# zegit-forgejo-runner

Custom toolchain image for the cluster's self-hosted **Gitea Actions (Forgejo)
runner**, which runs in *host mode* (Docker disabled) — workflow steps execute
inside this image, so it must carry node/git/make/etc. that the stock
`code.forgejo.org/forgejo/runner` image lacks.

This repo lives only on Gitea (`zegit-zoo/zegit-forgejo-runner`). The cluster-side
deployment and rationale live in `flux-config` (`runners.md`,
`applications/forgejo-runner/`).

## Build & push

The runner needs this image to run *any* job, so the **first** build must be done
by hand (CI can't bootstrap itself). The cluster is mixed amd64/arm64, so build
multi-arch:

```sh
docker buildx create --use --name zegit-ci 2>/dev/null || true
docker login gitea.langenoja.se        # username + a Gitea personal access token
docker buildx build --platform linux/amd64,linux/arm64 \
  -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
```

The Gitea package is **public**, so the `forgejo-runner-system` namespace pulls it
without an imagePullSecret.

## Wire it into the cluster

After the push succeeds, in `flux-config`
`applications/forgejo-runner/base/deployment-forgejo-runner.yaml` set the `image:`
on **both** the `register` initContainer and the `forgejo-runner` daemon to
`gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci`, then commit (Flux
reconciles). Do this only *after* the image exists, or the pod ImagePullBackOffs.

## Tag scheme

`<base-runner-version>-ci` (e.g. `12.11.1-ci`). Must satisfy the cluster's
Gatekeeper `enforce-semantic-image-tags` constraint — never `:latest`.