Worph
c961d74e0e
Short names: the public repositories of one Gitea organisation (IPCR_ROOT_ORG, then the admin page; metadec on our boxes) are also published at the root of the forge's name, so ipcr.localhost:4767/ipns/metadec.eth/ipcr-hello:1.0.0 works. Collisions (a user/org of that name, another owner's folder) are skipped and explained. Push credentials: the staging registry now sits behind forge-gate (ipcr-forge-bridge gate), in the CI daemon's network namespace, with the registry on a unix socket and no network. Each publishing repository logs in as <owner>/<repo> with an IPCR_PUSH_TOKEN Actions secret the bridge sets, and may push its own name only; IPCR logs in with a credential it generates. Workflows need a docker/login-action step (example and page updated). ipcr 1.4.0: allow.aliases with per-pass alias sync; unpublish/retag on every path; IMPORT_AUTH_GENERATE; names this node publishes resolve via name/resolve --nocache (Kubo's resolve cache lagged, and the generic resolve ignores nocache). bridge 0.3.0: gate, push credentials (rotate in the admin page), root organisation setting, setup creates the org and the example in it; the Radicle description carries the Gitea path (identical documents gave the same RID); OAuth2 app updated only when hosts change, keeping the new secret. Admin page: tabs, one-line keys, name-check feedback, per-tag docker pull commands (IPFS, IPNS, ENS, short path first). Verified on holyhorse (docs/forge.md).
40 lines
1.4 KiB
YAML
40 lines
1.4 KiB
YAML
# Builds the Dockerfile at the root for every v* tag and pushes it to this forge's staging registry.
|
|
# IPCR picks it up from there within a minute and publishes it on IPFS; the forge's page then
|
|
# lists the exact `image:` line to use.
|
|
#
|
|
# Differences from a GitHub-hosted workflow, all needed on this forge:
|
|
# login to localhost:5000 the staging registry, as this repository: IPCR_PUSH_TOKEN is a secret
|
|
# the forge sets on every repository allowed to publish
|
|
# images: localhost:5000/… this repository's own name there (no other is accepted)
|
|
# network=host so buildx's builder can reach that registry
|
|
name: image
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: localhost:5000
|
|
username: ${{ github.repository }}
|
|
password: ${{ secrets.IPCR_PUSH_TOKEN }}
|
|
- uses: docker/metadata-action@v5
|
|
id: meta
|
|
with:
|
|
images: localhost:5000/${{ github.repository }}
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=raw,value=latest
|
|
- uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver-opts: network=host
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|