Forgejo's auto GITHUB_TOKEN lacks package-write on the moby org, so the
Kaniko push 401s (reqPackageAccess). Use the write:package PAT secrets
for the registry auth (matching moby/uberbau_xyz and moby/claude-code);
the git-context clone stays on the auto token.
Kaniko's up-front push-permission check 401'd (reqPackageAccess): the Forgejo
auto GITHUB_TOKEN has no package-write scope by default. Declare
`permissions: {contents: read, packages: write}` so the token can push to the
forge container registry (git clone still needs contents:read).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the docker buildx / build-push-action build job with Kaniko running as
the job container: it builds the Dockerfile from the git context and pushes to
the forge registry, with no Docker daemon, no buildx, and no privileged DinD.
Kaniko cannot handle BuildKit `RUN --mount=type=cache`, so drop the two cache
mounts on the cargo build layer (plain `cargo build` now). Document the pipeline
and this gotcha (plus the node20-only runner and full-github-URL action rules) in
the README so it isn't reintroduced.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The build job aborted during action preparation while cloning the docker/*
actions from code.forgejo.org (the checkout clone already warned "some refs
were not updated"). The check job proved that full github.com `uses:` URLs
clone reliably on this runner (mise-action@v2 worked), so pull checkout and the
docker actions from github.com directly. All are node20, which the runner
supports.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The check job failed inside mise: mise.toml pulls the full dev toolchain
(tailwind, cargo-watch, flyctl, shellcheck, mvdan/sh, ...) and resolves most of
it via api.github.com, which 401s on the runner (no github.com token) ->
"Failed to install tools" -> exit 1.
CI only needs Rust for fmt/clippy/test, so restrict mise to `install_args: rust`
(rust resolves through rustup, no GitHub API). Also drop `sudo` (the runner
image runs as root and has none) and the redundant `rustup component add`
(mise installs rustfmt/clippy from mise.toml). Keep mold — the .cargo linker
flag requires it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The forge's forgejo-runner (v6.3.1) only supports node runtimes up to node20,
but resolves bare `uses:` from code.forgejo.org where checkout@v6 (and the
other @v5/v6/v7 actions) declare `runs.using: node24` -> "must be one of
[... node20 ...], got node24" -> job failed before any step ran.
- checkout@v6->v4, cache@v5->v4, docker/{setup-buildx@v4->v3, login@v4->v3,
build-push@v7->v6}: all node20.
- jdx/mise-action isn't mirrored on code.forgejo.org; reference it by full
github URL, pinned to @v2 (node20).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The workflows were still the upstream GitHub ones and never ran here:
Deploy triggered on `main` (this fork's branch is `dev`), pushed to
`ghcr.io/jnsgruk/brewlog` (unreachable from this forge), and deployed to
jnsgruk's Fly.io.
- Deploy → build on push to `dev`, publish to this forge's own registry
(git.ziemlichoptimal.de/uberbau/brewlog:{sha,dev}) via the auto GITHUB_TOKEN.
- Drop the Fly.io deploy step and the dead version-extract step; the moby
homelab deploys the image via Flux GitOps, not from this pipeline.
- Retarget PR CI (push.yml) from `main` to `dev`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Deploy workflow on main failed because .cargo/config.toml requires
the mold linker, but deploy.yml only installed lld. The earlier fix
commit only updated push.yml, missing deploy.yml.
Add mold to system deps (needed by .cargo/config.toml linker setting)
and explicitly install rustfmt/clippy components since mise-action
doesn't always install Rust components.
Replace snap-installed Chromium/chromedriver with Chrome for Testing
installed via npx @puppeteer/browsers. Binaries live in
$MISE_DATA_DIR/chrome-for-testing/ with version-agnostic path lookup.
Add install-e2e mise task and required apt packages to README and CI.
Replace Nix flake with mise for toolchain management, treefmt for
formatting, prek for pre-commit hooks, and a Dockerfile for container
builds. Update CI workflows to use jdx/mise-action instead of Nix.
Add system dependency instructions to README.md and CLAUDE.md.
Merge separate lint and test jobs into a single check job so clippy's
compilation artifacts are reused by tests. Add actions/cache for the
Cargo target directory and registry to enable incremental builds across
runs. Drop unnecessary fetch-depth: 0 from CI jobs.
The container image is tagged with the package version from flake.nix,
not the git short hash. Read the version from Cargo.toml so the
docker tag command references the correct source image.
