gitea_adminandClaude Opus 4.8
3dab3bc9fb
- .gitea/workflows/ci.yml: build → seo:lint → e2e → image build/push → bump k8s image tag and commit back (paths-ignore + [skip ci] guard) - argocd/bcs-website-application.yaml: ArgoCD App (internal Gitea repoURL, k8s path) - k8s: image → Gitea Packages path; kustomization images newTag stanza - ADR-0007 (Gitea Actions + Packages), supersedes GHCR/GitHub bits of ADR-0001 - Reconcile gitops-deployment-strategy.md to Gitea Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
2.0 KiB
Markdown
34 lines
2.0 KiB
Markdown
# ADR-0007: CI on Gitea Actions, images in Gitea Packages
|
|
|
|
**Status:** Accepted — 2026-07-15 · **Supersedes** the GitHub Actions + GHCR specifics of
|
|
[ADR-0001](0001-gitops-with-argocd.md) (the ArgoCD/GitOps model itself stands).
|
|
|
|
## Context
|
|
|
|
The repo lives on the homelab's self-hosted **Gitea** (`bmr_bluecap/bcs-website`), not GitHub, so
|
|
GitHub Actions and GHCR do not apply. Gitea runs an **`act_runner`** (GitHub-Actions-compatible)
|
|
and a built-in **container registry** (Gitea Packages, OCI `/v2/` confirmed live at
|
|
`10.66.15.22:3000`). The runner mounts `/var/run/docker.sock`; its label is `ubuntu-latest`
|
|
(jobs run in a `node:18-bullseye` container).
|
|
|
|
## Decision
|
|
|
|
- **CI = Gitea Actions**, workflow at `.gitea/workflows/ci.yml`, `runs-on: ubuntu-latest`.
|
|
- **Registry = Gitea Packages** at `10.66.15.22:3000/bmr_bluecap/bcs-website`, immutable
|
|
`<git-sha>` tags. Auth via the run's automatic token.
|
|
- Pipeline: `npm ci` → build (typecheck) → `seo:lint` → Playwright e2e → build & push image →
|
|
bump the image tag in `k8s/kustomization.yaml` and commit back to `main` (`[skip ci]` +
|
|
`paths-ignore` to avoid a loop). **ArgoCD** then reconciles k3s (unchanged from ADR-0001).
|
|
- **Package visibility: public** (recommended) — the image contains only the compiled public
|
|
site, so a public package removes the need for a cluster imagePullSecret. Private + an
|
|
External-Secrets-managed pull secret is the documented alternative.
|
|
|
|
## Consequences
|
|
|
|
- No external CI/registry dependency; everything stays in the homelab.
|
|
- **New infra prerequisites** (see `docs/gitops-deployment-strategy.md`): k3s must trust the HTTP
|
|
registry (`registries.yaml` / `k3s_registry_mirrors` entry for `10.66.15.22:3000`); the runner
|
|
host's Docker daemon needs `10.66.15.22:3000` as an insecure registry; docker must be usable
|
|
from job containers (act_runner socket passthrough) or the build switches to kaniko.
|
|
- `GHCR`/`GitHub` references in ADR-0001 and older doc revisions are superseded by this ADR.
|