luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(ci): split publish into standalone push-only workflow + document release model #5

Merged
luckberg merged 4 commits from gsd/quick-split-publish into main 2026-06-11 19:04:31 -04:00
Conversation 0 Commits 4 Files Changed 6
+77 -55
2 changed files with 77 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bb331fd110 - Show all commits
.gitea/workflows/ci.yml
-55
View File
@@ -3,11 +3,6 @@ name: CI
on:
pull_request:
branches: [main]
push:
branches: [main]
env:
MILESTONE: v1.1
jobs:
fast-checks:
@@ -310,53 +305,3 @@ jobs:
name: playwright-traces-${{ github.run_id }}
path: apps/pwa/test-results/
retention-days: 14
publish:
runs-on: ubuntu-latest
# Push to main only — never on pull_request (D-03). No dev-bypass flag in this job (T-08-09).
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
# Compute both image tags per D-04:
# :latest — moving pointer for easy pulls
# :<milestone>-<shortsha> — immutable, rollback-traceable (e.g. v1.1-4303a1b)
# GITHUB_SHA is confirmed available in Gitea Actions (probe P-13).
# MILESTONE is read from the workflow-level env var (set to v1.1 above) — update at milestone boundaries.
- name: Compute image tags
id: tags
run: |
SHORT_SHA=${GITHUB_SHA:0:7}
MILESTONE="${{ env.MILESTONE }}"
echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT
echo "sha_tag=git.bergerhouse.net/luckberg/familysync-api:${MILESTONE}-${SHORT_SHA}" >> $GITHUB_OUTPUT
# Pitfall 13 (load-bearing security step): PAT piped via stdin — never via -p/--password.
# GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required
# (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber
# and never echoed elsewhere or set as a plain env var.
# Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
# for secret names, so the GITEA_-prefixed name cannot be created.
- name: Docker login
run: |
echo "${{ secrets.REGISTRY_PAT }}" | \
docker login git.bergerhouse.net \
--username luckberg \
--password-stdin
# Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
# lockfile from the root context; building from apps/api/ would fail to find them.
- name: Build and push
run: |
docker build --target production \
-f apps/api/Dockerfile \
-t ${{ steps.tags.outputs.latest }} \
-t ${{ steps.tags.outputs.sha_tag }} \
.
docker push ${{ steps.tags.outputs.latest }}
docker push ${{ steps.tags.outputs.sha_tag }}
# Always drop the stored credential from the runner after push (defence in depth).
- name: Docker logout
if: always()
run: docker logout git.bergerhouse.net || true
.gitea/workflows/publish.yml
+77
View File
@@ -0,0 +1,77 @@
# Publishing / Releases
#
# Trigger: push to main — i.e. when any PR merges.
# Image: git.bergerhouse.net/luckberg/familysync-api
# Tags:
# :latest — moving pointer for easy pulls
# :<MILESTONE>-<shortsha> — immutable, rollback-traceable (e.g. v1.1-98acff8)
#
# Required secret: REGISTRY_PAT — a Gitea Actions secret holding a PAT with write:package scope.
# Named REGISTRY_PAT (not GITEA_*): Gitea reserves the GITEA_ prefix for secret names, so
# GITEA_-prefixed names cannot be created. GITEA_TOKEN / GITHUB_TOKEN cannot push packages.
#
# Safety gate: branch protection on main, NOT a needs: dependency in this file.
# The PR test jobs (fast-checks, api, harness in ci.yml) run on pull_request — they never
# run in the same workflow invocation as publish.yml. Tests gate the PR; main is trusted to
# be green because direct push and force push are blocked and the three required checks
# (CI / fast-checks, CI / api, CI / harness) must pass before merge.
#
# To bump the milestone tag at a milestone boundary: edit MILESTONE below.
name: Publish
on:
push:
branches: [main]
env:
MILESTONE: v1.1
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# Compute both image tags per D-04:
# :latest — moving pointer for easy pulls
# :<milestone>-<shortsha> — immutable, rollback-traceable (e.g. v1.1-4303a1b)
# GITHUB_SHA is confirmed available in Gitea Actions (probe P-13).
# MILESTONE is read from the workflow-level env var (set to v1.1 above) — update at milestone boundaries.
- name: Compute image tags
id: tags
run: |
SHORT_SHA=${GITHUB_SHA:0:7}
MILESTONE="${{ env.MILESTONE }}"
echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT
echo "sha_tag=git.bergerhouse.net/luckberg/familysync-api:${MILESTONE}-${SHORT_SHA}" >> $GITHUB_OUTPUT
# Pitfall 13 (load-bearing security step): PAT piped via stdin — never via -p/--password.
# GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required
# (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber
# and never echoed elsewhere or set as a plain env var.
# Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
# for secret names, so the GITEA_-prefixed name cannot be created.
- name: Docker login
run: |
echo "${{ secrets.REGISTRY_PAT }}" | \
docker login git.bergerhouse.net \
--username luckberg \
--password-stdin
# Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
# lockfile from the root context; building from apps/api/ would fail to find them.
- name: Build and push
run: |
docker build --target production \
-f apps/api/Dockerfile \
-t ${{ steps.tags.outputs.latest }} \
-t ${{ steps.tags.outputs.sha_tag }} \
.
docker push ${{ steps.tags.outputs.latest }}
docker push ${{ steps.tags.outputs.sha_tag }}
# Always drop the stored credential from the runner after push (defence in depth).
- name: Docker logout
if: always()
run: docker logout git.bergerhouse.net || true