fix(ci): unify backend build flow through forgejo

.forgejo/workflows/build-all.yaml

@@ -1,38 +0,0 @@
-name: build-all
-
-on:
-  push:
-    branches:
-      - main
-      - high-performance
-
-jobs:
-  build-gateway:
-    runs-on: self-hosted
-    steps:
-      - run: |
-          git clone --depth 1 http://forgejo-http.forgejo.svc.cluster.local:3000/ashwin/nxtgauge-backend-rust.git /tmp/repo
-          cd /tmp/repo
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=gateway -t registry.nxtgauge.com/nxtgauge-rust-gateway:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-gateway:latest
-          rm -rf /tmp/repo
-
-  build-users:
-    runs-on: self-hosted
-    steps:
-      - run: |
-          git clone --depth 1 http://forgejo-http.forgejo.svc.cluster.local:3000/ashwin/nxtgauge-backend-rust.git /tmp/repo
-          cd /tmp/repo
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=users -t registry.nxtgauge.com/nxtgauge-rust-users:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-users:latest
-          rm -rf /tmp/repo
-
-  build-cron:
-    runs-on: self-hosted
-    steps:
-      - run: |
-          git clone --depth 1 http://forgejo-http.forgejo.svc.cluster.local:3000/ashwin/nxtgauge-backend-rust.git /tmp/repo
-          cd /tmp/repo
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=cron -t registry.nxtgauge.com/nxtgauge-rust-cron:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-cron:latest
-          rm -rf /tmp/repo

.forgejo/workflows/build-gateway.yaml

@@ -1,18 +0,0 @@
-name: build-gateway
-
-on:
-  push:
-    branches:
-      - high-performance
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Build
-        run: |
-          git clone --depth 1 http://forgejo-http.forgejo.svc.cluster.local:3000/ashwin/nxtgauge-backend-rust.git /tmp/repo
-          cd /tmp/repo
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=gateway -t registry.nxtgauge.com/nxtgauge-rust-gateway:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-gateway:latest
-          rm -rf /tmp/repo

.forgejo/workflows/build-images.yaml

@@ -1,19 +0,0 @@
-name: build-images
-
-on:
-  push:
-    branches:
-      - high-performance
-
-jobs:
-  gateway:
-    runs-on: ubuntu-latest
-    container:
-      image: registry.nxtgauge.com/rust:alpine
-    steps:
-      - name: checkout
-        run: apk add --no-cache git && git clone --depth 1 http://forgejo-http.forgejo.svc.cluster.local:3000/ashwin/nxtgauge-backend-rust.git /src
-      - name: build
-        run: cd /src && cargo build --release --bin gateway
-      - name: package
-        run: cp /src/target/release/gateway /gateway && echo "Gateway built"

.forgejo/workflows/build-services.yaml

@@ -1,53 +0,0 @@
-name: build-services
-
-on:
-  push:
-    branches:
-      - main
-      - high-performance
-
-jobs:
-  build-gateway:
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build gateway
-        run: |
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=gateway -t registry.nxtgauge.com/nxtgauge-rust-gateway:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-gateway:latest
-
-  build-users:
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build users
-        run: |
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=users -t registry.nxtgauge.com/nxtgauge-rust-users:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-users:latest
-
-  build-jobs:
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build jobs
-        run: |
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=jobs -t registry.nxtgauge.com/nxtgauge-rust-jobs:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-jobs:latest
-
-  build-leads:
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build leads
-        run: |
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=leads -t registry.nxtgauge.com/nxtgauge-rust-leads:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-leads:latest
-
-  build-cron:
-    runs-on: self-hosted
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build cron
-        run: |
-          docker build -f Dockerfile.simple --build-arg SERVICE_NAME=cron -t registry.nxtgauge.com/nxtgauge-rust-cron:latest .
-          docker push registry.nxtgauge.com/nxtgauge-rust-cron:latest

