quine-global/site-image
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
site-image/README.md
Philip Peterson 81e622cd52 Use the forge's tailnet name, forge.in.quineglobal.com 
The forge is tailnet-only since 2026-11-04 (petersweb-infra,
docs/FORGE_INTERNAL.md); forge.quinefoundation.com goes away.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-04 00:14:55 -09:00

2.1 KiB
Raw Permalink Blame History

site-image

A Forgejo action for our Docker-based sites (hyper.quineglobal.com and the others petersweb-infra runs): on every push to a site's main,

  1. build its image and push it to the forge's registry, tagged with the commit;
  2. open a PR on Cold-Air-Networks/petersweb-infra that replaces the image's pinned @sha256: digest with the new one.

Merging the PR deploys it. (The sites run on the forge VM, so after merging, ./tart/apply.sh on the Mac mini; see petersweb-infra's docs.)

Using it

In the site's repo, .forgejo/workflows/deploy.yml:

name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  image:
    runs-on: runner-x86-linux
    steps:
      - uses: actions/checkout@v4
      - uses: https://forge.in.quineglobal.com/quine-global/site-image@v1
        with:
          image: forge.in.quineglobal.com/ironmagma/hyper-quineglobal-com
          infra-file: nixos/linux.nix
          name: hyper
          registry-username: ${{ secrets.REGISTRY_USERNAME }}
          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
          infra-token: ${{ secrets.INFRA_TOKEN }}
  • image: exactly as petersweb-infra pins it, without tag or digest.
  • infra-file: the petersweb-infra file with <image>@sha256:<digest> (nixos/linux.nix, or e.g. nixos/arion-riverside/arion-compose.nix).
  • Optional: server (default https://forge.in.quineglobal.com; not the runner-reported address, which can be localhost), name (branch and PR title; default the image's last path part), context (default .), containerfile, platform (default linux/amd64), infra-repo.

The secrets are organization-level (quine-global, Cold-Air-Networks):

Secret
REGISTRY_USERNAME The account that owns the token
REGISTRY_PASSWORD Its token, with package write (pushes the image)
INFRA_TOKEN A token with repository write on petersweb-infra (pushes the branch, opens the PR)

If petersweb-infra already pins the digest (a rebuild of the same commit), no PR is opened.

Versions

Sites use @v1, a tag moved forward for compatible changes; breaking ones get v2.