ci: add Forgejo release workflows #27

Merged

pdurlej merged 1 commit from codex/ops-forgejo-ci-release into main

2026-05-10 13:35:00 +02:00

codex commented

2026-05-09 23:38:04 +02:00

Collaborator

Canary status: missing — fire 3+3 review before merge

Summary

Closes #3.

Adds Forgejo-first CI/release workflow files and documents the GHCR release lane for RS2000 without touching production, secrets, migrations, or deploy state.

Scope

Add .forgejo/workflows/ci.yml for a bounded PR/main verification lane.
Add .forgejo/workflows/docker-publish.yml for web, migrate, and MCP Docker image builds.
Preserve RS2000 image names: ghcr.io/pdurlej/kan, ghcr.io/pdurlej/kan-migrate, ghcr.io/pdurlej/kan-mcp.
Preserve immutable sha-<12-char-sha> rollback tags plus main/rs2000 channel tags.
Document required Forgejo runner capabilities and GHCR secrets in docs/deploy/forgejo-ci-release.md.

Non-goals

No production deploy or service restart.
No production DB migration.
No secret, PAT, Infisical, or GHCR token change.
No RS2000 infra repo changes.
No attempt to fix the existing root lint/typecheck baseline.

Spec sources read

Forgejo Actions user guide: .forgejo/workflows is the primary workflow directory and .github/workflows is only fallback when .forgejo/workflows is absent.
Forgejo Actions basic concepts/reference: github context is compatible with forgejo, and Forgejo repository tokens are scoped to the Forgejo repository, so GHCR push uses explicit GHCR_USERNAME / GHCR_TOKEN secrets.
Existing Kan-ductor deployment docs in docs/deploy/rs2000-kan.md.

Tests / smoke

pnpm exec prettier --check .forgejo/workflows/ci.yml .forgejo/workflows/docker-publish.yml docs/deploy/forgejo-ci-release.md docs/deploy/rs2000-kan.md
pnpm --filter @kan/api typecheck
pnpm --filter @kan/mcp typecheck
ruby -e 'require "yaml"; ...' .forgejo/workflows/*.yml
bash -n over every workflow run: block
docker buildx version

Known baseline gaps:

pnpm lint fails on current main for existing ESLint/package config issues outside this PR.
pnpm typecheck fails on current main, especially apps/docs and existing web type mismatches.

Rollback

Revert commit 5502759 or delete .forgejo/workflows/* to return Forgejo to its previous .github/workflows fallback behavior. No data migration or production state change is involved.

Owner gates

Required before operational use:

Piotr configures Forgejo secrets GHCR_USERNAME and GHCR_TOKEN.
Piotr confirms the Forgejo runner label/capabilities if not ubuntu-latest with Docker Buildx.
Piotr explicitly approves any production deploy/restart or DB migration that consumes these images.