.forgejo/workflows/build-simple.yaml

@@ -1,44 +0,0 @@
-name: build-all-services
-
-on:
-  push:
-    branches:
-      - main
-      - high-performance
-
-jobs:
-  build:
-    runs-on: self-hosted
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Build and push all services
-        run: |
-          set -e
-          REGISTRY="registry.nxtgauge.com"
-          SHA="${{ github.sha }}"
-          
-          SERVICES='gateway users companies jobs leads job-seekers customers payments employees photographers makeup-artists tutors developers video-editors graphic-designers social-media-managers fitness-trainers catering-services ugc-content-creators cron'
-          
-          echo "Logging into registry..."
-          echo "Ashwin@2026" | docker login $REGISTRY -u admin --password-stdin
-          
-          for service in $SERVICES; do
-            echo ""
-            echo "=================================="
-            echo "Building $service..."
-            echo "=================================="
-            
-            docker build -f Dockerfile.simple \
-              --build-arg SERVICE_NAME=$service \
-              -t "$REGISTRY/nxtgauge-rust-$service:$SHA" \
-              -t "$REGISTRY/nxtgauge-rust-$service:latest" \
-              . || echo "Failed to build $service"
-            
-            docker push "$REGISTRY/nxtgauge-rust-$service:$SHA" || echo "Failed to push $service:$SHA"
-            docker push "$REGISTRY/nxtgauge-rust-$service:latest" || echo "Failed to push $service:latest"
-          done
-          
-          echo ""
-          echo "All services built and pushed!"

.forgejo/workflows/build.yaml

@@ -1,4 +1,4 @@
-name: build-and-push
+name: build-and-release
 
 on:
   push:
@@ -6,12 +6,13 @@ on:
       - main
       - high-performance
 
+concurrency:
+  group: backend-build-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  detect-changes:
-    runs-on: ubuntu-latest
-    outputs:
-      services_csv: ${{ steps.detect.outputs.services_csv }}
-      has_changes: ${{ steps.detect.outputs.has_changes }}
+  build:
+    runs-on: self-hosted
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -19,150 +20,145 @@ jobs:
           fetch-depth: 0
 
       - name: Detect changed services
-        id: detect
         run: |
           set -euo pipefail
-          
+          ALL_SERVICES='gateway users companies jobs leads job-seekers customers payments employees photographers makeup-artists tutors developers video-editors graphic-designers social-media-managers fitness-trainers catering-services ugc-content-creators cron'
+
           if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
-            CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
+            CHANGED_FILES="$(git diff --name-only HEAD^ HEAD)"
           else
-            CHANGED_FILES=$(git ls-files)
-          fi
-          
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | tr '\n' ' ')
-          
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-          
-          ALL_SERVICES='gateway,users,companies,jobs,leads,job-seekers,customers,payments,employees,photographers,makeup-artists,tutors,developers,video-editors,graphic-designers,social-media-managers,fitness-trainers,catering-services,ugc-content-creators,cron'
-          
-          # Force full build for explicit trigger commits
-          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger build|force build|rebuild all'; then
-            echo "services_csv=$ALL_SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          
-          # Build everything for workflow/docker/shared backend changes
-          if echo "$CHANGED_FILES" | grep -Eq '^(\.forgejo/workflows/|Dockerfile|Cargo\.toml|Cargo\.lock|crates/)'; then
-            echo "services_csv=$ALL_SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          
-          SERVICES=''
-          add_service() {
-            local svc="$1"
-            case ",${SERVICES}," in
-              *",${svc},"*) ;;
-              *)
-                if [ -z "$SERVICES" ]; then
-                  SERVICES="$svc"
-                else
-                  SERVICES="$SERVICES,$svc"
-                fi
-                ;;
-            esac
-          }
-          
-          while IFS= read -r f; do
-            case "$f" in
-              apps/gateway/*) add_service "gateway" ;;
-              apps/users/*) add_service "users" ;;
-              apps/companies/*) add_service "companies" ;;
-              apps/jobs/*) add_service "jobs" ;;
-              apps/leads/*) add_service "leads" ;;
-              apps/job_seekers/*) add_service "job-seekers" ;;
-              apps/customers/*) add_service "customers" ;;
-              apps/payments/*) add_service "payments" ;;
-              apps/employees/*) add_service "employees" ;;
-              apps/photographers/*) add_service "photographers" ;;
-              apps/makeup_artists/*) add_service "makeup-artists" ;;
-              apps/tutors/*) add_service "tutors" ;;
-              apps/developers/*) add_service "developers" ;;
-              apps/video_editors/*) add_service "video-editors" ;;
-              apps/graphic_designers/*) add_service "graphic-designers" ;;
-              apps/social_media_managers/*) add_service "social-media-managers" ;;
-              apps/fitness_trainers/*) add_service "fitness-trainers" ;;
-              apps/catering_services/*) add_service "catering-services" ;;
-              apps/ugc_content_creators/*) add_service "ugc-content-creators" ;;
-              apps/cron/*) add_service "cron" ;;
-            esac
-          done <<< "$CHANGED_FILES"
-          
-          if [ -z "$SERVICES" ]; then
-            echo "services_csv=" >> "$GITHUB_OUTPUT"
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "services_csv=$SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            CHANGED_FILES="$(git ls-files)"
           fi
 
