quine-global/site-image.git

# site-image

A Forgejo action for our Docker-based sites (hyper.quineglobal.com and the
others petersweb-infra runs): on every push to a site's `main`,

1. build its image and push it to the forge's registry, tagged with the
   commit;
2. open a PR on `Cold-Air-Networks/petersweb-infra` that replaces the
   image's pinned `@sha256:` digest with the new one.

Merging the PR deploys it. (The sites run on the forge VM, so after merging,
`./tart/apply.sh` on the Mac mini; see petersweb-infra's docs.)

## Using it

In the site's repo, `.forgejo/workflows/deploy.yml`:

```yaml
name: deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  image:
    runs-on: runner-x86-linux
    steps:
      - uses: actions/checkout@v4
      - uses: https://forge.in.quineglobal.com/quine-global/site-image@v1
        with:
          image: forge.in.quineglobal.com/ironmagma/hyper-quineglobal-com
          infra-file: nixos/linux.nix
          name: hyper
          registry-username: ${{ secrets.REGISTRY_USERNAME }}
          registry-password: ${{ secrets.REGISTRY_PASSWORD }}
          infra-token: ${{ secrets.INFRA_TOKEN }}
```

- `image`: exactly as petersweb-infra pins it, without tag or digest.
- `infra-file`: the petersweb-infra file with `<image>@sha256:<digest>`
  (`nixos/linux.nix`, or e.g. `nixos/arion-riverside/arion-compose.nix`).
- Optional: `server` (default https://forge.in.quineglobal.com; not the
  runner-reported address, which can be localhost), `name` (branch and PR
  title; default the image's last path
  part), `context` (default `.`), `containerfile`, `platform` (default
  `linux/amd64`), `infra-repo`.

The secrets are organization-level (quine-global, Cold-Air-Networks):

| Secret | |
|---|---|
| `REGISTRY_USERNAME` | The account that owns the token |
| `REGISTRY_PASSWORD` | Its token, with package write (pushes the image) |
| `INFRA_TOKEN` | A token with repository write on petersweb-infra (pushes the branch, opens the PR) |

If petersweb-infra already pins the digest (a rebuild of the same
commit), no PR is opened.

Only the latest build's PR stays open: opening one (or finding main already
pins the digest) closes the image's other open `bump-<name>-<sha>` PRs, with
a comment pointing at what superseded them, and deletes their branches. So
an older bump can't be merged after a newer one.

## Versions

Sites use `@v1`, a tag moved forward for compatible changes; breaking ones
get `v2`.