on:
	17	+ push:
	18	+ branches: [master]
	19	+ workflow_dispatch:
	20	+
	21	+# A newer push supersedes this run: on a branch the run in progress is
	22	+# cancelled; on master it finishes, and only a run still waiting is
	23	+# replaced.
	24	+concurrency:
	25	+ group: ${{ github.workflow }}-${{ github.ref }}
	26	+ cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
	27	+
	28	+jobs:
	29	+ image:
	30	+ if: github.server_url != 'https://github.com'
	31	+ strategy:
	32	+ matrix:
	33	+ tls_mode: [kubernetes, standalone]
	34	+ runs-on: arc-runner-set
	35	+ permissions:
	36	+ contents: read
	37	+ packages: write
	38	+ steps:
	39	+ - uses: actions/checkout@v4
	40	+
	41	+ - uses: docker/setup-buildx-action@v3
	42	+
	43	+ # An unset CI_REGISTRY resolves to the empty string, and
	44	+ # login-action then silently defaults to docker.io while
	45	+ # metadata-action builds a nonsense "/owner/repo" reference. Say
	46	+ # what is missing instead.
	47	+ - name: Check the registry variable is set
	48	+ env:
	49	+ CI_REGISTRY: ${{ vars.CI_REGISTRY }}
	50	+ run: \|
	51	+ set -euo pipefail
	52	+ if [ -z "${CI_REGISTRY:-}" ]; then
	53	+ echo "CI_REGISTRY is not set for this repository." >&2
	54	+ exit 1
	55	+ fi
	56	+ echo "pushing to $CI_REGISTRY"
	57	+
	58	+ # The username is ignored by the token endpoint but login-action
	59	+ # requires it to be non-empty.
	60	+ - uses: docker/login-action@v3
	61	+ with:
	62	+ registry: ${{ vars.CI_REGISTRY }}
	63	+ username: gitgud-actions
	64	+ password: ${{ github.token }}
	65	+
	66	+ - uses: docker/metadata-action@v5
	67	+ id: meta
	68	+ with:
	69	+ images: ${{ vars.CI_REGISTRY }}/${{ github.repository }}
	70	+ flavor: latest=false
	71	+ tags: \|
	72	+ type=raw,value=${{ matrix.tls_mode }}-master
	73	+ type=sha,prefix=${{ matrix.tls_mode }}-,format=short
	74	+ type=raw,value=master,enable=${{ matrix.tls_mode == 'standalone' }}
	75	+ type=raw,value=latest,enable=${{ matrix.tls_mode == 'standalone' }}
	76	+
	77	+ - uses: docker/build-push-action@v6
	78	+ with:
	79	+ context: .
	80	+ file: ./Dockerfile
	81	+ build-args: TLS_MODE=${{ matrix.tls_mode }}
	82	+ push: true
	83	+ tags: ${{ steps.meta.outputs.tags }}
	84	+ labels: ${{ steps.meta.outputs.labels }}
	85	+ cache-from: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache-${{ matrix.tls_mode }}
	86	+ cache-to: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache-${{ matrix.tls_mode }},mode=max

Parents: 0be2d60