-  build:
-    needs: detect-changes
-    if: needs.detect-changes.outputs.has_changes == 'true'
-    runs-on: ubuntu-latest
-    env:
-      DOCKER_HOST: unix:///var/run/docker.sock
-    strategy:
-      fail-fast: false
-      matrix:
-        service:
-          - gateway
-          - users
-          - companies
-          - jobs
-          - leads
-          - job-seekers
-          - customers
-          - payments
-          - employees
-          - photographers
-          - makeup-artists
-          - tutors
-          - developers
-          - video-editors
-          - graphic-designers
-          - social-media-managers
-          - fitness-trainers
-          - catering-services
-          - ugc-content-creators
-          - cron
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+          LAST_COMMIT_MSG="$(git log -1 --pretty=%B | tr '\n' ' ')"
+
+          force_full_build=false
+          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger build|force build|rebuild all'; then
+            force_full_build=true
+          elif echo "$CHANGED_FILES" | grep -Eq '^(\.forgejo/workflows/|Dockerfile|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then
+            force_full_build=true
+          fi
+
+          if [ "$force_full_build" = true ]; then
+            printf '%s\n' $ALL_SERVICES > /tmp/changed-services.txt
+            exit 0
+          fi
+
+          : > /tmp/changed-services.txt
+          while IFS= read -r f; do
+            case "$f" in
+              apps/gateway/*) echo gateway >> /tmp/changed-services.txt ;;
+              apps/users/*) echo users >> /tmp/changed-services.txt ;;
+              apps/companies/*) echo companies >> /tmp/changed-services.txt ;;
+              apps/jobs/*) echo jobs >> /tmp/changed-services.txt ;;
+              apps/leads/*) echo leads >> /tmp/changed-services.txt ;;
+              apps/job_seekers/*) echo job-seekers >> /tmp/changed-services.txt ;;
+              apps/customers/*) echo customers >> /tmp/changed-services.txt ;;
+              apps/payments/*) echo payments >> /tmp/changed-services.txt ;;
+              apps/employees/*) echo employees >> /tmp/changed-services.txt ;;
+              apps/photographers/*) echo photographers >> /tmp/changed-services.txt ;;
+              apps/makeup_artists/*) echo makeup-artists >> /tmp/changed-services.txt ;;
+              apps/tutors/*) echo tutors >> /tmp/changed-services.txt ;;
+              apps/developers/*) echo developers >> /tmp/changed-services.txt ;;
+              apps/video_editors/*) echo video-editors >> /tmp/changed-services.txt ;;
+              apps/graphic_designers/*) echo graphic-designers >> /tmp/changed-services.txt ;;
+              apps/social_media_managers/*) echo social-media-managers >> /tmp/changed-services.txt ;;
+              apps/fitness_trainers/*) echo fitness-trainers >> /tmp/changed-services.txt ;;
+              apps/catering_services/*) echo catering-services >> /tmp/changed-services.txt ;;
+              apps/ugc_content_creators/*) echo ugc-content-creators >> /tmp/changed-services.txt ;;
+              apps/cron/*) echo cron >> /tmp/changed-services.txt ;;
+            esac
+          done <<EOF2
+$CHANGED_FILES
+EOF2
+
+          sort -u /tmp/changed-services.txt -o /tmp/changed-services.txt
+
+      - name: Stop if nothing changed
+        run: |
+          set -euo pipefail
+          if [ ! -s /tmp/changed-services.txt ]; then
+            echo "No backend service changes detected."
+            exit 0
+          fi
 
