quine-global/site-image
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Forgejo action for our Docker-based sites: build and push the image, then open a petersweb-infra PR that bumps its pinned digest.
2 commits 1 branch 1 tag 30 KiB
Find a file
Philip Peterson 9cc94f92b7 Use the forge's public address, not github.server_url 
The forge VM's runner is told http://localhost:3000, which a job
container can't reach, so cloning petersweb-infra and the PR API would
fail there. New input server, default https://forge.quinefoundation.com.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-02 05:35:49 -09:00
action.yml Use the forge's public address, not github.server_url 2026-11-02 05:35:49 -09:00
README.md Use the forge's public address, not github.server_url 2026-11-02 05:35:49 -09:00

README.md

site-image

A Forgejo action for our Docker-based sites (hyper.quineglobal.com and the others petersweb-infra runs): on every push to a site's main,

  1. build its image and push it to the forge's registry, tagged with the commit;
  2. open a PR on Cold-Air-Networks/petersweb-infra that replaces the image's pinned @sha256: digest with the new one.

Merging the PR deploys it. (The sites run on the forge VM, so after merging, ./tart/apply.sh on the Mac mini; see petersweb-infra's docs.)

Using it

In the site's repo, .forgejo/workflows/deploy.yml:

name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  image:
    runs-on: runner-x86-linux
    steps:
      - uses: actions/checkout@v4
      - uses: https://forge.quinefoundation.com/quine-global/site-image@v1
        with:
          image: forge.quinefoundation.com/ironmagma/hyper-quineglobal-com
          infra-file: nixos/linux.nix
          name: hyper
          registry-username: ${{ secrets.REGISTRY_USERNAME }}
          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
          infra-token: ${{ secrets.INFRA_TOKEN }}
  • image: exactly as petersweb-infra pins it, without tag or digest.
  • infra-file: the petersweb-infra file with <image>@sha256:<digest> (nixos/linux.nix, or e.g. nixos/arion-riverside/arion-compose.nix).
  • Optional: server (default https://forge.quinefoundation.com; not the runner-reported address, which can be localhost), name (branch and PR title; default the image's last path part), context (default .), containerfile, platform (default linux/amd64), infra-repo.

The secrets are organization-level (quine-global, Cold-Air-Networks):

Secret
REGISTRY_USERNAME The account that owns the token
REGISTRY_PASSWORD Its token, with package write (pushes the image)
INFRA_TOKEN A token with repository write on petersweb-infra (pushes the branch, opens the PR)

If petersweb-infra already pins the digest (a rebuild of the same commit), no PR is opened.

Versions

Sites use @v1, a tag moved forward for compatible changes; breaking ones get v2.