# Forgejo CI/CD

`.forgejo/workflows/pipeline.yml` runs verification for pushes and pull
requests. A push to `main` also publishes immutable commit-SHA tags for the API,
load generator, and web images, then deploys the API and load generator through
the production overlay and Argo Rollouts.

Two load-generator Deployments keep traffic on both the active and preview
Services. Preview traffic is required for the pre-promotion analysis to measure
the candidate revision instead of treating absent samples as success.

The repository needs a dedicated Forgejo runner labelled `docker`. It must have
Docker with Compose support, outbound access to the configured registries, and
network access to the Kubernetes API endpoint contained in the kubeconfig.
Keep this runner private to trusted repositories because deployment jobs can
access the Docker socket and production credentials.

Configure these encrypted repository or organization Actions secrets in the
Forgejo UI:

- `REGISTRY_USERNAME`: account allowed to push the three Nereus packages.
- `REGISTRY_PASSWORD`: package-scoped token for that account.
- `KUBECONFIG_B64`: base64 encoding of a least-privilege deployment kubeconfig.

The workflow never prints these values. It writes the kubeconfig to the
ephemeral workspace with mode `0600`, removes it in an `always()` step, and
creates the Kubernetes registry pull secret through a pipe so its generated
manifest is not logged or committed. The pre-existing `nereus-db` Secret is
required and is only checked for presence.