Migrate deploy off GitHub Actions to Forgejo + in-cluster registry #17

New issue

Closed

opened 2026-05-28 12:41:20 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 12:41:20 +00:00

Owner

Gated on coilysiren/backend#25. Do not start until backend's migration PR has merged - it establishes the pattern (Forgejo workflow shape + deployer SA/RBAC + kubeconfig secret + registry image ref). Use backend's merged PR as the byte-level template, adjusting for this repo's namespace and app names.

Context

GitHub no longer joins the tailnet (TS_* secrets already stripped from this repo). The in-cluster registry 192.168.0.194:30500 is live and verified (coilysiren/infrastructure#168). Deploys move to the in-cluster Forgejo runner pushing to that registry.

Work (replicate backend#25 for this repo)

deployer ServiceAccount + Role/RoleBinding + token Secret in this repo's namespace; kubeconfig as a Forgejo Actions secret DEPLOY_KUBECONFIG (server https://192.168.0.194:6443).
.forgejo/workflows/build-publish-deploy.yml - test, then build -> push 192.168.0.194:30500/<name>:<sha> -> kubectl set image -> rollout status. Preserve any existing CI-status report step.
Update the deploy manifest image ref + imagePullPolicy.
Remove the dead .github/workflows/build-and-publish.yml.
Verify a real deploy lands a pod pulling the registry image.

No tailnet join, no GHCR. The DEPLOY_KUBECONFIG secret is the only stored credential.

Blocked by: coilysiren/backend#25.

**Gated on coilysiren/backend#25.** Do not start until backend's migration PR has merged - it establishes the pattern (Forgejo workflow shape + deployer SA/RBAC + kubeconfig secret + registry image ref). Use backend's merged PR as the byte-level template, adjusting for this repo's namespace and app names. ## Context GitHub no longer joins the tailnet (`TS_*` secrets already stripped from this repo). The in-cluster registry `192.168.0.194:30500` is live and verified (coilysiren/infrastructure#168). Deploys move to the in-cluster Forgejo runner pushing to that registry. ## Work (replicate backend#25 for this repo) 1. deployer ServiceAccount + Role/RoleBinding + token Secret in this repo's namespace; kubeconfig as a Forgejo Actions secret `DEPLOY_KUBECONFIG` (server `https://192.168.0.194:6443`). 2. `.forgejo/workflows/build-publish-deploy.yml` - test, then build -> push `192.168.0.194:30500/<name>:<sha>` -> `kubectl set image` -> `rollout status`. Preserve any existing CI-status report step. 3. Update the deploy manifest image ref + `imagePullPolicy`. 4. Remove the dead `.github/workflows/build-and-publish.yml`. 5. Verify a real deploy lands a pod pulling the registry image. No tailnet join, no GHCR. The `DEPLOY_KUBECONFIG` secret is the only stored credential. Blocked by: coilysiren/backend#25.

coilysiren referenced this issue from a commit

2026-05-28 13:11:55 +00:00

ci: migrate deploy to Forgejo Actions + in-cluster registry

coilysiren closed this issue

2026-05-28 13:11:55 +00:00

coilysiren referenced this issue from a commit

2026-05-28 13:21:38 +00:00

ci: install rust via rustup instead of pinning the rust container

coilysiren referenced this issue from a commit

2026-05-28 13:39:20 +00:00

ci: drop browser e2e from the Forgejo gate, keep cargo test

coilysiren referenced this issue from a commit