Forgejo Actions workflow for deploy to home-ctr-onyx #30

New issue

Closed

opened 2026-04-19 12:19:36 -06:00 by claude-code · 0 comments

claude-code commented

2026-04-19 12:19:36 -06:00

Collaborator

Part of the platform-contract work (#25). Final piece of the deploy pipeline.

Scope

Add a Forgejo Actions workflow (e.g. .forgejo/workflows/deploy.yml) that on push to main:

Builds the Docker image (from the Dockerfile in #28).
Tags it with the git SHA (per intake §3.2) and pushes to forgejo.labbity.unbiasedgeek.com/archeious/quartermaster/quartermaster.
SSHes to home-ctr-onyx and runs docker compose pull && docker compose up -d against the compose file from #29.

Requirements

Runner label: homelab (container mode, has Node.js — needed for actions/checkout). Per intake §6.1.
Tag images with ${GITHUB_SHA} (or Forgejo's equivalent env var).
Forgejo Actions secrets on archeious/quartermaster:
- Registry push auth — the runner's default ${{ secrets.TOKEN }} may suffice; verify against another Forgejo-hosted repo.
- SSH deploy key + known-hosts for home-ctr-onyx.
Deploy is the default behavior on merge to main (intake §6.3); no manual gating.
Post-deploy: one curl -fsS https://quartermaster.unbiasedgeek.com/healthz against the public URL as a smoke step. Fail the workflow (and alert) if it doesn't return 200.

Out of scope

Rollback automation — manual docker compose with the previous tag is acceptable for v1.
Canary / blue-green — single-container app, not needed.

Deliverables

Workflow file.
README "CI/CD" paragraph documenting the push→deploy flow and which secrets the workflow reads.

Blocked by #28 and #29.

Part of the platform-contract work (#25). Final piece of the deploy pipeline. ## Scope Add a Forgejo Actions workflow (e.g. `.forgejo/workflows/deploy.yml`) that on push to `main`: 1. Builds the Docker image (from the Dockerfile in #28). 2. Tags it with the git SHA (per intake §3.2) and pushes to `forgejo.labbity.unbiasedgeek.com/archeious/quartermaster/quartermaster`. 3. SSHes to home-ctr-onyx and runs `docker compose pull && docker compose up -d` against the compose file from #29. ## Requirements - Runner label: `homelab` (container mode, has Node.js — needed for `actions/checkout`). Per intake §6.1. - Tag images with `${GITHUB_SHA}` (or Forgejo's equivalent env var). - Forgejo Actions secrets on `archeious/quartermaster`: - Registry push auth — the runner's default `${{ secrets.TOKEN }}` may suffice; verify against another Forgejo-hosted repo. - SSH deploy key + known-hosts for home-ctr-onyx. - Deploy is the default behavior on merge to `main` (intake §6.3); no manual gating. - Post-deploy: one `curl -fsS https://quartermaster.unbiasedgeek.com/healthz` against the public URL as a smoke step. Fail the workflow (and alert) if it doesn't return 200. ## Out of scope - Rollback automation — manual `docker compose` with the previous tag is acceptable for v1. - Canary / blue-green — single-container app, not needed. ## Deliverables - Workflow file. - README "CI/CD" paragraph documenting the push→deploy flow and which secrets the workflow reads. Blocked by #28 and #29.