Nereus/docs/ci-cd.md

Forgejo CI/CD

.forgejo/workflows/pipeline.yml runs verification for pushes and pull requests. A push to main also publishes immutable commit-SHA tags for the API, load generator, and web images, then deploys the API and load generator through the production overlay and Argo Rollouts.

Two load-generator Deployments keep traffic on both the active and preview Services. Preview traffic is required for the pre-promotion analysis to measure the candidate revision instead of treating absent samples as success.

The repository needs a dedicated Forgejo runner labelled docker. It must have Docker with Compose support, outbound access to the configured registries, and network access to the Kubernetes API endpoint contained in the kubeconfig. Keep this runner private to trusted repositories because deployment jobs can access the Docker socket and production credentials.

Configure these encrypted repository or organization Actions secrets in the Forgejo UI:

• REGISTRY_USERNAME: account allowed to push the three Nereus packages.
• REGISTRY_PASSWORD: package-scoped token for that account.
• KUBECONFIG_B64: base64 encoding of a least-privilege deployment kubeconfig.

The workflow never prints these values. It writes the kubeconfig to the ephemeral workspace with mode 0600, removes it in an always() step, and creates the Kubernetes registry pull secret through a pipe so its generated manifest is not logged or committed. The pre-existing nereus-db Secret is required and is only checked for presence.