From 9230b1213cefdb69673504950d302fc1d031f80a Mon Sep 17 00:00:00 2001 From: Jan Novak Date: Tue, 11 Aug 2026 19:46:55 +0200 Subject: [PATCH] Document Gitea CI and required secrets in README Co-Authored-By: Claude --- README.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/README.md b/README.md index 4ac1071..b00e9fd 100644 --- a/README.md +++ b/README.md @@ -167,6 +167,40 @@ cloud.google.com/go/compute v1.65.0. envtest uses the 1.36.2 binary bundle (the latest 1.36 patch with published binaries — do not "fix" the Makefile's derived version to 1.36.3, which has none). +## Gitea CI + +[.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) builds the +manager image and pushes it to this Gitea instance's container registry. +It runs on **any tag push** or manually via **Run workflow** (with a `tag` +input) — never on branch pushes. A lightweight `check` job (`go vet`, +`go build`, `go test -short`) gates the build. + +Every build pushes two tags to +`gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator`: + +- the human tag (the git tag, or the dispatch input), and +- an immutable `sha-<12-char-commit>` tag — pin deployments to this one. + +`:latest` is additionally updated on real tag pushes only, so a manual +dispatch of an old ref can never clobber it. The commit is baked into the +binary (`internal/version.Commit`) via the `GIT_COMMIT` build arg. + +### Mandatory Gitea secrets + +Set under **Settings → Actions → Secrets** in this repo: + +| Secret | Required by | What it is | +| ---------------- | ----------------------------- | ---------------------------------------- | +| `REGISTRY_TOKEN` | `build.yaml` (registry login) | Gitea PAT with the `write:package` scope | + +The token is paired with `${{ github.actor }}` as the username, so it +must belong to the user triggering the workflow — same convention as the +other projects on this instance. + +Without `REGISTRY_TOKEN` the `check` job still passes but the build job +fails at the `docker login` step. No other secrets are needed — the +workflow does not deploy anywhere. + ## Development ```sh