devteam/sharenet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

make secrets clearer in CI guide
Some checks are pending
CI/CD Pipeline with Ephemeral PiP / test-backend (push) Waiting to run
Details
CI/CD Pipeline with Ephemeral PiP / test-frontend (push) Blocked by required conditions
Details
CI/CD Pipeline with Ephemeral PiP / build-backend (push) Blocked by required conditions
Details
CI/CD Pipeline with Ephemeral PiP / build-frontend (push) Blocked by required conditions
Details
CI/CD Pipeline with Ephemeral PiP / cleanup (push) Blocked by required conditions
Details

Browse source
This commit is contained in:
continuist 2025-09-04 21:40:23 -04:00
parent d09c5926f7
commit 4270c036f6
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
CI_CD_PIPELINE_SETUP_GUIDE.md
View file

@ -1921,9 +1921,15 @@ Go to your Forgejo repository and add these secrets in **Settings → Secrets an
- `APP_NAME`: Your application name (e.g., `sharenet`)
- `POSTGRES_PASSWORD`: A strong password for the PostgreSQL database
- `REGISTRY_HOST`: Your Forgejo instance's registry URL
- `REGISTRY_TOKEN`: Personal Access Token with package write permissions
- `REGISTRY_USERNAME`: Your Forgejo username for registry authentication
- `REGISTRY_TOKEN`: Personal Access Token with `write:packages` scope for registry pushes
- `SSH_PRIVATE_KEY`: SSH private key for production deployment access
**Note**: The CI pipeline now uses mTLS authentication for pushes (port 4443) and Cosign for image signing. The registry policy enforces Sigstore signatures for all images consumed from the registry.
**Optional Secrets (for enhanced security):**
- `COSIGN_PRIVATE_KEY`: Private key for Cosign image signing
- `COSIGN_PASSWORD`: Password for Cosign private key
**Security Note**: All secrets are managed by Forgejo and never exposed in logs or environment variables. The ephemeral PiP approach ensures secrets are only used during execution and never persist.