From 0a4af3b758031082838bb6947108d2c97197411b Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Tue, 21 Jul 2026 10:56:36 +0000 Subject: [PATCH] ci: push to Harbor (repo.meghsakha.com) + cosign signing --- .gitea/workflows/ci.yaml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index c7a6fd9..4dc85a5 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -8,6 +8,10 @@ on: push: branches: [main] +env: + COSIGN_KEY: ${{ secrets.COSIGN_KEY }} + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} + jobs: shared: runs-on: docker @@ -110,7 +114,7 @@ jobs: image: # Builds the portal image and ships it through the same path every # other service in orca-infra uses: push :latest + :sha- to - # registry.meghsakha.com, then POST a github-style payload to the + # repo.meghsakha.com, then POST a github-style payload to the # orca webhook so the master pulls and redeploys breakpilot-portal. # # Webhook target (registered once on the master via @@ -124,15 +128,15 @@ jobs: - uses: actions/checkout@v4 - uses: docker/login-action@v3 with: - registry: registry.meghsakha.com + registry: repo.meghsakha.com username: ${{ secrets.REGISTRY_USER }} password: ${{ secrets.REGISTRY_PASS }} - uses: docker/build-push-action@v6 with: push: true tags: | - registry.meghsakha.com/breakpilot/portal:latest - registry.meghsakha.com/breakpilot/portal:sha-${{ github.sha }} + repo.meghsakha.com/breakpilot/portal:latest + repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }} - name: trigger orca redeploy # Signs the POST with HMAC-SHA256 over the JSON body using the # secret orca generated when the webhook was registered. Orca's