alexei.dolgolyov
7733e64b08
A dockerfile or static workload can opt in to reading its deploy config from a
.tinyforge.yml in its own repo. Tinyforge fetches the file, shows field-level
drift vs the live config, and an admin applies it with an explicit Sync. The
repo becomes the source of truth for the declared fields. Manual-sync only;
no auto-apply on deploy, no multi-workload reconcile, no create/delete in v1.
Scope is deliberately source-aware and source_config-resident: dockerfile
declares port/healthcheck/deploy_strategy, static declares deploy_strategy.
The file never carries repo coords or secrets (those stay in the encrypted
DB), which keeps credentials out of the repo.
Backend:
- internal/gitops: Spec/ParseSpec (KnownFields rejects unknown keys), a
source-aware ApplyPlan/BuildPlan, MergeAndValidate (omitted-field-preserving
deep merge + validate-the-merged-result-then-commit — never a partial
config), declared-only Drift with normalization, and Fetch with
ok/no_file/fetch_failed/invalid statuses and token-redacted messages.
- staticsite: DownloadFile added to GitProvider + Gitea/GitHub/GitLab impls,
reusing each provider's SSRF-safe client; 64 KiB cap; ErrFileNotFound.
- store: 4 additive gitops_* columns + setters (disjoint from UpdateWorkload
so the edit-form save and a sync never clobber each other).
- api: GET /workloads/{id}/gitops (status + raw + live drift + managed_fields),
PUT /gitops (admin, enable/path, traversal-safe), POST /gitops/sync (admin,
per-workload locked read->merge->validate->write, audited to event_log).
Frontend:
- GitOpsPanel.svelte: status pill, a purpose-built field-level drift view,
.tinyforge.yml preview, enable ToggleSwitch, Sync via ConfirmDialog; all five
statuses handled, admin affordances gated on the real viewer role.
- GitOps-managed badge (list + detail hero) and a read-only edit-form banner.
- api.ts fetchers + types; i18n apps.detail.gitops.* (en + ru parity).
Built phase-by-phase with an adversarial plan review (caught 5 design flaws
pre-implementation) and an independent review per phase (go / security / ts /
final) — all APPROVE, 0 CRITICAL/HIGH. docs/gitops.md documents the schema and
what's intentionally out of v1. Plan: plans/gitops/.
2.3 KiB
Facts Repo Suggestions
Pending suggestions to push back to claude-code-facts.
2026-06-21: Buildx + registry buildcache DOES work on the TrueNAS Gitea runner
Target file: gitea-python-ci-cd.md
Section: "## 7. Docker Build" and "## 9. Gitea vs GitHub Actions Differences"
Reason: The doc's compatibility table says "Docker Buildx — May not work (runner networking)" and the Docker section uses plain docker build + docker push --all-tags. In practice, docker/setup-buildx-action@v3 + docker/build-push-action@v5 with cache-from/to: type=registry,ref=$REGISTRY:buildcache,mode=max (and type=gha for no-push CI builds) works on the current git.dolgolyov-family.by runner — verified in the notify-bridge and tiny-forge pipelines. Recommend adding a "buildx path (preferred when it works)" variant alongside the conservative plain-docker build path, and softening the row to "Usually works; falls back to plain docker build."
2026-06-21: Quote if: expressions that contain a colon
Target file: gitea-python-ci-cd.md
Section: "## 9. Gitea vs GitHub Actions Differences" (or a new "Workflow gotchas")
Reason: A common skip-guard if: ${{ !startsWith(gitea.event.head_commit.message, 'chore: release v') }} contains : inside the literal, which makes strict YAML parsers (PyYAML, and validators) treat it as a nested mapping and error with "mapping values are not allowed here". Gitea's parser is lenient and accepts the unquoted form, but it fails any standard YAML lint. Fix: wrap the whole expression in double quotes — if: "${{ ... 'chore: release v' ... }}".
2026-06-21: Add a "Go on Gitea" CI/CD note
Target file: gitea-python-ci-cd.md (or a new gitea-go-ci-cd.md)
Section: new
Reason: The doc is Python-only. The same release/Docker patterns apply to Go services with these deltas: pin setup-go to match the go directive in go.mod (a mismatch silently triggers a slow GOTOOLCHAIN=auto toolchain download); gate on go vet ./... + go test ./internal/...; multi-stage Dockerfile with --mount=type=cache,target=/go/pkg/mod and target=/root/.cache/go-build (requires # syntax=docker/dockerfile:1.7); CGO_ENABLED=0 -ldflags="-s -w" static binary on an alpine runtime with a non-root user and a wget --spider HEALTHCHECK.