.github/workflows/deploy.yml

@@ -1,53 +1,25 @@
-name: Build & Publish
+name: Deploy
-# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/moby/brewlog).
-# On every push to `dev` this checks the code, then builds the container and
-# publishes it to this forge's own container registry. The moby homelab
-# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
-# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
-# Fly.io deploy step was removed).
 on:
   push:
-    branches: ["dev"]
+    branches: ["main"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-# The registry push uses a PAT with `write:package` scope, supplied via the
-# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
-# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
-# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
-# Kaniko git-context clone (over the auto token) working; `packages: write` is
-# belt-and-suspenders on the auto token.
-permissions:
-  contents: read
-  packages: write
-
-env:
-  # This forge's built-in container registry, same host as the git server.
-  REGISTRY: git.ziemlichoptimal.de
-  IMAGE: git.ziemlichoptimal.de/moby/brewlog
-
 jobs:
   check:
     name: Check
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      # The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
+      - name: Install mise
-      # flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
+        uses: jdx/mise-action@v4
-      # API — which 401s on this runner (it has no github.com token), failing the
-      # entire install. CI only needs the pinned Rust toolchain, so install it
-      # directly via mise (rust resolves through rustup, no GitHub API).
-      - name: Install Rust toolchain
-        uses: https://github.com/jdx/mise-action@v2
-        with:
-          install_args: rust
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -59,10 +31,11 @@ jobs:
             cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
             cargo-${{ runner.os }}-
 
-      # No sudo on the node:20-bookworm runner image (job runs as root). mold is
-      # required by .cargo/config.toml's linker flag (-fuse-ld=mold).
       - name: Install system dependencies
-        run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
+        run: sudo apt-get update && sudo apt-get install -y clang lld mold libssl-dev pkg-config
+
+      - name: Ensure Rust components
+        run: rustup component add rustfmt clippy
 
       - name: Check formatting
         run: cargo fmt -- --check
@@ -73,46 +46,44 @@ jobs:
       - name: Run tests
         run: cargo test -- --show-output
 
-  build:
+  deploy:
-    name: Build & Publish
+    name: Deploy
     runs-on: ubuntu-latest
     needs: [check]
-    # Build the image DAEMONLESS with Kaniko — no Docker, no buildx, no
-    # privileged DinD. The job runs *inside* the Kaniko executor image, which
-    # builds the Dockerfile and pushes straight to the forge registry.
-    container:
-      image: gcr.io/kaniko-project/executor:v1.24.0-debug
-    defaults:
-      run:
-        # The kaniko -debug image is busybox-only (no bash).
-        shell: sh
     steps:
-      - name: Build and push (Kaniko)
+      - name: Checkout
-        env:
+        uses: actions/checkout@v6
-          # Registry push uses a PAT with write:package scope (Forgejo's auto
+
-          # GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
+      - name: Install mise
-          FORGE_USER: ${{ secrets.REGISTRY_USER }}
+        uses: jdx/mise-action@v4
-          FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+
-          # Kaniko clones the `--context` git URL over the auto token (read).
+      - name: Set up Docker Buildx
-          GIT_USERNAME: ${{ github.actor }}
+        uses: docker/setup-buildx-action@v4
-          GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version from Cargo.toml
+        id: version
+        run: echo "version=$(grep '^version = ' Cargo.toml | head -1 | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push container
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/jnsgruk/brewlog:${{ github.sha }}
+            ghcr.io/jnsgruk/brewlog:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Deploy to Fly.io
         run: |
-          set -eu
+          flyctl deploy -i "ghcr.io/jnsgruk/brewlog:${{ github.sha }}"
-          # Registry auth for the push (docker config.json format).
+        env:
-          AUTH=$(printf '%s:%s' "$FORGE_USER" "$FORGE_TOKEN" | base64 | tr -d '\n')
+          FLY_ACCESS_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-          mkdir -p /kaniko/.docker
-          printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
-          # Kaniko clones the context itself (this job has no node for JS actions
-          # like checkout). `dev` is the moving branch tag; the commit SHA is the
-          # immutable ref the moby Deployment pins by digest.
-          # The runtime stage is `FROM scratch` + `COPY /rootfs /`, so Kaniko
-          # rebuilds the container root. The act runner bind-mounts /var/run/act
-          # into the job container; Kaniko can't unlink that busy mount while
-          # laying down the rootfs (unlinkat ... device or resource busy), so
-          # ignore it. It is a runner artifact and must not be in the image.
-          /kaniko/executor \
-            --context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
-            --dockerfile Dockerfile \
-            --ignore-path=/var/run/act \
-            --destination "${IMAGE}:${GITHUB_SHA}" \
-            --destination "${IMAGE}:dev"

