ci: run CI from .github/workflows and drop the Forgejo workflow (#69)
- commit
- 7fabed9e2b4c058108a264435de110850b954f1a
- author
- brice · · 2026-10-18 15:44 UTC
- committer
- bnema · · 2026-10-18 15:44 UTC
- parent
- 66bbda9
- signature
- SSH Unverified
SHA256:VOCA5lYARHcbKDZ7GhTV45VmcjWnJ6ZQIBazj17LivAThe key is unknown - refs
- tag: v0.25.1
7 files · +19 -35
M .dockerignore +1 -1
| @@ -1,7 +1,7 @@ | |||
| 1 | 1 | # Keep the build context to the sources. | |
| 2 | 2 | .git | |
| 3 | 3 | .worktrees | |
| 4 | - | .forgejo | |
| 4 | + | .github | |
| 5 | 5 | .air.toml | |
| 6 | 6 | compose.yaml | |
| 7 | 7 | Dockerfile | |
| @@ -1,7 +1,7 @@ | |||||
| 1 | # Keep the build context to the sources. | 1 | # Keep the build context to the sources. | ||
| 2 | .git | 2 | .git | ||
| 3 | .worktrees | 3 | .worktrees | ||
| 4 | - | .forgejo | 4 | + | .github |
| 5 | .air.toml | 5 | .air.toml | ||
| 6 | compose.yaml | 6 | compose.yaml | ||
| 7 | Dockerfile | 7 | Dockerfile | ||
R .forgejo/workflows/ci.yml → .github/workflows/ci.yml +10 -25 renamed, 69% similar
| @@ -8,7 +8,6 @@ on: | |||
| 8 | 8 | env: | |
| 9 | 9 | # Test the module alone, with the versions in go.mod (never a go.work). | |
| 10 | 10 | GOWORK: "off" | |
| 11 | - | GOPRIVATE: bnema.dev/ermite* | |
| 12 | 11 | ||
| 13 | 12 | jobs: | |
| 14 | 13 | lint: | |
| @@ -16,9 +15,6 @@ jobs: | |||
| 16 | 15 | runs-on: ubuntu-latest | |
| 17 | 16 | steps: | |
| 18 | 17 | - uses: actions/checkout@v6 | |
| 19 | - | # Job containers reach the forge over plain HTTP on the host loopback. | |
| 20 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | |
| 21 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | |
| 22 | 18 | - uses: actions/setup-go@v5 | |
| 23 | 19 | with: | |
| 24 | 20 | go-version-file: go.mod | |
| @@ -30,8 +26,9 @@ jobs: | |||
| 30 | 26 | test: | |
| 31 | 27 | name: Test | |
| 32 | 28 | # ermite needs git >= 2.45; the ubuntu-latest image (Debian bookworm) has 2.39. | |
| 33 | - | # The arch label runs archlinux:latest as root, with a current git. | |
| 34 | - | runs-on: arch | |
| 29 | + | # The job runs in archlinux:latest as root, with a current git. | |
| 30 | + | runs-on: ubuntu-latest | |
| 31 | + | container: archlinux:latest | |
| 35 | 32 | steps: | |
| 36 | 33 | # openssh provides ssh-keygen, which the tests use to check that the squash | |
| 37 | 34 | # commits verify (git verify-commit, ADR 0022). The tests fail without it when CI is set. | |
| @@ -39,9 +36,10 @@ jobs: | |||
| 39 | 36 | - name: System packages | |
| 40 | 37 | run: pacman -Syu --noconfirm --needed git gcc openssh nodejs | |
| 41 | 38 | - uses: actions/checkout@v6 | |
| 42 | - | # Job containers reach the forge over plain HTTP on the host loopback. | |
| 43 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | |
| 44 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | |
| 39 | + | # The workspace belongs to the runner user, not root: without this, git does not | |
| 40 | + | # treat it as a repository and `git diff a b` compares the two files instead. | |
| 41 | + | - name: Trust the workspace | |
| 42 | + | run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| 45 | 43 | - uses: actions/setup-go@v5 | |
| 46 | 44 | with: | |
| 47 | 45 | go-version-file: go.mod | |
| @@ -84,9 +82,6 @@ jobs: | |||
| 84 | 82 | with: | |
| 85 | 83 | # buf breaking compares with the base branch. | |
| 86 | 84 | fetch-depth: 0 | |
| 87 | - | # Job containers reach the forge over plain HTTP on the host loopback. | |
| 88 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | |
| 89 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | |
| 90 | 85 | - uses: actions/setup-go@v5 | |
