29 lines
1.5 KiB
Markdown
29 lines
1.5 KiB
Markdown
# Forgejo CI/CD
|
|
|
|
`.forgejo/workflows/pipeline.yml` runs verification for pushes and pull
|
|
requests. A push to `main` also publishes immutable commit-SHA tags for the API,
|
|
load generator, and web images, then deploys the API and load generator through
|
|
the production overlay and Argo Rollouts.
|
|
|
|
Two load-generator Deployments keep traffic on both the active and preview
|
|
Services. Preview traffic is required for the pre-promotion analysis to measure
|
|
the candidate revision instead of treating absent samples as success.
|
|
|
|
The repository needs a dedicated Forgejo runner labelled `docker`. It must have
|
|
Docker with Compose support, outbound access to the configured registries, and
|
|
network access to the Kubernetes API endpoint contained in the kubeconfig.
|
|
Keep this runner private to trusted repositories because deployment jobs can
|
|
access the Docker socket and production credentials.
|
|
|
|
Configure these encrypted repository or organization Actions secrets in the
|
|
Forgejo UI:
|
|
|
|
- `REGISTRY_USERNAME`: account allowed to push the three Nereus packages.
|
|
- `REGISTRY_PASSWORD`: package-scoped token for that account.
|
|
- `KUBECONFIG_B64`: base64 encoding of a least-privilege deployment kubeconfig.
|
|
|
|
The workflow never prints these values. It writes the kubeconfig to the
|
|
ephemeral workspace with mode `0600`, removes it in an `always()` step, and
|
|
creates the Kubernetes registry pull secret through a pipe so its generated
|
|
manifest is not logged or committed. The pre-existing `nereus-db` Secret is
|
|
required and is only checked for presence.
|