Since Forgejo and the app share a swarm, the runner can:
- Connect to Forgejo at http://forgejo:3000 (internal, no Traefik)
- Call docker service update directly via mounted socket
- Avoid SSH entirely — secrets drop from 6 to 3
infra/runner-swarm.yml: runner added to Forgejo stack, pinned to manager
node (required for service API access), uses Docker Swarm Config object
for act_runner config injection
infra/act-runner-config.yml: runner config (bridge network for jobs,
docker socket whitelisted)
build.yml: deploy step replaced with docker service update --with-registry-auth
--detach=false (waits for rollout, shows progress in Actions log)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- build.yml: clarify that runner needs Docker socket; SSH deploy uses
DEPLOY_PATH secret so app host path is configurable; --no-deps so
db/ollama containers are left untouched during deploy
- infra/runner-swarm.yml: act_runner as a Docker service on the Forgejo
host — mounts host socket for buildx, writes act_runner config via
one-shot init container, connects to fabled_backend network
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- .forgejo/workflows/ci.yml: fast checks on every push (TS typecheck,
Python lint via ruff, pytest) — no Docker build, ~30s with cache
- .forgejo/workflows/build.yml: Docker build with registry-side layer
caching + SSH deploy on main branch pushes only
- pyproject.toml: add ruff to dev deps, configure pytest and ruff rules
- tests/: conftest.py + first unit tests for _safe_filename (no DB needed)
- Makefile: add lint, fmt, typecheck, test, check targets for local use
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bvandeusen