Enable Forgejo Actions (Phase 1) #48

Merged
eblume merged 8 commits from feature/forgejo-actions-p1 into main 2026-01-23 17:00:13 -08:00

8 commits

Author SHA1 Message Date
66c20e8edd Fix checkout to use head_ref for PRs
All checks were successful
Test CI / test (pull_request) Successful in 0s
gitea.ref_name returns PR number for pull_request events, need to
use gitea.head_ref to get the actual branch name.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:56:18 -08:00
b2c5716e21 Fix test workflow for host mode, add custom runner image plan
Some checks failed
Test CI / test (pull_request) Failing after 0s
- Use git clone instead of actions/checkout (no Node.js in runner)
- Add Use Case 0 to P4: build custom runner image with Node.js

The stock forgejo/runner image lacks Node.js, so standard GitHub
Actions don't work in host mode. P4 now includes building a custom
runner image as the first step.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:54:53 -08:00
70f2227313 Add test workflow and document CI/CD setup
Some checks failed
Test CI / test (pull_request) Failing after 38s
- Create .forgejo/workflows/test.yaml with basic hello world workflow
- Update README.md with CI/CD section explaining Forgejo Actions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:51:51 -08:00
338456b820 Switch Forgejo runner to host mode
- Use host labels (ubuntu-latest:host) instead of docker://
- Remove RBAC (not needed for host mode)
- Simplify configmap (no container backend config needed)

Host mode runs jobs directly in the runner container, which is
acceptable since we control all workflows and the pod provides
isolation from indri.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:40:37 -08:00
460449326e Switch Forgejo runner to Kubernetes backend
- Use k8s pods instead of Docker containers for job execution
- Add RBAC for runner to create/manage job pods
- Add ConfigMap with runner config for kubernetes backend
- Remove Docker socket mount (no longer needed)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:28:34 -08:00
266f5944b9 Fix Forgejo runner to use internal k8s service URL
Use http://forge.tailscale.svc.cluster.local:3001 instead of
https://forge.tail8d86e.ts.net - the Tailscale operator provides
egress routing to indri via this internal service.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:20:04 -08:00
feff296979 Add Forgejo Actions runner k8s deployment
- ArgoCD Application for forgejo-runner
- Deployment with Docker socket access for running workflow containers
- Secret template for runner registration token (via op inject)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 16:09:27 -08:00
7653c85649 Refactor Forgejo config to use 1Password secrets
- Move app.ini to ansible template with secrets from 1Password
- Enable Forgejo Actions in config
- Add DEFAULT_REPO_UNITS with repo.actions
- Clean up unused MySQL database fields (using SQLite)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 15:51:53 -08:00