Canary status: missing — fire 3+3 review before merge ## Summary Closes #3. Adds Forgejo-first CI/release workflow files and documents the GHCR release lane for RS2000 without touching production, secrets, migrations, or deploy state. ## Scope - Add `.forgejo/workflows/ci.yml` for a bounded PR/main verification lane. - Add `.forgejo/workflows/docker-publish.yml` for web, migrate, and MCP Docker image builds. - Preserve RS2000 image names: `ghcr.io/pdurlej/kan`, `ghcr.io/pdurlej/kan-migrate`, `ghcr.io/pdurlej/kan-mcp`. - Preserve immutable `sha-<12-char-sha>` rollback tags plus `main`/`rs2000` channel tags. - Document required Forgejo runner capabilities and GHCR secrets in `docs/deploy/forgejo-ci-release.md`. ## Non-goals - No production deploy or service restart. - No production DB migration. - No secret, PAT, Infisical, or GHCR token change. - No RS2000 infra repo changes. - No attempt to fix the existing root lint/typecheck baseline. ## Spec sources read - Forgejo Actions user guide: `.forgejo/workflows` is the primary workflow directory and `.github/workflows` is only fallback when `.forgejo/workflows` is absent. - Forgejo Actions basic concepts/reference: `github` context is compatible with `forgejo`, and Forgejo repository tokens are scoped to the Forgejo repository, so GHCR push uses explicit `GHCR_USERNAME` / `GHCR_TOKEN` secrets. - Existing Kan-ductor deployment docs in `docs/deploy/rs2000-kan.md`. ## Tests / smoke - `pnpm exec prettier --check .forgejo/workflows/ci.yml .forgejo/workflows/docker-publish.yml docs/deploy/forgejo-ci-release.md docs/deploy/rs2000-kan.md` - `pnpm --filter @kan/api typecheck` - `pnpm --filter @kan/mcp typecheck` - `ruby -e 'require "yaml"; ...' .forgejo/workflows/*.yml` - `bash -n` over every workflow `run:` block - `docker buildx version` Known baseline gaps: - `pnpm lint` fails on current `main` for existing ESLint/package config issues outside this PR. - `pnpm typecheck` fails on current `main`, especially `apps/docs` and existing web type mismatches. ## Rollback Revert commit `5502759` or delete `.forgejo/workflows/*` to return Forgejo to its previous `.github/workflows` fallback behavior. No data migration or production state change is involved. ## Owner gates Required before operational use: - Piotr configures Forgejo secrets `GHCR_USERNAME` and `GHCR_TOKEN`. - Piotr confirms the Forgejo runner label/capabilities if not `ubuntu-latest` with Docker Buildx. - Piotr explicitly approves any production deploy/restart or DB migration that consumes these images.

codex added 1 commit

2026-05-09 23:38:04 +02:00

ci: add forgejo release workflows

Forgejo CI / verify (pull_request) Successful in 10m52s

Details

Forgejo Docker Images / build (pull_request) Failing after 5s

Details

5502759aa1

codex referenced this pull request

2026-05-09 23:38:10 +02:00

ops/forgejo-first-ci-and-release #3

codex commented

2026-05-10 08:48:11 +02:00

Author

Collaborator

3+3 Review Result

Status: OK with residual risk

Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus.

Deterministic checks on current stack tip:

PASS: @kan/db typecheck/build
PASS: @kan/shared typecheck/build
PASS: @kan/mcp typecheck/build
PASS: @kan/api typecheck/build and focused agent tests: 28/28
FAIL: targeted web ESLint currently reports apps/web/src/views/card/components/ActivityList.tsx:374 unused isAdmin
FAIL, known broader baseline: @kan/web typecheck still has existing bootstrap/workspace typing errors

Canary gate: current automated canary is not green for the draft stack; treat this as a review/checkpoint result, not merge approval.

Review notes:

No 3+3 blocker found. Residual risk: Forgejo/GHCR release path still needs live runner/deploy validation and explicit operator rollback discipline.

## 3+3 Review Result Status: **OK with residual risk** Review lanes completed: tech-ollama-1, tech-ollama-2, tech-codex, product-ollama-1, product-ollama-2, product-claude-opus. Deterministic checks on current stack tip: - PASS: `@kan/db` typecheck/build - PASS: `@kan/shared` typecheck/build - PASS: `@kan/mcp` typecheck/build - PASS: `@kan/api` typecheck/build and focused agent tests: 28/28 - FAIL: targeted web ESLint currently reports `apps/web/src/views/card/components/ActivityList.tsx:374` unused `isAdmin` - FAIL, known broader baseline: `@kan/web typecheck` still has existing bootstrap/workspace typing errors Canary gate: current automated canary is **not green** for the draft stack; treat this as a review/checkpoint result, not merge approval. Review notes: - No 3+3 blocker found. Residual risk: Forgejo/GHCR release path still needs live runner/deploy validation and explicit operator rollback discipline.