From 4becb73ab0921ef28460673a548cdc888df4f3e3 Mon Sep 17 00:00:00 2001 From: Ashwin Kumar Sivakumar Date: Thu, 16 Jul 2026 20:33:14 +0530 Subject: [PATCH] fix(ci): push image to Forgejo registry and update GitOps repo over HTTPS The GitOps step relied on GITEOPS_REPO/GITEOPS_SSH_KEY secrets that were never configured, and the registry login used a REGISTRY_HOSTPORT secret that doesn't match this repo's actual registry setup. Switch to the Forgejo registry directly and push the GitOps update over HTTPS with a token, matching how other services in this org already deploy. Co-Authored-By: Claude Sonnet 5 --- .env.example | 9 ++++ .forgejo/workflows/build.yaml | 80 +++++++++++------------------------ 2 files changed, 33 insertions(+), 56 deletions(-) diff --git a/.env.example b/.env.example index edbe9d8..561042c 100644 --- a/.env.example +++ b/.env.example @@ -4,6 +4,15 @@ RUST_LOG=info DATABASE_URL=postgres://postgres:postgres@localhost:5432/nxtgauge_ai_assistant +# Local/laptop testing has no access to the in-cluster Ollama instance, so +# default to the LiteLLM gateway (https://llm.nxtgauge.com) instead of raw +# Ollama. Get LITELLM_API_KEY from secret/litellm-secrets in nxtgauge-ai. +LLM_PROVIDER=litellm +LITELLM_BASE_URL=https://llm.nxtgauge.com/v1 +LITELLM_API_KEY= +LITELLM_MODEL=askash-main + +# Only used when LLM_PROVIDER=ollama (e.g. running Ollama locally yourself). OLLAMA_BASE_URL=http://localhost:11434 OLLAMA_CHAT_MODEL=smollm2:360m OLLAMA_EMBED_MODEL=nomic-embed-text diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml index 77918fc..7f89d6d 100644 --- a/.forgejo/workflows/build.yaml +++ b/.forgejo/workflows/build.yaml @@ -35,80 +35,48 @@ jobs: docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder docker buildx inspect --bootstrap - - name: Login to registry + - name: Login to Forgejo registry env: - REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }} + REGISTRY_HOST: ci.nxtgauge.com REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} run: | set -euo pipefail - test -n "$REGISTRY_HOSTPORT" - printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin + printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin - name: Build and push image env: - REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }} + REGISTRY_HOST: ci.nxtgauge.com SHA: ${{ github.sha }} run: | set -euo pipefail - metadata_file="/tmp/ai-assistant-metadata.json" - image_ref="$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:$SHA" - + image_ref="$REGISTRY_HOST/nxtgauge/nxtgauge-ai-assistant:$SHA" + docker buildx build --push \ - --metadata-file "$metadata_file" \ - -f Dockerfile \ -t "$image_ref" \ + -t "$REGISTRY_HOST/nxtgauge/nxtgauge-ai-assistant:latest" \ + -f Dockerfile \ . - digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)" - test -n "$digest" - printf '%s@%s\n' "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant" "$digest" > /tmp/ai-assistant-image-ref.txt - - - name: Prune old SHA tags - if: success() - continue-on-error: true + - name: Update GitOps env: - REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }} - REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} - run: | - set -euo pipefail - python3 .forgejo/scripts/registry_prune.py \ - --registry "$REGISTRY_HOST" \ - --repo "nxtgauge-ai-assistant" \ - --username "$REGISTRY_USERNAME" \ - --password "$REGISTRY_PASSWORD" \ - --keep 2 - - - name: Update GitOps release - env: - GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }} - GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }} + GITOPS_REPO: https://ci.nxtgauge.com/nxtgauge/nxtgauge-gitops.git + GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }} SHA: ${{ github.sha }} run: | set -euo pipefail - test -n "$GITEOPS_REPO" - test -n "$GITEOPS_SSH_KEY" - - mkdir -p ~/.ssh - printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 - ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null - - GITEOPS_DIR=$(mktemp -d) - git clone "$GITEOPS_REPO" "$GITEOPS_DIR" - cd "$GITEOPS_DIR" - - image_ref="$(cat /tmp/ai-assistant-image-ref.txt)" - ./scripts/set-app-release.sh ai-assistant "$image_ref" - - if git diff --quiet; then - echo "GitOps repo already up to date." - exit 0 - fi - + apk add --no-cache git + + git config --global credential.helper '!f() { printf "%s\\n" "username=forgejo-actions"; printf "%s\\n" "password=$GITOPS_TOKEN"; }; f' + + GITOPS_DIR=$(mktemp -d) + git clone "$GITOPS_REPO" "$GITOPS_DIR" + cd "$GITOPS_DIR" + + # Update deployment image + sed -i "s|image: ci.nxtgauge.com/nxtgauge/nxtgauge-ai-assistant:.*|image: ci.nxtgauge.com/nxtgauge/nxtgauge-ai-assistant:$SHA|" apps/nxtgauge-ai-assistant/base/deployment.yaml + git config user.name "forgejo-actions[bot]" git config user.email "forgejo-actions@ci.nxtgauge.com" - git add apps scripts/set-app-release.sh - git commit -m "chore(gitops): deploy ai-assistant@${SHA}" - git push + git add apps/nxtgauge-ai-assistant/base/deployment.yaml + git diff --quiet || (git commit -m "chore(gitops): deploy ai-assistant@${SHA}" && git push)