cert-portal/docs/gitea.md

Gitea Actions and Container Registry

The workflow in .gitea/workflows/container.yml runs tests, builds the Docker image, and publishes it to this Gitea instance’s OCI registry.

What it publishes

On main, version tags (v*), and manual Run workflow:

git.atlashorizon.net/nick/cert-portal:latest   # default branch only
git.atlashorizon.net/nick/cert-portal:main
git.atlashorizon.net/nick/cert-portal:sha-<short-sha>
git.atlashorizon.net/nick/cert-portal:v1.2.3   # git tags named v*

The host is taken from the Actions server URL (or vars.REGISTRY if you set one). The image name is {registry}/{owner}/{repo} in lowercase, which is what Gitea’s container registry requires.

Pull requests build the image but do not push.

One-time Gitea setup

1. Enable Actions on the repository (Settings → Actions).
2. Enable Packages for the owner (user or org) if it is not already on.
3. Register an act_runner that can build images: Docker socket or privileged dind. A label matching runs-on: ubuntu-latest (Gitea’s default runner label) is enough.
4. If actions/checkout@v4 and the Docker actions cannot be fetched, either set Gitea [actions].DEFAULT_ACTIONS_URL = github or mirror those actions onto this instance and change the uses: lines.

Registry login from the job

The workflow logs in as the user who triggered the job (github.actor) with secrets.GITEA_TOKEN (the job token). Give that token package write if your instance uses restricted token permissions (Settings → Actions → General, and permissions: packages: write in the workflow).

If login returns 401, the job token cannot write packages on this Gitea version. Create a PAT with package read/write (and 2FA/OAuth accounts must use a token, not a password) and add repository secrets:

Secret	Purpose
REGISTRY_TOKEN	PAT used instead of GITEA_TOKEN
REGISTRY_USERNAME	Optional; defaults to the triggering user

Optional instance setting:

Variable	Purpose
REGISTRY	Registry host if it is not the Gitea web hostname

After the first successful push, open Packages on the user/org (or the repo if Gitea linked the package). Pull:

docker login git.atlashorizon.net
docker pull git.atlashorizon.net/nick/cert-portal:latest

Run it the same way as a local build; see setup.md.

Manual run

Actions → Container → Run workflow. That tags the image manual in addition to the SHA tag.