There are no Windows runners, so the workflow never ran. Builds now follow
the kaniko setup used in CCCHH/oci-images:

- kaniko in a container on the `docker` runner, one matrix job per image
- authenticates as forgejo-actions with the PACKAGES_TOKEN secret
- adds OCI annotations (ref.name, revision, url, source)

Publishing is limited to pushes to refs/heads/main, which push `latest`
and an immutable `sha-<commit>` tag. All other refs build with
KANIKO_NO_PUSH and do not receive the token. Tags are no longer derived
from ref names, so a branch named `latest` or a tag named `main` can no
longer overwrite the production image.

The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.

fix: Uses repository registry credentials

Build (and tag) Images / Build data_handler Image (push) Successful in 39s

Details

Build (and tag) Images / Build web Image (push) Successful in 54s

Details

7d925d79a2

This repository has REGISTRY_USERNAME/REGISTRY_TOKEN configured, not PACKAGES_TOKEN. Both are still only passed to kaniko when publishing from main.

stb added 1 commit

2026-11-15 13:22:32 +01:00

chore: Re-adds Docker Compose test as disabled job

Build (and tag) Images / Build data_handler Image (push) Successful in 39s

Details

Build (and tag) Images / Build web Image (push) Successful in 55s

Details

3a9dc311e4

The compose smoke test needs a Docker daemon, which jobs on the current docker runner do not have. It is kept commented out so it can be re-enabled once such a runner exists.

stb merged commit c90405d9ab into main

2026-11-15 13:28:02 +01:00

stb deleted branch kaniko-build

2026-11-15 13:28:02 +01:00

stb referenced this pull request from a commit

2026-11-15 13:28:03 +01:00

Merge pull request 'Use kaniko to build image' (#39) from kaniko-build into main