DevSeal Workflows

Reusable Forgejo Actions workflows shared across DevSeal repositories. Caller repositories reference these workflows instead of duplicating CI logic; inputs parameterize the build, secrets come from organization-level Actions secrets via secrets: inherit.

publish-image

Builds a Docker image on the dev002-docker-amd64 runner and pushes it to the Forgejo container registry, optionally also to Docker Hub.

Tag semantics:

• Push to the default branch → :latest
• Push of a vX.Y.Z git tag → :X.Y.Z (the v prefix is stripped)

Usage

Add .forgejo/workflows/publish.yml to the caller repository:

name: publish
on:
  push:
    branches: ["main"]
    tags: ["v*"]

jobs:
  publish:
    uses: DevSeal/workflows/.forgejo/workflows/publish-image.yml@main
    with:
      image: my-image
    secrets: inherit

Do not set runs-on on the caller job — omitting it enables workflow expansion, so the published jobs appear individually in the caller's UI.

Inputs

Input	Default	Purpose
image	(required)	Image name; pushed as git.seal-cloud.eu/devseal/<image>
dockerfile	Dockerfile	Dockerfile path relative to the repository root
context	.	Docker build context directory
dockerhub-repo	empty	Docker Hub repository (e.g. devseal/my-image); empty skips the Docker Hub push

Secrets

Callers pass secrets: inherit. The values are defined once as organization-level Actions secrets on the DevSeal org, never per repository and never in this repository:

Secret	Purpose
REGISTRY_USER	Forgejo registry bot user (service)
REGISTRY_TOKEN	write:package access token for service
DOCKERHUB_USER	Docker Hub account (only needed with dockerhub-repo)
DOCKERHUB_TOKEN	Docker Hub access token (only needed with dockerhub-repo)

Because registry credentials are inherited into every caller run, publish workflows must only trigger on default-branch and tag pushes — never on pull_request.

Requirements

• This repository must be public on the Forgejo instance so other repositories can reference its workflows.
• The service user needs Packages write permission in the DevSeal org.
• The caller repository must have Actions enabled.

smoke

workflow_dispatch (or a push touching smoke/) builds and publishes the trivial smoke/Dockerfile as ci-smoke through publish-image — an end-to-end check of the runner, registry credentials, and this workflow without touching a real project.