From c8af6e4114f7a869315203a0fb238eb509e647a3 Mon Sep 17 00:00:00 2001
From: Ashwin Kumar Sivakumar <ashwin@traceworks.in>
Date: Sun, 12 Jul 2026 18:36:42 +0530
Subject: [PATCH] fix(ci): use GITOPS_PAT for gitops push, not never-configured
 SSH secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third bug in the same chain: GITEOPS_REPO/GITEOPS_SSH_KEY were
referenced but never actually configured as repo secrets (only
REGISTRY_*, GITOPS_GITHUB_*, and GITOPS_PAT exist) — the digest
extraction fix got the job to actually reach this step, where it then
failed instantly and silently (a bare `test -n` with no echo). Switch
to an HTTPS clone with GITOPS_PAT, matching nxtgauge-backend-rust's
already-working workflow.
---
 .forgejo/workflows/build.yaml | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 796e9d6..0363ea9 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -98,22 +98,24 @@ jobs:
 
       - name: Update GitOps release
         env:
-          GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
-          GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
+          GITOPS_SERVER: ${{ secrets.GITOPS_SERVER || 'ci.nxtgauge.com' }}
+          GITOPS_OWNER: ${{ secrets.GITOPS_OWNER || 'ashwin' }}
+          GITOPS_REPO: ${{ secrets.GITOPS_REPO || 'nxtgauge-gitops' }}
+          GITOPS_BRANCH: ${{ secrets.GITOPS_BRANCH || 'main' }}
+          # The gitops repo lives on Forgejo (ci.nxtgauge.com), not GitHub -
+          # GITEOPS_REPO/GITEOPS_SSH_KEY were never actually configured as
+          # repo secrets (only GITOPS_GITHUB_* and GITOPS_PAT exist, per
+          # nxtgauge-backend-rust's already-fixed workflow). Use GITOPS_PAT.
+          GITOPS_PAT: ${{ secrets.GITOPS_PAT }}
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          test -n "$GITEOPS_REPO"
-          test -n "$GITEOPS_SSH_KEY"
+          test -n "${GITOPS_PAT:-}" || { echo "GITOPS_PAT is empty"; exit 1; }
 
-          mkdir -p ~/.ssh
-          printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          for host in github.com ci.nxtgauge.com; do ssh-keyscan -H "$host" >> ~/.ssh/known_hosts 2>/dev/null || true; done
-
-          GITEOPS_DIR=$(mktemp -d)
-          git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
-          cd "$GITEOPS_DIR"
+          GITOPS_DIR=$(mktemp -d)
+          git clone "https://forgejo-actions:${GITOPS_PAT}@${GITOPS_SERVER}/${GITOPS_OWNER}/${GITOPS_REPO}.git" "$GITOPS_DIR"
+          cd "$GITOPS_DIR"
+          git checkout "$GITOPS_BRANCH"
 
           image_ref="$(cat /tmp/frontend-solid-image-ref.txt)"
           ./scripts/set-app-release.sh frontend-solid "$image_ref"
@@ -127,4 +129,4 @@ jobs:
           git config user.email "forgejo-actions@ci.nxtgauge.com"
           git add apps scripts/set-app-release.sh
           git commit -m "chore(gitops): deploy frontend-solid@${SHA}"
-          git push
+          git push origin "HEAD:${GITOPS_BRANCH}"