sunders/.forgejo
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Stefan Bethke 40a92ef6c8
All checks were successful
Build (and tag) Images / Build data_handler Image (push) Successful in 38s
Build (and tag) Images / Build web Image (push) Successful in 54s
fix: Builds images with kaniko on the docker runner
There are no Windows runners, so the workflow never ran. Builds now follow
the kaniko setup used in CCCHH/oci-images:

- kaniko in a container on the `docker` runner, one matrix job per image
- authenticates as forgejo-actions with the PACKAGES_TOKEN secret
- adds OCI annotations (ref.name, revision, url, source)

Publishing is limited to pushes to refs/heads/main, which push `latest`
and an immutable `sha-<commit>` tag. All other refs build with
KANIKO_NO_PUSH and do not receive the token. Tags are no longer derived
from ref names, so a branch named `latest` or a tag named `main` can no
longer overwrite the production image.

The docker compose smoke test is dropped, as there is no Docker daemon
inside the kaniko container.
2026-11-15 11:55:04 +01:00
..
workflows fix: Builds images with kaniko on the docker runner 2026-11-15 11:55:04 +01:00