kenpat
f38decc285
- apps/forgejo/docker-compose.yml: enable FORGEJO__actions__ENABLED=true
- apps/forgejo-runner/docker-compose.yml: forgejo-runner:3.5.0 container
mounts docker.sock so jobs can spin up containers on monk
- .forgejo/workflows/ci.yml: 3-job pipeline on every push to main
compose-lint → validates all apps/*/docker-compose.yml
secrets-check → scans for hardcoded passwords/tokens/keys
shellcheck → lints all scripts/*.sh
- docs/ci-cd-setup.md: runner registration steps + extension guide
PENDING (needs user action):
1. docker compose up -d --force-recreate in apps/forgejo/ to apply env
2. Get runner token from Forgejo admin panel
3. Run forgejo-runner register with token, then docker compose up
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
91 lines
2.5 KiB
Markdown
91 lines
2.5 KiB
Markdown
# Forgejo Actions CI/CD Setup
|
|
|
|
Forgejo Actions is GitHub Actions-compatible CI/CD built into Forgejo. Every push to `kitestacks-homelab` triggers: compose validation, secret leak scan, and shellcheck.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Developer pushes to Forgejo
|
|
│
|
|
▼
|
|
Forgejo Actions scheduler
|
|
│
|
|
▼
|
|
forgejo-runner container
|
|
├── compose-lint job (validates all apps/*/docker-compose.yml)
|
|
├── secrets-check job (scans for hardcoded passwords/tokens)
|
|
└── shellcheck job (lints all scripts/*.sh)
|
|
```
|
|
|
|
## One-time setup
|
|
|
|
### 1. Restart Forgejo to enable Actions
|
|
|
|
Actions is now enabled via `FORGEJO__actions__ENABLED=true` in the compose env. Restart to apply:
|
|
|
|
```bash
|
|
cd ~/kitestacks-homelab/apps/forgejo
|
|
docker compose up -d --force-recreate
|
|
```
|
|
|
|
Verify in the Forgejo UI: Admin Panel → Configuration → Actions = Enabled
|
|
|
|
### 2. Get a runner registration token
|
|
|
|
In Forgejo web UI:
|
|
- Site Admin → Actions → Runners → **Create new runner token**
|
|
- Copy the token (starts with `grt_...`)
|
|
|
|
### 3. Register and start the runner
|
|
|
|
```bash
|
|
cd ~/kitestacks-homelab/apps/forgejo-runner
|
|
mkdir -p config
|
|
|
|
# Register the runner (one-time, interactive)
|
|
docker run --rm -it \
|
|
-v $(pwd)/config:/etc/act_runner \
|
|
code.forgejo.org/forgejo/runner:3.5.0 \
|
|
register \
|
|
--instance http://forgejo:3000 \
|
|
--token <paste-grt-token-here> \
|
|
--name monk-runner \
|
|
--labels docker:docker://node:20
|
|
|
|
# Start the runner daemon
|
|
docker compose up -d
|
|
```
|
|
|
|
### 4. Verify
|
|
|
|
Push any change to kitestacks-homelab → Forgejo → Actions tab shows the pipeline running.
|
|
|
|
## Workflow file
|
|
|
|
`.forgejo/workflows/ci.yml` — runs on every push/PR to main:
|
|
|
|
| Job | What it does |
|
|
|-----|-------------|
|
|
| `compose-lint` | `docker compose config --quiet` on all compose files |
|
|
| `secrets-check` | grep for hardcoded passwords, tokens, private keys |
|
|
| `shellcheck` | static analysis on all `scripts/*.sh` |
|
|
|
|
## Adding workflows to other repos
|
|
|
|
Copy `.forgejo/workflows/ci.yml` into any repo that has a runner label matching `docker`. The runner on monk can serve all repos in your Forgejo instance.
|
|
|
|
## Extending the pipeline
|
|
|
|
Add a deploy job that runs after tests pass:
|
|
|
|
```yaml
|
|
deploy:
|
|
name: Deploy to monk
|
|
runs-on: docker
|
|
needs: [compose-lint, secrets-check, shellcheck]
|
|
if: github.ref == 'refs/heads/main'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Redeploy changed app
|
|
run: docker compose -f apps/myapp/docker-compose.yml up -d --pull always
|
|
```
|