forge-public/kuzzle-publish@v1

Per-framework publish workflow для Kuzzle publisher репо (old/kuzzle). Sibling будущим <framework>-publish@v1 для других upstream фреймворков.

Состоит из двух jobs в одном workflow: build (nix build OCI) + publish (needs: build, skopeo push в Forgejo registry). Отдельные workflow files не реализуемы в Forgejo Actions v15.0.1 (no workflow_run trigger).

Использование

.forgejo/workflows/publish.yml в publisher репо:

name: Publish
on:
  push:
    branches: [main]
jobs:
  publish:
    uses: forge-public/kuzzle-publish/.forgejo/workflows/publish.yml@v1
    secrets:
      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

Publisher's devenv.nix должен экспонировать outputs.image (docker-archive derivation). package.json MUST содержать .version — становится image tag.

Contract

• Image namespace = $GITHUB_REPOSITORY → push в git.rolder.cloud/<org>/<repo>:<version>
• Image tag = .version из package.json
• Required secret: REGISTRY_TOKEN (Forgejo PAT scope write:package)
• REGISTRY_USER derived runtime из /api/v1/user (PAT owner login)

Job flow

Job	Steps
build	checkout → derive image_full/version → nix build .#outputs.image
publish (needs: build)	checkout → re-build (nix cache hit) → derive REGISTRY_USER → skopeo copy

Related

• Source-of-truth: talos/ansible/playbooks/100-app-platform/templates/seeds/kuzzle-publish/
• Runner: runs-on: rolder-nix (forgejo-runner-nix, M080)
• Plan 6 (kuzzle publisher wire): docs/superpowers/plans/2026-05-22-kuzzle-wire-upstream.md