Push from CI

The CI guides build an image, push it to a registry and deploy it. If the registry is your own Zaroz Registry, two things get simpler: you push with a credential that can do only that, and the Workload pulls the image without any registry login in its source (Zaroz hands the cluster its own pull credential for your registry).

Before you start, finish the Registry quick start up to step 2.

A credential for the pipeline

Create a credential named after the pipeline with scope Pull and push. Not "Pull, push and delete": a build that can delete tags can delete what runs in production. Store the username and the secret in your CI's secret store as ZAROZ_REGISTRY_USERNAME and ZAROZ_REGISTRY_SECRET. Store the login host as ZAROZ_REGISTRY_HOST and the image name as ZAROZ_REGISTRY_IMAGE (<login host>/<namespace>/my-app); these two are not secret.

Use one credential per pipeline and environment. Revoking it stops that pipeline and nothing else; a token already issued lapses within minutes.

GitHub Actions

Code
# .github/workflows/deploy.yml (the build job; the deploy job is the one in the GitHub Actions guide)
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.meta.outputs.image }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ${{ vars.ZAROZ_REGISTRY_HOST }}
          username: ${{ secrets.ZAROZ_REGISTRY_USERNAME }}
          password: ${{ secrets.ZAROZ_REGISTRY_SECRET }}
      - id: meta
        # One immutable tag per commit: Zaroz does not watch a moved tag.
        run: echo "image=${{ vars.ZAROZ_REGISTRY_IMAGE }}:${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.image }}

In the deploy job of the GitHub Actions guide, leave out REGISTRY_USERNAME and REGISTRY_PASSWORD: the image is yours and the cluster already can pull it.

GitLab CI

Code
# .gitlab-ci.yml
build:
  stage: build
  image: docker:27
  services: [docker:27-dind]
  variables:
    IMAGE: "$ZAROZ_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
  script:
    - echo "$ZAROZ_REGISTRY_SECRET" | docker login "${ZAROZ_REGISTRY_IMAGE%%/*}" --username "$ZAROZ_REGISTRY_USERNAME" --password-stdin
    - docker build -t "$IMAGE" .
    - docker push "$IMAGE"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Put the variables in Settings > CI/CD > Variables, masked, and protected if the branch is protected. ${ZAROZ_REGISTRY_IMAGE%%/*} keeps only the login host from the image name. The deploy job is the one in the GitLab CI guide, again without registry login variables.

Forgejo Actions and Gitea Actions

Code
# .forgejo/workflows/deploy.yml
jobs:
  build:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - name: Log in
        env:
          SECRET: ${{ secrets.ZAROZ_REGISTRY_SECRET }}
        run: echo "$SECRET" | docker login "${IMAGE_REPO%%/*}" --username "${{ secrets.ZAROZ_REGISTRY_USERNAME }}" --password-stdin
      - name: Build and push
        run: |
          IMAGE="${IMAGE_REPO}:$(echo "$GITHUB_SHA" | cut -c1-12)"
          docker build -t "$IMAGE" .
          docker push "$IMAGE"
    env:
      IMAGE_REPO: ${{ vars.ZAROZ_REGISTRY_IMAGE }}

The runner needs access to a Docker daemon. The deploy step is the one in the Forgejo and Gitea guide.

Keep the registry tidy

A pipeline that pushes one tag per commit fills the registry. Once a release is out, delete old build tags from the Tags tab, or with a credential of scope "Pull, push and delete" kept outside the build pipeline, for example in a scheduled job that calls DELETE /subscriptions/{id}/registry/repositories/tags. Stored size, and your bill, fall after the registry's next clean-up run.