| 91 | 86 | with: | |
| 92 | 87 | go-version-file: go.mod | |
| @@ -109,27 +104,17 @@ jobs: | |||
| 109 | 104 | ||
| 110 | 105 | image: | |
| 111 | 106 | name: Image | |
| 112 | - | # Build only, nothing is pushed. The arch job container gets the runner's rootless | |
| 113 | - | # Podman socket as /var/run/docker.sock (docker_host in ci-runner/config.yml), so the | |
| 114 | - | # docker CLI builds through Podman. | |
| 115 | - | runs-on: arch | |
| 107 | + | # Build only, nothing is pushed. A plain ubuntu-latest job (not a container): | |
| 108 | + | # the runner image provides the docker CLI and daemon. | |
| 109 | + | runs-on: ubuntu-latest | |
| 116 | 110 | steps: | |
| 117 | - | - name: System packages | |
| 118 | - | run: pacman -Syu --noconfirm --needed git docker | |
| 119 | 111 | - uses: actions/checkout@v6 | |
| 120 | 112 | with: | |
| 121 | 113 | # git describe needs the tags for the image version. | |
| 122 | 114 | fetch-depth: 0 | |
| 123 | - | # The build runs in Podman on the runner host. With the host network it resolves | |
| 124 | - | # the forge through the host's /etc/hosts (loopback) and reaches it over plain HTTP. | |
| 125 | - | # Podman's Docker API rejects | |
| 126 | - | # the classic builder's --add-host encoding, so host networking is used instead. | |
| 127 | - | # Acceptable because only trusted branches of this repo trigger CI (no fork PRs). | |
| 128 | 115 | - name: Build the image | |
| 129 | 116 | run: | | |
| 130 | 117 | docker build \ | |
| 131 | - | --network host \ | |
| 132 | - | --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ \ | |
| 133 | 118 | --build-arg VERSION="$(git describe --tags --always --dirty)" \ | |
| 134 | 119 | -t ermite:ci . | |
| 135 | 120 | - name: Smoke test | |
| @@ -8,7 +8,6 @@ on: | |||||
| 8 | env: | 8 | env: | ||
| 9 | # Test the module alone, with the versions in go.mod (never a go.work). | 9 | # Test the module alone, with the versions in go.mod (never a go.work). | ||
| 10 | GOWORK: "off" | 10 | GOWORK: "off" | ||
| 11 | - | GOPRIVATE: bnema.dev/ermite* | |||
| 12 | 11 | ||||
| 13 | jobs: | 12 | jobs: | ||
| 14 | lint: | 13 | lint: | ||
| @@ -16,9 +15,6 @@ jobs: | |||||
| 16 | runs-on: ubuntu-latest | 15 | runs-on: ubuntu-latest | ||
| 17 | steps: | 16 | steps: | ||
| 18 | - uses: actions/checkout@v6 | 17 | - uses: actions/checkout@v6 | ||
| 19 | - | # Job containers reach the forge over plain HTTP on the host loopback. | |||
| 20 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | |||
| 21 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | |||
| 22 | - uses: actions/setup-go@v5 | 18 | - uses: actions/setup-go@v5 | ||
| 23 | with: | 19 | with: | ||
| 24 | go-version-file: go.mod | 20 | go-version-file: go.mod | ||
| @@ -30,8 +26,9 @@ jobs: | |||||
| 30 | test: | 26 | test: | ||
| 31 | name: Test | 27 | name: Test | ||
| 32 | # ermite needs git >= 2.45; the ubuntu-latest image (Debian bookworm) has 2.39. | 28 | # ermite needs git >= 2.45; the ubuntu-latest image (Debian bookworm) has 2.39. | ||
| 33 | - | # The arch label runs archlinux:latest as root, with a current git. | 29 | + | # The job runs in archlinux:latest as root, with a current git. |
| 34 | - | runs-on: arch | 30 | + | runs-on: ubuntu-latest |
| 31 | + | container: archlinux:latest | |||
| 35 | steps: | 32 | steps: | ||
| 36 | # openssh provides ssh-keygen, which the tests use to check that the squash | 33 | # openssh provides ssh-keygen, which the tests use to check that the squash | ||
| 37 | # commits verify (git verify-commit, ADR 0022). The tests fail without it when CI is set. | 34 | # commits verify (git verify-commit, ADR 0022). The tests fail without it when CI is set. | ||
