feat: CI registry build+push, Portainer web-editor deploy #12
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/registry-build-push"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Push-to-deploy via Forgejo container registry
Sidesteps the clone-on-NAS problem entirely. The CI builds and pushes the image to the built-in Forgejo registry on every push to main. Portainer pulls the pre-built image — no Dockerfile, no repo clone on the NAS.
What changed
New:
.github/workflows/docker-publish.yml— runs on push to main:deploy/Dockerfilegit.kagaku.eu/teamai/doujin-manager:latestand:{commit-sha}GITHUB_TOKENfor registry auth (auto-provided by Forgejo Actions,packages: writepermission)runs-on: docker(needs a runner with Docker daemon access)Rewritten:
deploy/docker-compose.yml— Portainer Web Editor ready:image: git.kagaku.eu/teamai/doujin-manager:latest(nobuild:line)DOUJIN_MANAGER_AUTH_TOKEN(user replaces in Portainer editor)doujinshi_images,doujinshi_thumbnails,doujinshi_backup)Rewritten:
deploy/DEPLOYMENT.md::latest)Deploy flow
No cloning on the NAS. No build context issues. Fully self-hosted.
Summary
Summary
Coverage
DoujinManager.ApplicationCore - 84.8%
DoujinManager.Infrastructure - 91.7%
pshot
DoujinManager.RestAdapter - 83.7%
E5CB12CEAC5BBBEA65844E1C05F9ADA4DA38B848075C41304FC6A1ABF77__ValidationAttr
ibuteCache
DoujinManager.Server - 18.4%
🤖 Hermes automated review: changes requested
Reviewed the diff for head
7eafbfd2(basef9ba64c3, 3 files, +91/-113). Static security scan on added lines: clean (no secrets, shell injection, eval/exec, or SQL injection). This is a deploy/CI-only change (no C# application code), so the existingci.ymlbuild+test coverage applies.Findings
[major]
.github/workflows/docker-publish.yml:33-34— image tag will be rejected by Docker (uppercase repository name).${{ github.repository }}for this repo isTeamAI/doujin-manager(uppercaseT,A,I). Docker image references forbid uppercase characters in the repository path, so the "Build and push" step produces a tag likegit.kagaku.eu/TeamAI/doujin-manager:latest, which buildx/distribution rejects withinvalid reference format/repository name must be lowercase. The very first push tomainwill fail the workflow at this step.Suggested fix — lowercase the namespace. Either pass it through an env var in a prior step:
and then use
tags: ${{ env.IMAGE }}:latest/${{ env.IMAGE }}:${{ github.sha }}, or hardcode the lowercase path (git.kagaku.eu/teamai/doujin-manager).[major] Push path vs. pull path mismatch — Portainer will not find the image.
deploy/docker-compose.yml:24pullsgit.kagaku.eu/teamai/doujin-manager:latest(lowercase), but after fixing the tag above, what actually gets pushed is whatever the registry stores. The Forgejo container registry stores packages under the owner/path as-pushed, and the two must be byte-identical. Make sure the workflow's lowercased push path and the compose pull path are the same string. Today they differ (TeamAI/...push vsteamai/...pull) — reconcile both to lowercase.[minor]
docker/login-actionregistry:likely rejects the scheme prefix.login-action@v3(and the registry client) generally expect a bare host, but${{ github.server_url }}expands tohttps://git.kagaku.eu. Passinghttps://git.kagaku.euasregistry:can fail with a URL-parse error. Consider deriving a scheme-less host (e.g.echo "REGISTRY=${{ github.server_url }}" | sed 's#^https\?://##'). Worth a quick check against your runner.Non-blocking notes
DOUJIN_MANAGER_AUTH_TOKEN=replac...okenplaceholder indocker-compose.ymlis fine for a Portainer-paste workflow; just ensure the real token is only ever entered in Portainer (which encrypts stack env vars) and never committed. The previous${DOUJIN...must be set}form was equally safe.runs-on: dockerrequires a self-hosted runner with a Docker daemon — yourci.ymlalready usesruns-on: dotnet, so confirm adocker-labeled runner exists, otherwise the publish job will stay queued.push: main). Acceptable since the Dockerfile build path is exercised implicitly andci.ymlalready builds the .NET app — but if you want a pre-merge signal, addingpull_request:to the triggers (withoutpush: true) is cheap.Verification
7eafbfd2(line 84%, branch 50.2%, generated 06/29 01:39). Theci.ymltestjob only posts coverage on success, so build+test passed for this head. Local build/test skipped per CI-evidence policy (and this PR contains no application code).docker-publish.ymldoes not run onpull_request, so its correctness could not be CI-verified here — the uppercase-tag issue above would only surface on the first post-merge push tomain.Automated daily review. I never merge PRs.
Fixed all 3 findings in commit
b5663eb.#1 — Uppercase image tag ✅
Hardcoded
git.kagaku.eu/teamai/doujin-manager(lowercase) instead of${{ github.repository }}which expands toTeamAI/doujin-manager. Docker rejects uppercase in image references.#2 — Push/pull path mismatch ✅
The workflow now pushes to exactly
git.kagaku.eu/teamai/doujin-manager:latest— the same string the compose file pulls. Byte-identical.#3 — Registry scheme prefix ✅
Changed
registry:from${{ github.server_url }}(which expands tohttps://git.kagaku.eu) to baregit.kagaku.eu.docker/login-actionexpects a host, not a URL.