       - name: Set up Docker Buildx
         run: |
-          export DOCKER_HOST=unix:///var/run/docker.sock
+          set -euo pipefail
+          [ -s /tmp/changed-services.txt ] || exit 0
           docker version
-          docker buildx create --use || true
+          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
           docker buildx inspect --bootstrap
 
-      - name: Login to Registry
-        run: |
-          set -euo pipefail
-          export DOCKER_HOST=unix:///var/run/docker.sock
-          echo "Logging into registry.nxtgauge.com..."
-          echo "Ashwin@2026" | docker login registry.nxtgauge.com -u admin --password-stdin
-
-      - name: Build and push
+      - name: Login to registry
         env:
-          SERVICES_CSV: ${{ needs.detect-changes.outputs.services_csv }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME || 'admin' }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD || 'Ashwin@2026' }}
         run: |
           set -euo pipefail
-          export DOCKER_HOST=unix:///var/run/docker.sock
-          SHA="${{ github.sha }}"
-          
-          if [ -n "$SERVICES_CSV" ] && ! echo ",$SERVICES_CSV," | grep -q ",${{ matrix.service }},"; then
-            echo "Skipping unchanged service: ${{ matrix.service }}"
+          [ -s /tmp/changed-services.txt ] || exit 0
+          printf '%s' "$REGISTRY_PASSWORD" | docker login registry.nxtgauge.com -u "$REGISTRY_USERNAME" --password-stdin
+
+      - name: Build changed services
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          [ -s /tmp/changed-services.txt ] || exit 0
+          : > /tmp/built-services.tsv
+          while IFS= read -r service; do
+            [ -n "$service" ] || continue
+            metadata_file="/tmp/${service}-metadata.json"
+            image_ref="registry.nxtgauge.com/nxtgauge-rust-${service}:${SHA}"
+
+            docker buildx build --push \
+              --metadata-file "$metadata_file" \
+              -f Dockerfile.simple \
+              --build-arg SERVICE_NAME="$service" \
+              -t "$image_ref" \
+              .
+
+            digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
+            if [ -z "$digest" ]; then
+              echo "Failed to determine digest for $service" >&2
+              exit 1
+            fi
+
+            printf '%s\t%s\n' "$service" "$digest" >> /tmp/built-services.tsv
+          done < /tmp/changed-services.txt
+
+      - name: Update GitOps release state
+        env:
+          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'Traceworks2023' }}
+          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
+          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
+          GITOPS_PUSH_USERNAME: ${{ secrets.GITOPS_PUSH_USERNAME || 'Traceworks2023' }}
+          GITOPS_PUSH_TOKEN: ${{ secrets.GITOPS_PUSH_TOKEN || secrets.GITHUB_PAT }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          [ -s /tmp/built-services.tsv ] || exit 0
+          test -n "${GITOPS_PUSH_TOKEN:-}" || { echo "GITOPS_PUSH_TOKEN is empty"; exit 1; }
+
+          git clone "https://${GITOPS_PUSH_USERNAME}:${GITOPS_PUSH_TOKEN}@github.com/${GITOPS_OWNER}/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
+          cd /tmp/nxtgauge-gitops
+          git checkout "$GITOPS_BRANCH"
+
+          while IFS=$'\t' read -r service digest; do
+            [ -n "$service" ] || continue
+            ./scripts/set-backend-rust-release.sh "$service" "$digest"
+          done < /tmp/built-services.tsv
+
+          if git diff --quiet; then
+            echo "GitOps repo already up to date."
             exit 0
           fi
 
