fix(ci): push image to Forgejo registry and update GitOps repo over HTTPS

The GitOps step relied on GITEOPS_REPO/GITEOPS_SSH_KEY secrets that were
never configured, and the registry login used a REGISTRY_HOSTPORT secret
that doesn't match this repo's actual registry setup. Switch to the
Forgejo registry directly and push the GitOps update over HTTPS with a
token, matching how other services in this org already deploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -4,6 +4,15 @@ RUST_LOG=info
 
 DATABASE_URL=postgres://postgres:postgres@localhost:5432/nxtgauge_ai_assistant
 
+# Local/laptop testing has no access to the in-cluster Ollama instance, so
+# default to the LiteLLM gateway (https://llm.nxtgauge.com) instead of raw
+# Ollama. Get LITELLM_API_KEY from secret/litellm-secrets in nxtgauge-ai.
+LLM_PROVIDER=litellm
+LITELLM_BASE_URL=https://llm.nxtgauge.com/v1
+LITELLM_API_KEY=
+LITELLM_MODEL=askash-main
+
+# Only used when LLM_PROVIDER=ollama (e.g. running Ollama locally yourself).
 OLLAMA_BASE_URL=http://localhost:11434
 OLLAMA_CHAT_MODEL=smollm2:360m
 OLLAMA_EMBED_MODEL=nomic-embed-text

.forgejo/workflows/build.yaml

@@ -35,80 +35,48 @@ jobs:
           docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
           docker buildx inspect --bootstrap
 
-      - name: Login to registry
+      - name: Login to Forgejo registry
         env:
-          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
+          REGISTRY_HOST: ci.nxtgauge.com
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -euo pipefail
-          test -n "$REGISTRY_HOSTPORT"
+          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin
-          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin
 
       - name: Build and push image
         env:
-          REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
+          REGISTRY_HOST: ci.nxtgauge.com
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          metadata_file="/tmp/ai-assistant-metadata.json"
+          image_ref="$REGISTRY_HOST/nxtgauge/nxtgauge-ai-assistant:$SHA"
-          image_ref="$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:$SHA"
           
           docker buildx build --push \
-            --metadata-file "$metadata_file" \
-            -f Dockerfile \
             -t "$image_ref" \
+            -t "$REGISTRY_HOST/nxtgauge/nxtgauge-ai-assistant:latest" \
+            -f Dockerfile \
             .
 
-          digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
+      - name: Update GitOps
-          test -n "$digest"
-          printf '%s@%s\n' "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant" "$digest" > /tmp/ai-assistant-image-ref.txt
-
-      - name: Prune old SHA tags
-        if: success()
-        continue-on-error: true
         env:
-          REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
+          GITOPS_REPO: https://ci.nxtgauge.com/nxtgauge/nxtgauge-gitops.git
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          python3 .forgejo/scripts/registry_prune.py \
-            --registry "$REGISTRY_HOST" \
-            --repo "nxtgauge-ai-assistant" \
-            --username "$REGISTRY_USERNAME" \
-            --password "$REGISTRY_PASSWORD" \
-            --keep 2
-
-      - name: Update GitOps release
-        env:
-          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
-          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "$GITEOPS_REPO"
+          apk add --no-cache git
-          test -n "$GITEOPS_SSH_KEY"
           
-          mkdir -p ~/.ssh
+          git config --global credential.helper '!f() { printf "%s\\n" "username=forgejo-actions"; printf "%s\\n" "password=$GITOPS_TOKEN"; }; f'
-          printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
           
-          GITEOPS_DIR=$(mktemp -d)
+          GITOPS_DIR=$(mktemp -d)
-          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
+          git clone "$GITOPS_REPO" "$GITOPS_DIR"
-          cd "$GITEOPS_DIR"
+          cd "$GITOPS_DIR"
           
-          image_ref="$(cat /tmp/ai-assistant-image-ref.txt)"
+          # Update deployment image
-          ./scripts/set-app-release.sh ai-assistant "$image_ref"
+          sed -i "s|image: ci.nxtgauge.com/nxtgauge/nxtgauge-ai-assistant:.*|image: ci.nxtgauge.com/nxtgauge/nxtgauge-ai-assistant:$SHA|" apps/nxtgauge-ai-assistant/base/deployment.yaml
-
-          if git diff --quiet; then
-            echo "GitOps repo already up to date."
-            exit 0
-          fi
           
           git config user.name "forgejo-actions[bot]"
           git config user.email "forgejo-actions@ci.nxtgauge.com"
-          git add apps scripts/set-app-release.sh
+          git add apps/nxtgauge-ai-assistant/base/deployment.yaml
-          git commit -m "chore(gitops): deploy ai-assistant@${SHA}"
+          git diff --quiet || (git commit -m "chore(gitops): deploy ai-assistant@${SHA}" && git push)
-          git push