| @@ -39,9 +36,10 @@ jobs: | |||||
| 39 | - name: System packages | 36 | - name: System packages | ||
| 40 | run: pacman -Syu --noconfirm --needed git gcc openssh nodejs | 37 | run: pacman -Syu --noconfirm --needed git gcc openssh nodejs | ||
| 41 | - uses: actions/checkout@v6 | 38 | - uses: actions/checkout@v6 | ||
| 42 | - | # Job containers reach the forge over plain HTTP on the host loopback. | 39 | + | # The workspace belongs to the runner user, not root: without this, git does not |
| 43 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | 40 | + | # treat it as a repository and `git diff a b` compares the two files instead. |
| 44 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | 41 | + | - name: Trust the workspace |
| 42 | + | run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |||
| 45 | - uses: actions/setup-go@v5 | 43 | - uses: actions/setup-go@v5 | ||
| 46 | with: | 44 | with: | ||
| 47 | go-version-file: go.mod | 45 | go-version-file: go.mod | ||
| @@ -84,9 +82,6 @@ jobs: | |||||
| 84 | with: | 82 | with: | ||
| 85 | # buf breaking compares with the base branch. | 83 | # buf breaking compares with the base branch. | ||
| 86 | fetch-depth: 0 | 84 | fetch-depth: 0 | ||
| 87 | - | # Job containers reach the forge over plain HTTP on the host loopback. | |||
| 88 | - | - name: Fetch bnema.dev/ermite* modules through the runner's Forgejo route | |||
| 89 | - | run: git config --global url."http://git.bnema.dev:8088/".insteadOf "https://git.bnema.dev/" | |||
| 90 | - uses: actions/setup-go@v5 | 85 | - uses: actions/setup-go@v5 | ||
| 91 | with: | 86 | with: | ||
| 92 | go-version-file: go.mod | 87 | go-version-file: go.mod | ||
| @@ -109,27 +104,17 @@ jobs: | |||||
| 109 | 104 | ||||
| 110 | image: | 105 | image: | ||
| 111 | name: Image | 106 | name: Image | ||
| 112 | - | # Build only, nothing is pushed. The arch job container gets the runner's rootless | 107 | + | # Build only, nothing is pushed. A plain ubuntu-latest job (not a container): |
| 113 | - | # Podman socket as /var/run/docker.sock (docker_host in ci-runner/config.yml), so the | 108 | + | # the runner image provides the docker CLI and daemon. |
| 114 | - | # docker CLI builds through Podman. | 109 | + | runs-on: ubuntu-latest |
| 115 | - | runs-on: arch | |||
| 116 | steps: | 110 | steps: | ||
| 117 | - | - name: System packages | |||
| 118 | - | run: pacman -Syu --noconfirm --needed git docker | |||
| 119 | - uses: actions/checkout@v6 | 111 | - uses: actions/checkout@v6 | ||
| 120 | with: | 112 | with: | ||
| 121 | # git describe needs the tags for the image version. | 113 | # git describe needs the tags for the image version. | ||
| 122 | fetch-depth: 0 | 114 | fetch-depth: 0 | ||
| 123 | - | # The build runs in Podman on the runner host. With the host network it resolves | |||
| 124 | - | # the forge through the host's /etc/hosts (loopback) and reaches it over plain HTTP. | |||
| 125 | - | # Podman's Docker API rejects | |||
| 126 | - | # the classic builder's --add-host encoding, so host networking is used instead. | |||
| 127 | - | # Acceptable because only trusted branches of this repo trigger CI (no fork PRs). | |||
| 128 | - name: Build the image | 115 | - name: Build the image | ||
| 129 | run: | | 116 | run: | | ||
| 130 | docker build \ | 117 | docker build \ | ||
| 131 | - | --network host \ | |||
| 132 | - | --build-arg GIT_REWRITE_BASE=http://git.bnema.dev:8088/ \ | |||
| 133 | --build-arg VERSION="$(git describe --tags --always --dirty)" \ | 118 | --build-arg VERSION="$(git describe --tags --always --dirty)" \ | ||
