nns/food-market
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

ci(forgejo/docker): drop ghcr push — Forgejo GITHUB_TOKEN can't auth to ghcr.io
Some checks are pending
CI / POS (WPF, Windows) (push) Waiting to run
Details
CI / Backend (.NET 8) (push) Successful in 24s
Details
CI / Web (React + Vite) (push) Successful in 23s
Details
Docker Images / API image (push) Successful in 6s
Details
Docker Images / Web image (push) Successful in 27s
Details

Browse source 
Forgejo Actions synthesizes a GITHUB_TOKEN for the Forgejo API, not
github.com. Using it to docker-login to ghcr.io always fails (401).
Forgejo side is the new primary — push to the local registry only.
ghcr.io mirroring, if ever wanted, will go through a separate job with
an explicit GitHub PAT in GHCR_TOKEN secret.
This commit is contained in:
nurdotnet 2026-04-23 16:45:28 +05:00
parent e408647b4b
commit 82d74bd8fe
1 changed files with 5 additions and 65 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

70
.forgejo/workflows/docker.yml
View file

@ -11,13 +11,9 @@ on:
- 'src/food-market.infrastructure/**'
- 'src/food-market.shared/**'
- 'deploy/**'
- '.github/workflows/docker.yml'
- '.forgejo/workflows/docker.yml'
workflow_dispatch:
permissions:
contents: read
packages: write
env:
LOCAL_REGISTRY: 127.0.0.1:5001
@ -28,44 +24,15 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Login to ghcr
env:
TOKEN: ${{ secrets.GITHUB_TOKEN }}
ACTOR: ${{ github.actor }}
run: |
for i in 1 2 3 4 5; do
if echo "$TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin; then
exit 0
fi
echo "login attempt $i failed, retrying in 15s"
sleep 15
done
exit 1
- name: Build + push api
env:
OWNER: ${{ github.repository_owner }}
SHA: ${{ github.sha }}
run: |
docker build -f deploy/Dockerfile.api \
-t $LOCAL_REGISTRY/food-market-api:$SHA \
-t $LOCAL_REGISTRY/food-market-api:latest \
-t ghcr.io/$OWNER/food-market-api:$SHA \
-t ghcr.io/$OWNER/food-market-api:latest .
# Push to LOCAL registry first (deploy depends on it) — it's on localhost, reliable.
-t $LOCAL_REGISTRY/food-market-api:latest .
for tag in $SHA latest; do
docker push $LOCAL_REGISTRY/food-market-api:$tag || { echo "local push $tag failed"; exit 1; }
done
# Push to ghcr.io as off-site backup. Flaky on KZ network — retry, but don't fail the job.
for tag in $SHA latest; do
for i in 1 2 3 4 5; do
if docker push ghcr.io/$OWNER/food-market-api:$tag; then break; fi
echo "ghcr push $tag attempt $i failed, retrying in 15s"
sleep 15
[ $i -eq 5 ] && echo "::warning::ghcr push $tag failed after 5 attempts — local registry still has the image"
done
docker push $LOCAL_REGISTRY/food-market-api:$tag
done
web:
@ -74,40 +41,13 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Login to ghcr
env:
TOKEN: ${{ secrets.GITHUB_TOKEN }}
ACTOR: ${{ github.actor }}
run: |
for i in 1 2 3 4 5; do
if echo "$TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin; then
exit 0
fi
echo "login attempt $i failed, retrying in 15s"
sleep 15
done
exit 1
- name: Build + push web
env:
OWNER: ${{ github.repository_owner }}
SHA: ${{ github.sha }}
run: |
docker build -f deploy/Dockerfile.web \
-t $LOCAL_REGISTRY/food-market-web:$SHA \
-t $LOCAL_REGISTRY/food-market-web:latest \
-t ghcr.io/$OWNER/food-market-web:$SHA \
-t ghcr.io/$OWNER/food-market-web:latest .
-t $LOCAL_REGISTRY/food-market-web:latest .
for tag in $SHA latest; do
docker push $LOCAL_REGISTRY/food-market-web:$tag || { echo "local push $tag failed"; exit 1; }
done
for tag in $SHA latest; do
for i in 1 2 3 4 5; do
if docker push ghcr.io/$OWNER/food-market-web:$tag; then break; fi
echo "ghcr push $tag attempt $i failed, retrying in 15s"
sleep 15
[ $i -eq 5 ] && echo "::warning::ghcr push $tag failed after 5 attempts — local registry still has the image"
done
docker push $LOCAL_REGISTRY/food-market-web:$tag
done