ci: setup Forgejo Actions CI and Dokploy deployment pipeline (#11) #13

Merged

yuris merged 1 commit from feat/issue-11-ci-cd-dokploy into main

2026-10-14 20:06:15 +00:00

yuris commented

2026-10-14 20:04:21 +00:00

Owner

Summary

Implements Issue #11: CI/CD Pipeline on Forgejo Actions with Docker & Dokploy Deployment.

next.config.ts: enabled output: standalone.
Dockerfile: multi-stage node:22-alpine with unprivileged nextjs:nodejs (UID 1001) runner copying standalone output, static assets, and public directory.
.dockerignore: exclusions for .git, node_modules, .next, docs, rigs, scratch, .cache, .direnv.
.forgejo/workflows/ci.yml: runs-on ubuntu-latest with Node 22, pnpm store cache, executing vp check and next build on PR and push to main.
.forgejo/workflows/deploy.yml: gates on ci.yml, builds and publishes multi-stage Docker image with registry cache to git.nokopia.com/yuris/titik-gambut-next, sends Dokploy redeploy webhook with X-Gitea-Event header and ref payload, and executes container tag pruner.
.forgejo/scripts/prune-container-tags.mjs: automated registry cleanup keeping 2 recent commit-SHA tags.

Closes #11

## Summary Implements Issue #11: CI/CD Pipeline on Forgejo Actions with Docker & Dokploy Deployment. - next.config.ts: enabled output: standalone. - Dockerfile: multi-stage node:22-alpine with unprivileged nextjs:nodejs (UID 1001) runner copying standalone output, static assets, and public directory. - .dockerignore: exclusions for .git, node_modules, .next, docs, rigs, scratch, .cache, .direnv. - .forgejo/workflows/ci.yml: runs-on ubuntu-latest with Node 22, pnpm store cache, executing vp check and next build on PR and push to main. - .forgejo/workflows/deploy.yml: gates on ci.yml, builds and publishes multi-stage Docker image with registry cache to git.nokopia.com/yuris/titik-gambut-next, sends Dokploy redeploy webhook with X-Gitea-Event header and ref payload, and executes container tag pruner. - .forgejo/scripts/prune-container-tags.mjs: automated registry cleanup keeping 2 recent commit-SHA tags. Closes #11

yuris added 1 commit

2026-10-14 20:04:22 +00:00

ci: setup Forgejo Actions CI and Dokploy deployment pipeline

CI / Verify Quality & Build (pull_request) Successful in 1m44s

Details

3f7007705e

yuris-bot approved these changes

2026-10-14 20:05:37 +00:00

yuris-bot left a comment

Review: Issue 11 - CI/CD Pipeline on Forgejo Actions with Docker & Dokploy Deployment

Verdict: APPROVE

Five-Axis Review Summary

1. Correctness

Standalone Build Configuration: next.config.ts correctly sets output: "standalone". Verified that pnpm build generates .next/standalone with self-contained server.js and standalone dependencies.
Standalone Server Verification: Tested running node server.js from .next/standalone; initialized cleanly on port 3009 without errors.
Multi-Stage Container Architecture: Dockerfile cleanly splits into base, deps, builder, and runner stages with unprivileged system user nextjs:nodejs (UID 1001).
Tag Pruning Script: .forgejo/scripts/prune-container-tags.mjs correctly protects the deploying commit SHA, ignores :latest and :buildcache, and prunes older commit SHAs via Forgejo Package API.

2. Readability & Simplicity

Clean YAML workflow structure.
CI and Deploy concerns cleanly separated into ci.yml (reusable check) and deploy.yml (CD pipeline).
Script logic in prune-container-tags.mjs is self-documenting and resilient.

3. Architecture

Follows standard Forgejo Actions workflow conventions.
Concurrency control configured (cancel-in-progress: true for PRs, false for deployments).
Docker layer caching uses registry buildcache (mode=max).

4. Security & Hardening

Container runs as unprivileged user nextjs (UID 1001).
Thorough .dockerignore prevents accidental leaking of .env*, .git, or scratch artifacts into image context.
Dokploy webhook execution gracefully checks for secret existence before attempting invocation.

5. Performance

Multi-stage build produces a minimal production container footprint (only standalone bundle, public assets, and static files copied).
pnpm store cache configured in CI using actions/cache@v4.

Ponytail Audit

Dependencies: Zero runtime dependencies added.
Complexity: Lean pipeline with essential CI/CD stages.

Verification

vp check: All 86 files formatted; 0 lint errors, 0 type errors.
next build: Standalone artifacts generated in .next/standalone.
Direct execution test of .next/standalone/server.js succeeded (Ready in 0ms).

# Review: Issue 11 - CI/CD Pipeline on Forgejo Actions with Docker & Dokploy Deployment ### Verdict: **APPROVE** --- ### Five-Axis Review Summary #### 1. Correctness - **Standalone Build Configuration**: `next.config.ts` correctly sets `output: "standalone"`. Verified that `pnpm build` generates `.next/standalone` with self-contained `server.js` and standalone dependencies. - **Standalone Server Verification**: Tested running `node server.js` from `.next/standalone`; initialized cleanly on port 3009 without errors. - **Multi-Stage Container Architecture**: Dockerfile cleanly splits into `base`, `deps`, `builder`, and `runner` stages with unprivileged system user `nextjs:nodejs` (UID 1001). - **Tag Pruning Script**: `.forgejo/scripts/prune-container-tags.mjs` correctly protects the deploying commit SHA, ignores `:latest` and `:buildcache`, and prunes older commit SHAs via Forgejo Package API. #### 2. Readability & Simplicity - Clean YAML workflow structure. - CI and Deploy concerns cleanly separated into `ci.yml` (reusable check) and `deploy.yml` (CD pipeline). - Script logic in `prune-container-tags.mjs` is self-documenting and resilient. #### 3. Architecture - Follows standard Forgejo Actions workflow conventions. - Concurrency control configured (`cancel-in-progress: true` for PRs, `false` for deployments). - Docker layer caching uses registry buildcache (`mode=max`). #### 4. Security & Hardening - Container runs as unprivileged user `nextjs` (UID 1001). - Thorough `.dockerignore` prevents accidental leaking of `.env*`, `.git`, or scratch artifacts into image context. - Dokploy webhook execution gracefully checks for secret existence before attempting invocation. #### 5. Performance - Multi-stage build produces a minimal production container footprint (only standalone bundle, public assets, and static files copied). - pnpm store cache configured in CI using `actions/cache@v4`. --- ### Ponytail Audit - **Dependencies**: Zero runtime dependencies added. - **Complexity**: Lean pipeline with essential CI/CD stages. --- ### Verification - `vp check`: All 86 files formatted; 0 lint errors, 0 type errors. - `next build`: Standalone artifacts generated in `.next/standalone`. - Direct execution test of `.next/standalone/server.js` succeeded (Ready in 0ms).

yuris merged commit 2f0c392216 into main

2026-10-14 20:06:15 +00:00

yuris referenced this pull request from a commit

2026-10-14 20:06:16 +00:00

ci: setup Forgejo Actions CI and Dokploy deployment pipeline (#13)