5 Commits

Include renames

Author	SHA1	Message	Date
JakeBreath	7cecfeabc6	Use a minimal registry PAT and the job token for releases ... Gitea's container registry rejects the automatic job token (go-gitea/gitea#23642 is still open), so the image push keeps a PAT with only the write:package scope; a preflight step fails clearly when the REGISTRY_USER/REGISTRY_TOKEN secrets are missing. Release creation needs no PAT: the desktop job asks for contents: write on the job token.	2026-09-22 23:35:55 -05:00
JakeBreath	ed6178d12e	Make Actions token permissions explicit ... The automatic job token creates the desktop release, so the CD desktop job asks for contents: write; the images job keeps contents: read and asks for packages: write so the job token can stand in for the scoped registry PAT. CI stays read-only. The registry token itself remains a write:package-only PAT (verified login + pull).	2026-09-22 23:30:37 -05:00
JakeBreath	8f9656ac0e	Add the manual CD release workflow ... One dispatch builds and pushes both images and builds the desktop packages into a Gitea release (desktop-v<version>, installers + latest*.yml attached, idempotent on re-run). The live update feed stays a deploy-host operation: CI has no SSH key for jakerasp, so push_desktop.sh --no-build remains the way to publish it. Repo secrets REGISTRY_USER/REGISTRY_TOKEN are set, so the image push uses the Gitea registry credentials directly.	2026-09-22 23:23:05 -05:00
JakeBreath	72fc42217f	Fix CI for the user-scoped runners ... - ci.yml: connect to the test MariaDB as root so Django creates the test database itself (no client install/grant step), and drop actions/cache (cache: pip/npm): Gitea's cache service hangs the job on restore/save. - publish.yml: prefer the REGISTRY_USER/REGISTRY_TOKEN secrets (as on other repos) and fall back to the automatic Actions token. - AGENTS.md: note the CI layout, the runner labels and the cache caveat.	2026-09-22 23:12:56 -05:00
JakeBreath	d9c1e9e521	Add CI and manual image publishing workflows ... - .gitea/workflows/ci.yml: on every push/PR, run Django checks + the full backend suite against MariaDB/Redis services and the frontend lint/type-check/build. Runs on the nitro-ci runner (ubuntu-latest). - .gitea/workflows/publish.yml: manual dispatch; multi-arch build+push of both images as :latest and :<short-sha> with GIT_HASH baked in. - push_*.sh: non-interactive registry login for CI (REGISTRY_USER/ REGISTRY_TOKEN) and a PLATFORMS override.	2026-09-22 22:32:37 -05:00