-          echo "Building ${{ matrix.service }}..."
-          docker buildx build --push \
-            -f Dockerfile.simple \
-            --build-arg SERVICE_NAME=${{ matrix.service }} \
-            -t "registry.nxtgauge.com/nxtgauge-rust-${{ matrix.service }}:${SHA}" \
-            -t "registry.nxtgauge.com/nxtgauge-rust-${{ matrix.service }}:latest" \
-            .
+          git config user.name "forgejo-actions[bot]"
+          git config user.email "forgejo-actions@ci.nxtgauge.com"
+          git add \
+            apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv \
+            apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml \
+            apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml
+          git commit -m "chore(gitops): update backend rust images for ${SHA}"
+          git push origin "HEAD:${GITOPS_BRANCH}"

.github/workflows/build-and-push.yaml

@@ -1,160 +0,0 @@
-name: Build and Push to Registry
-
-on:
-  push:
-    branches:
-      - high-performance
-      - main
-
-jobs:
-  detect-changes:
-    runs-on: ubuntu-latest
-    outputs:
-      services_csv: ${{ steps.detect.outputs.services_csv }}
-      has_changes: ${{ steps.detect.outputs.has_changes }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect changed services
-        id: detect
-        run: |
-          set -euo pipefail
-          
-          if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
-            CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
-          else
-            CHANGED_FILES=$(git ls-files)
-          fi
-          
-          LAST_COMMIT_MSG=$(git log -1 --pretty=%B | tr '\n' ' ')
-          
-          echo "Changed files:"
-          echo "$CHANGED_FILES"
-          
-          ALL_SERVICES='gateway,users,companies,jobs,leads,job-seekers,customers,payments,employees,photographers,makeup-artists,tutors,developers,video-editors,graphic-designers,social-media-managers,fitness-trainers,catering-services,ugc-content-creators,cron'
-          
-          # Force full build for explicit trigger commits
-          if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger build|force build|rebuild all'; then
-            echo "services_csv=$ALL_SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          
-          # Build everything for workflow/docker/shared backend changes
-          if echo "$CHANGED_FILES" | grep -Eq '^(\.github/workflows/|Dockerfile|Cargo\.toml|Cargo\.lock|crates/)'; then
-            echo "services_csv=$ALL_SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          
-          SERVICES=''
-          add_service() {
-            local svc="$1"
-            case ",${SERVICES}," in
-              *",${svc},"*) ;;
-              *)
-                if [ -z "$SERVICES" ]; then
-                  SERVICES="$svc"
-                else
-                  SERVICES="$SERVICES,$svc"
-                fi
-                ;;
-            esac
-          }
-          
-          while IFS= read -r f; do
-            case "$f" in
-              apps/gateway/*) add_service "gateway" ;;
-              apps/users/*) add_service "users" ;;
-              apps/companies/*) add_service "companies" ;;
-              apps/jobs/*) add_service "jobs" ;;
-              apps/leads/*) add_service "leads" ;;
-              apps/job_seekers/*) add_service "job-seekers" ;;
-              apps/customers/*) add_service "customers" ;;
-              apps/payments/*) add_service "payments" ;;
-              apps/employees/*) add_service "employees" ;;
-              apps/photographers/*) add_service "photographers" ;;
-              apps/makeup_artists/*) add_service "makeup-artists" ;;
-              apps/tutors/*) add_service "tutors" ;;
-              apps/developers/*) add_service "developers" ;;
-              apps/video_editors/*) add_service "video-editors" ;;
-              apps/graphic_designers/*) add_service "graphic-designers" ;;
-              apps/social_media_managers/*) add_service "social-media-managers" ;;
-              apps/fitness_trainers/*) add_service "fitness-trainers" ;;
-              apps/catering_services/*) add_service "catering-services" ;;
-              apps/ugc_content_creators/*) add_service "ugc-content-creators" ;;
-              apps/cron/*) add_service "cron" ;;
-            esac
-          done <<< "$CHANGED_FILES"
-          
-          if [ -z "$SERVICES" ]; then
-            echo "services_csv=" >> "$GITHUB_OUTPUT"
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "services_csv=$SERVICES" >> "$GITHUB_OUTPUT"
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
-
-  build:
-    needs: detect-changes
-    if: needs.detect-changes.outputs.has_changes == 'true'
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        service:
-          - gateway
-          - users
-          - companies
-          - jobs
-          - leads
-          - job-seekers
-          - customers
-          - payments
-          - employees
-          - photographers
-          - makeup-artists
-          - tutors
-          - developers
-          - video-editors
-          - graphic-designers
-          - social-media-managers
-          - fitness-trainers
-          - catering-services
-          - ugc-content-creators
-          - cron
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: registry.nxtgauge.com
-          username: admin
-          password: Ashwin@2026
-
-      - name: Build and push
-        env:
-          SERVICES_CSV: ${{ needs.detect-changes.outputs.services_csv }}
-        run: |
-          set -euo pipefail
-          SHA="${{ github.sha }}"
-          
-          if [ -n "$SERVICES_CSV" ] && ! echo ",$SERVICES_CSV," | grep -q ",${{ matrix.service }},"; then
-            echo "Skipping unchanged service: ${{ matrix.service }}"
-            exit 0
-          fi
-          
-          docker buildx build --push \
-            -f Dockerfile.simple \
-            --build-arg SERVICE_NAME=${{ matrix.service }} \
-            -t "registry.nxtgauge.com/nxtgauge-rust-${{ matrix.service }}:${SHA}" \
-            -t "registry.nxtgauge.com/nxtgauge-rust-${{ matrix.service }}:latest" \
-            .