| 134 | -t ermite:ci . | 119 | -t ermite:ci . | ||
| 135 | - name: Smoke test | 120 | - name: Smoke test | ||
M Dockerfile +2 -2
| @@ -4,7 +4,7 @@ | |||
| 4 | 4 | # | |
| 5 | 5 | # docker build --build-arg VERSION="$(git describe --tags --always --dirty)" -t ermite . | |
| 6 | 6 | # | |
| 7 | - | # The modules bnema.dev/ermite-* resolve through the bnema.dev vanity path. | |
| 7 | + | # The modules bnema.dev/ermite-* are public and resolve through the bnema.dev vanity path. | |
| 8 | 8 | # GIT_REWRITE_BASE optionally rewrites the git host for builds behind a private route: | |
| 9 | 9 | # --build-arg GIT_REWRITE_BASE=<url> --network host | |
| 10 | 10 | # | |
| @@ -12,7 +12,7 @@ | |||
| 12 | 12 | ||
| 13 | 13 | FROM golang:1.27-alpine3.24 AS build | |
| 14 | 14 | RUN apk add --no-cache git | |
| 15 | - | ENV CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local GOPRIVATE=bnema.dev/ermite* | |
| 15 | + | ENV CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local | |
| 16 | 16 | ARG GIT_REWRITE_BASE= | |
| 17 | 17 | RUN if [ -n "$GIT_REWRITE_BASE" ]; then \ | |
| 18 | 18 | git config --global url."$GIT_REWRITE_BASE".insteadOf https://git.bnema.dev/; \ | |
| @@ -4,7 +4,7 @@ | |||||
| 4 | # | 4 | # | ||
| 5 | # docker build --build-arg VERSION="$(git describe --tags --always --dirty)" -t ermite . | 5 | # docker build --build-arg VERSION="$(git describe --tags --always --dirty)" -t ermite . | ||
| 6 | # | 6 | # | ||
| 7 | - | # The modules bnema.dev/ermite-* resolve through the bnema.dev vanity path. | 7 | + | # The modules bnema.dev/ermite-* are public and resolve through the bnema.dev vanity path. |
| 8 | # GIT_REWRITE_BASE optionally rewrites the git host for builds behind a private route: | 8 | # GIT_REWRITE_BASE optionally rewrites the git host for builds behind a private route: | ||
| 9 | # --build-arg GIT_REWRITE_BASE=<url> --network host | 9 | # --build-arg GIT_REWRITE_BASE=<url> --network host | ||
| 10 | # | 10 | # | ||
| @@ -12,7 +12,7 @@ | |||||
| 12 | 12 | ||||
| 13 | FROM golang:1.27-alpine3.24 AS build | 13 | FROM golang:1.27-alpine3.24 AS build | ||
| 14 | RUN apk add --no-cache git | 14 | RUN apk add --no-cache git | ||
| 15 | - | ENV CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local GOPRIVATE=bnema.dev/ermite* | 15 | + | ENV CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local |
| 16 | ARG GIT_REWRITE_BASE= | 16 | ARG GIT_REWRITE_BASE= | ||
| 17 | RUN if [ -n "$GIT_REWRITE_BASE" ]; then \ | 17 | RUN if [ -n "$GIT_REWRITE_BASE" ]; then \ | ||
| 18 | git config --global url."$GIT_REWRITE_BASE".insteadOf https://git.bnema.dev/; \ | 18 | git config --global url."$GIT_REWRITE_BASE".insteadOf https://git.bnema.dev/; \ | ||
M README.md +1 -1
| @@ -187,7 +187,7 @@ docker run -d -p 127.0.0.1:7341:7341 -v ermite-data:/data \ | |||
| 187 | 187 | -e ERMITE_PUBLIC_URL=http://localhost:7341 -e ERMITE_ADMIN_TOKEN="$token" ermite | |
| 188 | 188 | ``` | |
| 189 | 189 | ||
| 190 | - | The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules. | |
| 190 | + | The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the public `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules. | |
| 191 | 191 | ||
| 192 | 192 | ## Develop with compose | |
| 193 | 193 | ||
| @@ -187,7 +187,7 @@ docker run -d -p 127.0.0.1:7341:7341 -v ermite-data:/data \ | |||||
| 187 | -e ERMITE_PUBLIC_URL=http://localhost:7341 -e ERMITE_ADMIN_TOKEN="$token" ermite | 187 | -e ERMITE_PUBLIC_URL=http://localhost:7341 -e ERMITE_ADMIN_TOKEN="$token" ermite | ||
| 188 | ``` | 188 | ``` | ||
| 189 | 189 | ||||