.github/workflows/push.yml

@@ -1,7 +1,7 @@
 name: CI
 on:
   pull_request:
-    branches: ["dev"]
+    branches: ["main"]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -13,13 +13,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install mise
-        uses: https://github.com/jdx/mise-action@v2
+        uses: jdx/mise-action@v4
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/
@@ -51,13 +51,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install mise
-        uses: https://github.com/jdx/mise-action@v2
+        uses: jdx/mise-action@v4
 
       - name: Cache Cargo artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry/index/

Dockerfile

@@ -30,10 +30,9 @@ RUN mkdir -p /usr/local/bin \
 WORKDIR /app
 COPY . .
 
-# NB: no `RUN --mount=type=cache` here on purpose. The CI image builder is
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
-# Kaniko (daemonless, no Docker/BuildKit), which does not support BuildKit cache
+    --mount=type=cache,target=/app/target \
-# mounts — it errors on them. Keep this RUN plain. See README "CI / build".
+    cargo build --release --locked \
-RUN cargo build --release --locked \
     && mkdir -p /out \
     && cp target/release/brewlog /out/brewlog
 
@@ -62,14 +61,6 @@ RUN useradd --root /rootfs -u 1000 -U -M -s /bin/false brewlog \
     && mkdir -p /rootfs/home/brewlog /rootfs/data \
     && chown 1000:1000 /rootfs/home/brewlog /rootfs/data
 
-# chisel's base-files ships /var/run as a symlink to /run. When the CI builder
-# (Kaniko) lays this rootfs onto `/` for the scratch stage, replacing that
-# symlink forces a RemoveAll of the destination /var/run — which on the Forgejo
-# act runner is a directory holding a busy /var/run/act bind-mount, so the copy
-# fails with "unlinkat /var/run/act: device or resource busy". The runtime image
-# does not need /var/run, so drop the symlink to avoid the collision.
-RUN rm -rf /rootfs/var/run
-
 # ---------------------------------------------------------------------------
 # Runtime — scratch with chisel rootfs
 # ---------------------------------------------------------------------------

README.md

@@ -165,37 +165,6 @@ cargo build               # Build
 
 See [CLAUDE.md](CLAUDE.md) for architecture, code patterns, and development conventions.
 
-## CI / build pipeline (this fork)
-
-This fork lives on the **zo** Forgejo forge
-(`git.ziemlichoptimal.de/uberbau/brewlog`, default branch **`dev`**) and is
-deployed to the **moby** homelab via Flux GitOps. `.github/workflows/deploy.yml`
-runs on every push to `dev`: it lints/tests (`check`), then builds and publishes
-the container image to the forge's own registry as
-`git.ziemlichoptimal.de/uberbau/brewlog:{dev,<sha>}`. The moby deployment pins
-that image by digest and bumps it per release.
-
-The build is **daemonless — it does not use Docker**. It runs
-[Kaniko](https://github.com/GoogleContainerTools/kaniko) as the job container,
-building the `Dockerfile` (context pulled straight from git) and pushing to the
-registry. No `docker`, no buildx, no privileged Docker-in-Docker.
-
-### Gotchas (learned the hard way)
-
-- **Kaniko does not support BuildKit `RUN --mount=type=cache`.** The build fails
-  on it. Keep every `RUN` in the `Dockerfile` plain — no BuildKit cache mounts.
-  (This is why the Rust build layer is a plain `cargo build`; we have been bitten
-  by this before, so do not "re-add caching" to the Dockerfile.)
-- **The forge's Actions runner is node20-only.** Pin JS actions to their node20
-  generation (`actions/checkout@v4`, `actions/cache@v4`, and if you reintroduce
-  docker actions, `@v3`/`@v6`) — the newer `@v5/@v6/@v7` releases declare
-  `runs.using: node24`, which the runner rejects (`must be one of [… node20 …]`).
-- **Reference actions by full `github.com` URL**
-  (`uses: https://github.com/owner/repo@ref`). The runner's default action
-  mirror (`code.forgejo.org`) is incomplete/flaky and aborts clones mid-run.
-- The `check` job installs only Rust via mise (`install_args: rust`); the full
-  `mise.toml` toolchain pulls tools from the GitHub API, which 401s on the runner.
-
 ## License
 
 [Apache License 2.0](LICENSE)