# ADR-0007: CI on Gitea Actions, images in Gitea Packages

**Status:** Accepted — 2026-07-15 · **Supersedes** the GitHub Actions + GHCR specifics of
[ADR-0001](0001-gitops-with-argocd.md) (the ArgoCD/GitOps model itself stands).

> ⚠️ **Partially superseded by [ADR-0008](0008-private-package-external-secrets-pull.md).** The
> registry-visibility (public → **private**), image-pull path (registries.yaml/k3s-restart →
> **public-HTTPS pull, no restart**), CI auth (auto token → **`CI_TOKEN` PAT**), and pipeline
> (**Playwright e2e removed from CI**) below were changed once built. The "CI on Gitea Actions,
> images in Gitea Packages" core still holds. Read ADR-0008 for the as-built details.

## Context

The repo lives on the homelab's self-hosted **Gitea** (`bmr_bluecap/bcs-website`), not GitHub, so
GitHub Actions and GHCR do not apply. Gitea runs an **`act_runner`** (GitHub-Actions-compatible)
and a built-in **container registry** (Gitea Packages, OCI `/v2/` confirmed live at
`10.66.15.22:3000`). The runner mounts `/var/run/docker.sock`; its label is `ubuntu-latest`
(jobs run in a `node:18-bullseye` container).

## Decision

- **CI = Gitea Actions**, workflow at `.gitea/workflows/ci.yml`, `runs-on: ubuntu-latest`.
- **Registry = Gitea Packages** at `10.66.15.22:3000/bmr_bluecap/bcs-website`, immutable
  `<git-sha>` tags. Auth via the run's automatic token.
- Pipeline: `npm ci` → build (typecheck) → `seo:lint` → Playwright e2e → build & push image →
  bump the image tag in `k8s/kustomization.yaml` and commit back to `main` (`[skip ci]` +
  `paths-ignore` to avoid a loop). **ArgoCD** then reconciles k3s (unchanged from ADR-0001).
- **Package visibility: public** (recommended) — the image contains only the compiled public
  site, so a public package removes the need for a cluster imagePullSecret. Private + an
  External-Secrets-managed pull secret is the documented alternative.

## Consequences

- No external CI/registry dependency; everything stays in the homelab.
- **New infra prerequisites** (see `docs/gitops-deployment-strategy.md`): k3s must trust the HTTP
  registry (`registries.yaml` / `k3s_registry_mirrors` entry for `10.66.15.22:3000`); the runner
  host's Docker daemon needs `10.66.15.22:3000` as an insecure registry; docker must be usable
  from job containers (act_runner socket passthrough) or the build switches to kaniko.
- `GHCR`/`GitHub` references in ADR-0001 and older doc revisions are superseded by this ADR.