.github/workflows/sync-to-forgejo.yml

@@ -10,14 +10,14 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Sync to Forgejo
+      - name: Push branch to Forgejo
         env:
           FORGEJO_SECRET: ${{ secrets.FORGEJO_SECRET || secrets.GITEA_SECRET }}
           FORGEJO_OWNER: ${{ secrets.FORGEJO_OWNER || 'ashwin' }}
@@ -25,16 +25,16 @@ jobs:
           REPO: ${{ github.event.repository.name }}
           BRANCH: ${{ github.ref_name }}
         run: |
-          set -euxo pipefail
-          export GIT_TERMINAL_PROMPT=0
-          export GIT_TRACE=1
-          export GIT_CURL_VERBOSE=1
+          set -euo pipefail
+          test -n "${FORGEJO_SECRET:-}" || { echo "FORGEJO_SECRET is empty"; exit 1; }
 
-          USER="${FORGEJO_USERNAME}"
+          AUTH="$(printf '%s' "${FORGEJO_USERNAME}:${FORGEJO_SECRET}" | base64 -w0)"
           TARGET="https://ci.nxtgauge.com/${FORGEJO_OWNER}/${REPO}.git"
-          AUTH="$(printf '%s' "${USER}:${FORGEJO_SECRET}" | base64 -w0)"
 
-          test -n "${FORGEJO_SECRET:-}" || (echo "FORGEJO_SECRET empty" && exit 1)
-          curl -fsS -H "Authorization: Basic ${AUTH}" https://ci.nxtgauge.com/api/v1/user >/dev/null
-          curl -fsS -X POST             -H "Authorization: Basic ${AUTH}"             "https://ci.nxtgauge.com/api/v1/repos/${FORGEJO_OWNER}/${REPO}/mirror-sync" >/dev/null
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote remove forgejo 2>/dev/null || true
+          git remote add forgejo "${TARGET}"
 
+          git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push forgejo "HEAD:${BRANCH}" --force
+          git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push forgejo --tags --force