site-image

A Forgejo action for our Docker-based sites (hyper.quineglobal.com and the others petersweb-infra runs): on every push to a site's main,

1. build its image and push it to the forge's registry, tagged with the commit;
2. open a PR on Cold-Air-Networks/petersweb-infra that replaces the image's pinned @sha256: digest with the new one.

Merging the PR deploys it. (The sites run on the forge VM, so after merging, ./tart/apply.sh on the Mac mini; see petersweb-infra's docs.)

Using it

In the site's repo, .forgejo/workflows/deploy.yml:

name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  image:
    runs-on: runner-x86-linux
    steps:
      - uses: actions/checkout@v4
      - uses: https://forge.in.quineglobal.com/quine-global/site-image@v1
        with:
          image: forge.in.quineglobal.com/ironmagma/hyper-quineglobal-com
          infra-file: nixos/linux.nix
          name: hyper
          registry-username: ${{ secrets.REGISTRY_USERNAME }}
          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
          infra-token: ${{ secrets.INFRA_TOKEN }}

• image: exactly as petersweb-infra pins it, without tag or digest.
• infra-file: the petersweb-infra file with <image>@sha256:<digest> (nixos/linux.nix, or e.g. nixos/arion-riverside/arion-compose.nix).
• Optional: server (default https://forge.in.quineglobal.com; not the runner-reported address, which can be localhost), name (branch and PR title; default the image's last path part), context (default .), containerfile, platform (default linux/amd64), infra-repo.

The secrets are organization-level (quine-global, Cold-Air-Networks):

If petersweb-infra already pins the digest (a rebuild of the same commit), no PR is opened.

Versions

Sites use @v1, a tag moved forward for compatible changes; breaking ones get v2.