From 9be4d495e410629d1588518e0e7ef9f00065d67f Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Mon, 20 Jul 2026 18:08:09 -0700 Subject: [PATCH] Reconcile Forgejo workflows with the real infrastructure now in place (#238) The Swarm/Forgejo standup (a parallel infra track, see INFRA.md) landed real .forgejo/workflows/{build,pr-build,deploy,deploy-dev}.yml before this PR merged, making ci.yml a redundant duplicate of their build.yml (same build gate, same job). Drop it. Fix the remaining two files to match the real, already-deployed conventions those files established rather than the guesses this PR shipped with: runs-on: [self-hosted, thermograph] -> docker (the actual Docker-in-Docker Swarm-hosted runner label), and appleboy/ssh-action referenced by full GitHub URL (confirmed not mirrored on this Forgejo instance's default action registry, per deploy.yml's own header comment) rather than the short form. actions/checkout needed no change - already confirmed to resolve unchanged from Forgejo's default mirror. build-push.yml (image registry push) and ops-cron.yml (backup + IndexNow) stay: neither duplicates anything in the real mirror, which faithfully replicates the OLD git-checkout-and-build-in-place deploy model rather than the registry-based one, and has no scheduled ops jobs at all. --- .forgejo/workflows/ops-cron.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.forgejo/workflows/ops-cron.yml b/.forgejo/workflows/ops-cron.yml index 21ab8f6..0b0a64a 100644 --- a/.forgejo/workflows/ops-cron.yml +++ b/.forgejo/workflows/ops-cron.yml @@ -9,9 +9,12 @@ name: Ops cron (backup + IndexNow) # Both jobs SSH into the prod host and run inside the already-running compose # stack (docker compose exec), the same way deploy.sh already runs its own # post-deploy IndexNow ping -- no new network exposure, no separate dependency -# install. Needs a runner registered with the `thermograph` label (Track B step -# 5) and the same SSH secrets deploy.yml uses (SSH_HOST/SSH_USER/SSH_KEY/ -# SSH_PORT) to reach the prod host. +# install. Runs on the `docker` label (the always-on Swarm-hosted runner +# deploy/forgejo/ stood up) and reuses the same SSH secrets deploy.yml already +# has (SSH_HOST/SSH_USER/SSH_KEY/SSH_PORT) -- inherits, and will automatically +# benefit from a fix to, deploy.yml's own flagged branch/host mismatch (that +# workflow's header comment: it still targets `main`, while +# terraform.tfvars.example names prod's branch `release`). on: schedule: @@ -22,10 +25,10 @@ on: jobs: backup: name: pg_dump backup - runs-on: [self-hosted, thermograph] + runs-on: docker steps: - name: Dump the prod database over SSH - uses: appleboy/ssh-action@v1.2.0 + uses: https://github.com/appleboy/ssh-action@v1.2.0 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }} @@ -47,10 +50,10 @@ jobs: indexnow: name: IndexNow ping - runs-on: [self-hosted, thermograph] + runs-on: docker steps: - name: Ping IndexNow if the URL set changed - uses: appleboy/ssh-action@v1.2.0 + uses: https://github.com/appleboy/ssh-action@v1.2.0 with: host: ${{ secrets.SSH_HOST }} username: ${{ secrets.SSH_USER }}