Build the image and deploy previews and production from Forgejo #495

New issue

Closed

opened 2026-10-21 10:06:57 +00:00 by root · 9 comments

root commented

2026-10-21 10:06:57 +00:00

(Migrated from gitlab.core-project.space)

Parent

#489

What to build

Production and previews deploy from Forgejo, as ADR 0049 says. On a same-repository pull request, the image is built once and pushed to the Forgejo registry with today's tags, and a noindex preview comes up at pr-<n>.chess.core-project.space. Closing the pull request tears the preview down, and the nightly reap removes any preview whose pull request is no longer open. On main, production deploys once the gate passes, reusing the image already built for the same tree. Docker in the job drives the production VPS over SSH, logged in with the bot's registry token inside the job only. The SSH key and the registry token are referenced only by the jobs that use them.

Seam: a Forgejo Actions run, and the existing deploy verifications (spec ## Seams).

Acceptance criteria

A pull request gets its preview, checked by the existing verify scripts, and loses it on close.
A push to main deploys production after the gate, reusing the tree's image when it exists.
The nightly reap keeps exactly the previews of open pull requests.
A fork pull request never deploys and gets no secret.
The production VPS stores no registry credential.
Deploys never overlap: the runner takes one job at a time.
ADR 0049 is followed.

## Parent #489 ## What to build Production and previews deploy from Forgejo, as ADR 0049 says. On a same-repository pull request, the image is built once and pushed to the Forgejo registry with today's tags, and a `noindex` preview comes up at `pr-<n>.chess.core-project.space`. Closing the pull request tears the preview down, and the nightly reap removes any preview whose pull request is no longer open. On `main`, production deploys once the gate passes, reusing the image already built for the same tree. Docker in the job drives the production VPS over SSH, logged in with the bot's registry token inside the job only. The SSH key and the registry token are referenced only by the jobs that use them. Seam: a Forgejo Actions run, and the existing deploy verifications (spec `## Seams`). ## Acceptance criteria - [ ] A pull request gets its preview, checked by the existing verify scripts, and loses it on close. - [ ] A push to `main` deploys production after the gate, reusing the tree's image when it exists. - [ ] The nightly reap keeps exactly the previews of open pull requests. - [ ] A fork pull request never deploys and gets no secret. - [ ] The production VPS stores no registry credential. - [ ] Deploys never overlap: the runner takes one job at a time. - [ ] ADR 0049 is followed.

root commented

2026-10-21 10:07:10 +00:00

(Migrated from gitlab.core-project.space)

mentioned in issue #497