neiam /waxx

waxx

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

Images: ghcr.io from GitHub, the forge registry from .forgejo

920fa72 · Gabe Morell · 2026-10-27 02:21

✗ android / android (push) ✓ ci / image (push) ✗ ci / test (push) ✗ image / image (push)

6 files +63 -29

Message

{commit_body(@commit)}

Files changed

added .forgejo/workflows/image.yml

+58 −0

@@ -0,0 +1,58 @@

	1	+# The forge's copy of the image publish. .github/workflows/ci.yml's
	2	+# image job pushes to ghcr.io (and the other public registries), but only
	3	+# when it runs on GitHub; here the image goes to the forge's bundled
	4	+# registry (CI_REGISTRY), as camerite and gitgud do: <registry>/<owner>/<repo>.
	5	+#
	6	+# No secrets. The forge injects CI_REGISTRY and accepts the per-job
	7	+# github.token for push to this repository's own image path.
	8	+#
	9	+# No test gate: this workflow can't `needs:` ci.yml's test job (mix precommit),
	10	+# and the Dockerfile compiles the release itself.
	11	+name: image
	12	+
	13	+on:
	14	+ push:
	15	+ branches: [master]
	16	+ tags: ['v*']
	17	+ workflow_dispatch:
	18	+
	19	+jobs:
	20	+ image:
	21	+ if: github.server_url != 'https://github.com'
	22	+ runs-on: arc-runner-set
	23	+ permissions:
	24	+ contents: read
	25	+ packages: write
	26	+ steps:
	27	+ - uses: actions/checkout@v4
	28	+ - uses: docker/setup-buildx-action@v3
	29	+
	30	+ # The username is ignored by the token endpoint, but login-action
	31	+ # requires it to be non-empty.
	32	+ - name: Log in to the forge registry
	33	+ uses: docker/login-action@v3
	34	+ with:
	35	+ registry: ${{ vars.CI_REGISTRY }}
	36	+ username: gitgud-actions
	37	+ password: ${{ github.token }}
	38	+
	39	+ - id: meta
	40	+ uses: docker/metadata-action@v5
	41	+ with:
	42	+ images: ${{ vars.CI_REGISTRY }}/${{ github.repository }}
	43	+ tags: \|
	44	+ type=ref,event=branch
	45	+ type=semver,pattern={{version}}
	46	+ type=semver,pattern={{major}}.{{minor}}
	47	+ type=sha
	48	+ type=raw,value=latest,enable={{is_default_branch}}
	49	+
	50	+ - uses: docker/build-push-action@v6
	51	+ with:
	52	+ context: .
	53	+ platforms: linux/amd64
	54	+ push: true
	55	+ tags: ${{ steps.meta.outputs.tags }}
	56	+ labels: ${{ steps.meta.outputs.labels }}
	57	+ cache-from: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache
	58	+ cache-to: type=registry,ref=${{ vars.CI_REGISTRY }}/${{ github.repository }}:buildcache,mode=max

modified .github/workflows/ci.yml

+5 −29

@@ -66,7 +66,11 @@ jobs:

66	66	# format, test (which creates + migrates the test DB).
67	67	- run: mix precommit
68	68
	69	+ # The public registries from GitHub only. The forge reads
	70	+ # .github/workflows too, and there .forgejo/workflows/image.yml
	71	+ # publishes to the forge's own registry instead.
69	72	image:
	73	+ if: github.server_url == 'https://github.com'
70	74	needs: test
71	75	runs-on: arc-runner-set
72	76	permissions:

@@ -76,35 +80,8 @@ jobs:

76	80	- uses: actions/checkout@v4
77	81	- uses: docker/setup-buildx-action@v3
78	82
79		− # An unset CI_REGISTRY resolves to the empty string, and
80		− # login-action then silently defaults to docker.io while
81		− # metadata-action builds a nonsense "/owner/repo" reference. Say
82		− # what is missing instead.
83		− - name: Check the registry variable is set
84		− env:
85		− CI_REGISTRY: ${{ vars.CI_REGISTRY }}
86		− run: \|
87		− set -euo pipefail
88		− if [ -z "${CI_REGISTRY:-}" ]; then
89		− echo "CI_REGISTRY is not set for this repository." >&2
90		− echo "Set it as an organisation-level Actions variable (the" >&2
91		− echo "registry hostname), the same one gitgud builds against." >&2
92		− exit 1
93		− fi
94		− echo "pushing to $CI_REGISTRY"
95		−
96		− # GHCR uses the built-in token. Docker Hub and Quay creds come from
	83	+ # GHCR uses a stored token (GHCR_TOKEN). Docker Hub and Quay creds come from
97	84	# org-wide secrets (DOCKERHUB_USER/DOCKERHUB_TOKEN, QUAY_USERNAME/QUAY_TOKEN).
98		− # The forge's own registry: no stored credential, the per-job token
99		− # is authorized to push this repository's own image path.
100		− - name: Log in to the forge registry
101		− if: github.event_name != 'pull_request'
102		− uses: docker/login-action@v3
103		− with:
104		− registry: ${{ vars.CI_REGISTRY }}
105		− username: ci
106		− password: ${{ github.token }}
107		−
108	85	- name: Log in to GHCR
109	86	if: github.event_name != 'pull_request'
110	87	uses: docker/login-action@v3

@@ -133,7 +110,6 @@ jobs:

133	110	uses: docker/metadata-action@v5
134	111	with:
135	112	images: \|
136		− ${{ vars.CI_REGISTRY }}/${{ github.repository }}
137	113	ghcr.io/${{ github.repository }}
138	114	docker.io/neiam/waxx
139	115	quay.io/neiam/waxx

Parents: 0d6d358