56 lines
2.6 KiB
Markdown
56 lines
2.6 KiB
Markdown
# Gitea Actions and Container Registry
|
||
|
||
The workflow in [`.gitea/workflows/container.yml`](../.gitea/workflows/container.yml) runs tests, builds the Docker image, and publishes it to this Gitea instance’s OCI registry.
|
||
|
||
## What it publishes
|
||
|
||
On `main`, version tags (`v*`), and manual **Run workflow**:
|
||
|
||
```
|
||
git.atlashorizon.net/nick/cert-portal:latest # default branch only
|
||
git.atlashorizon.net/nick/cert-portal:main
|
||
git.atlashorizon.net/nick/cert-portal:sha-<short-sha>
|
||
git.atlashorizon.net/nick/cert-portal:v1.2.3 # git tags named v*
|
||
```
|
||
|
||
The host is taken from the Actions server URL (or `vars.REGISTRY` if you set one). The image name is `{registry}/{owner}/{repo}` in lowercase, which is what [Gitea’s container registry](https://docs.gitea.com/usage/packages/container) requires.
|
||
|
||
Pull requests **build** the image but do **not** push.
|
||
|
||
## One-time Gitea setup
|
||
|
||
1. Enable **Actions** on the repository (`Settings` → `Actions`).
|
||
2. Enable **Packages** for the owner (user or org) if it is not already on.
|
||
3. Register an **act_runner** that can build images: Docker socket or privileged `dind`. A label matching `runs-on: ubuntu-latest` (Gitea’s default runner label) is enough.
|
||
4. If `actions/checkout@v4` and the Docker actions cannot be fetched, either set Gitea `[actions].DEFAULT_ACTIONS_URL = github` or mirror those actions onto this instance and change the `uses:` lines.
|
||
|
||
### Registry login from the job
|
||
|
||
The workflow logs in as the user who triggered the job (`github.actor`) with `secrets.GITEA_TOKEN` (the job token). Give that token **package write** if your instance uses restricted token permissions (`Settings` → `Actions` → `General`, and `permissions: packages: write` in the workflow).
|
||
|
||
If login returns **401**, the job token cannot write packages on this Gitea version. Create a PAT with **package read/write** (and 2FA/OAuth accounts must use a token, not a password) and add repository secrets:
|
||
|
||
| Secret | Purpose |
|
||
| --- | --- |
|
||
| `REGISTRY_TOKEN` | PAT used instead of `GITEA_TOKEN` |
|
||
| `REGISTRY_USERNAME` | Optional; defaults to the triggering user |
|
||
|
||
Optional instance setting:
|
||
|
||
| Variable | Purpose |
|
||
| --- | --- |
|
||
| `REGISTRY` | Registry host if it is not the Gitea web hostname |
|
||
|
||
After the first successful push, open **Packages** on the user/org (or the repo if Gitea linked the package). Pull:
|
||
|
||
```bash
|
||
docker login git.atlashorizon.net
|
||
docker pull git.atlashorizon.net/nick/cert-portal:latest
|
||
```
|
||
|
||
Run it the same way as a local build; see [setup.md](setup.md).
|
||
|
||
## Manual run
|
||
|
||
**Actions** → **Container** → **Run workflow**. That tags the image `manual` in addition to the SHA tag.
|