4 Commits

Author	SHA1	Message	Date
brent.edwards	1932bed2a8	fix(forgejo): remove harbor.cleverthis.com from docker:dind ... Fixes: #10861	2026-05-04 23:41:51 +00:00
CoreRasurae	9c5f19854d	ci(docker): Ensure CI uses CT docker proxy to workaround Docker ratelimit issues ... ISSUES CLOSED: #10856	2026-04-24 21:58:51 +01:00
freemo	33f1978bd0	fix(ci): resolve repository push failure in CI pipeline ... Root cause: actions/checkout@v4 was not configured with explicit write credentials (token + persist-credentials), and no git user identity (user.name/user.email) was set. Both are required for any git push operation in Forgejo Actions. Changes: - release.yml create-release job: add token: secrets.FORGEJO_TOKEN and fetch-depth: 0 to checkout; add 'Configure git identity for push operations' step using HTTPS credential store; add 'Smoke-test push access' step that validates write permission via Forgejo API before any push attempt - ci.yml: add push-validation job that validates push credentials on every CI run using FORGEJO_TOKEN, including credential helper verification and API-based write permission check; add push-validation to status-check needs and result reporting - docs/development/ci-cd.md: add FORGEJO_TOKEN, FORGEJO_URL, and CONTAINER_REGISTRY* secrets to the secrets table; add 'Repository Push Authentication' section documenting root cause, fix pattern, smoke-test step, setup instructions, and security notes; add push-validation to CI job dependency graph and quality gates table Design decisions: - HTTPS token authentication (not SSH deploy keys) -- simpler to manage - ~/.git-credentials with chmod 600 for ephemeral, secure storage - Smoke-test validates write permission via API before push attempts - push-validation job is independent (no needs) -- runs in parallel - No hardcoded credentials -- all secrets via Forgejo Secrets ISSUES CLOSED: #1541	2026-04-02 23:54:52 +00:00
brent.edwards	00897be24a	feat(ci): CI/CD pipeline definitions (#983) ... ## Summary Complete CI/CD pipeline definitions: release workflow, caching, status-check consolidation, and documentation. ### Changes **New: Release pipeline** (`.forgejo/workflows/release.yml`): - Triggered on `v*` tags - 3 jobs: `build-wheel` → `build-docker` → `create-release` - Builds wheel via `nox -s build`, Docker image via multi-stage Dockerfile - Creates Forgejo release via API with wheel artifact attached - Configurable registry push via `REGISTRY_*` secrets **Updated: CI pipeline** (`.forgejo/workflows/ci.yml`): - Added `actions/cache@v3` for `~/.cache/uv` on all 8 primary jobs (keyed on `pyproject.toml` hash) - Added `status-check` consolidation job depending on all required checks — single gate for branch protection **Updated: CONTRIBUTING.md**: - New CI/CD section: pipeline overview, job table, required merge checks, release process, secrets documentation **Tests**: - 13 new Behave scenarios validating workflow YAML structure, tag triggers, job definitions, dependencies - 9 new Robot tests validating file existence, content, nox session references ### Quality Gates | Session | Result | |---|---| | `nox -s lint` | PASS | | `nox -s typecheck` | PASS (0 errors) | | `nox -s unit_tests` | PASS (10,819 scenarios) | | `nox -s coverage_report` | 97.9% (>= 97%) | Closes #858 Reviewed-on: #983 Co-authored-by: Brent E. Edwards <brent.edwards@cleverthis.com> Co-committed-by: Brent E. Edwards <brent.edwards@cleverthis.com>	2026-03-21 00:29:49 +00:00