CI: publish a :main image to the Forgejo registry on every push to main #64
Labels
No labels
area/ai
area/backend
area/frontend
area/infra
area/scheduler
area/wled
good-first-issue
priority/high
priority/low
priority/medium
type/bug
type/chore
type/ci-cd
type/docs
type/feature
type/qa
v1.0.0
v1.1.0
v1.2.0
v2.0.0
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
rbrooks/Iris-WLED#64
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Companion to #3 (which covers the authoritative tag-time images via release.yml). To deploy the dev server without building on the host, CI should also publish a continuously-updated image on every merge to
main:ci.yml's docker job: after the build + health smoke pass on apushtomain, push to the registry asgit.rhoving.com/rbrooks/iris-wled:mainand:sha-<short>docker/login-action), same as release.yml — no long-lived PATamd64 is sufficient for the dev server; decide whether— resolved by #79: Iris publishes:mainshould also carry arm64 (slower CI) or leave multi-arch to the tagged releaseslinux/amd64only, everywhere. Nothing to decide.pull_requestevents — only merged main:sha-*images accumulate; enable/configure registry cleanup or prune in the workflowDepends on: #41 (CI must be green for the push step to ever run).
Enables: the pull-based dev deploy issue.
Enables #65.
Done — and verified by pulling, not by a green badge
Shipped in
b252b8f, fixed ind8900ac.Every merge to
mainnow retags the E2E-testediris:e2eand pushes it as:mainand:sha-<short>. The image is retagged, never rebuilt, so the published artifact is bit-for-bit the one the E2E exercised, at no extra build cost.Verification — the dev host pulled it with its own credentials:
The bug worth recording
The first real run failed:
docker loginsucceeded; the push was rejected.secrets.GITHUB_TOKENdoes not carrywrite:packagescope on this instance. I had copied the auth pattern fromrelease.yml— which has never run (no tags,release_counter: 0), so the pattern was never actually exercised. The working pattern was already here:marginaliauses aREGISTRY_TOKENrepo secret withwrite:package.Two consequences:
release.ymlhad the identical latent bug, fixed in the same commit. It would otherwise have failed during an actual release and taken #3/#4 with it. That fix remains unverified — it only gets exercised when av*tag is pushed, i.e. at #10.rbrooksrather than${{ github.actor }}. The token belongs to rbrooks, and since #56 enabled Renovate automerge a merged dependency PR runs asrenovate-bot, which would not match — an intermittent failure appearing only on automerged PRs.One checkbox not done
Registry hygiene.
:sha-*accrues one tag per merge and nothing bounds it. This is deliberately not repo work: the right mechanism is a Forgejo owner-level package cleanup rule (Settings → Packages → Cleanup Rules, keep N versions). A prune loop in the workflow would need package-delete scope and a silently-failing cleanup step is worse than none.Closing with that recorded rather than leaving the issue open on an instance-configuration task. It is not urgent — one tag per merge — but it will grow.