| 190 | - | The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules. | 190 | + | The image is alpine with git, runs as uid 10001 and keeps its data in the `/data` volume. Logs are JSON by default. The build fetches the public `bnema.dev/ermite-*` modules through their `bnema.dev` vanity paths. Behind a private route, `--build-arg GIT_REWRITE_BASE=<url>` rewrites the git host used for those modules. |
| 191 | 191 | ||||
| 192 | ## Develop with compose | 192 | ## Develop with compose | ||
| 193 | 193 | ||||
M compose.yaml +2 -3
| @@ -1,6 +1,6 @@ | |||
| 1 | 1 | # Development server with hot reload: `docker compose up`, then http://localhost:7341. | |
| 2 | - | # The module is built on its own (no go.work), like CI. Private modules bnema.dev/ermite-* | |
| 3 | - | # resolve through the bnema.dev vanity path, using the host's DNS and routes. | |
| 2 | + | # The module is built on its own (no go.work), like CI. The modules bnema.dev/ermite-* are public | |
| 3 | + | # and resolve through the bnema.dev vanity path. | |
| 4 | 4 | services: | |
| 5 | 5 | ermite: | |
| 6 | 6 | build: | |
| @@ -15,7 +15,6 @@ services: | |||
| 15 | 15 | CGO_ENABLED: "0" | |
| 16 | 16 | GOWORK: "off" | |
| 17 | 17 | GOTOOLCHAIN: local | |
| 18 | - | GOPRIVATE: bnema.dev/ermite* | |
| 19 | 18 | # The mounted .git of a worktree points outside the container. | |
| 20 | 19 | GOFLAGS: -buildvcs=false | |
| 21 | 20 | ERMITE_DATA_DIR: /data | |
| @@ -1,6 +1,6 @@ | |||||
| 1 | # Development server with hot reload: `docker compose up`, then http://localhost:7341. | 1 | # Development server with hot reload: `docker compose up`, then http://localhost:7341. | ||
| 2 | - | # The module is built on its own (no go.work), like CI. Private modules bnema.dev/ermite-* | 2 | + | # The module is built on its own (no go.work), like CI. The modules bnema.dev/ermite-* are public |
| 3 | - | # resolve through the bnema.dev vanity path, using the host's DNS and routes. | 3 | + | # and resolve through the bnema.dev vanity path. |
| 4 | services: | 4 | services: | ||
| 5 | ermite: | 5 | ermite: | ||
| 6 | build: | 6 | build: | ||
| @@ -15,7 +15,6 @@ services: | |||||
| 15 | CGO_ENABLED: "0" | 15 | CGO_ENABLED: "0" | ||
| 16 | GOWORK: "off" | 16 | GOWORK: "off" | ||
| 17 | GOTOOLCHAIN: local | 17 | GOTOOLCHAIN: local | ||
| 18 | - | GOPRIVATE: bnema.dev/ermite* | |||
| 19 | # The mounted .git of a worktree points outside the container. | 18 | # The mounted .git of a worktree points outside the container. | ||
| 20 | GOFLAGS: -buildvcs=false | 19 | GOFLAGS: -buildvcs=false | ||
| 21 | ERMITE_DATA_DIR: /data | 20 | ERMITE_DATA_DIR: /data | ||
M go.mod +1 -1
| @@ -15,7 +15,7 @@ require ( | |||
| 15 | 15 | bnema.dev/ermite-actions v0.2.0 | |
| 16 | 16 | bnema.dev/ermite-api v0.5.0 | |
| 17 | 17 | bnema.dev/ermite-git v0.1.0 | |
| 18 | - | bnema.dev/ermite-kv v0.0.0-20261010031554-5e09b48f81c3 | |
| 18 | + | bnema.dev/ermite-kv v0.1.0 | |
| 19 | 19 | connectrpc.com/connect v1.21.0 | |
| 20 | 20 | github.com/a-h/templ v0.3.1020 | |
| 21 | 21 | github.com/alecthomas/chroma/v2 v2.27.0 | |
| @@ -15,7 +15,7 @@ require ( | |||||
| 15 | bnema.dev/ermite-actions v0.2.0 | 15 | bnema.dev/ermite-actions v0.2.0 | ||
| 16 | bnema.dev/ermite-api v0.5.0 | 16 | bnema.dev/ermite-api v0.5.0 | ||
| 17 | bnema.dev/ermite-git v0.1.0 | 17 | bnema.dev/ermite-git v0.1.0 | ||
| 18 | - | bnema.dev/ermite-kv v0.0.0-20261010031554-5e09b48f81c3 | 18 | + | bnema.dev/ermite-kv v0.1.0 |
| 19 | connectrpc.com/connect v1.21.0 | 19 | connectrpc.com/connect v1.21.0 | ||
| 20 | github.com/a-h/templ v0.3.1020 | 20 | github.com/a-h/templ v0.3.1020 | ||
| 21 | github.com/alecthomas/chroma/v2 v2.27.0 | 21 | github.com/alecthomas/chroma/v2 v2.27.0 | ||