@r8s/forgejo 0.3.2

package/dist/index.d.ts

@@ -0,0 +1,127 @@
+import { type DatabaseProps } from '@r8s/recipes';
+export interface ForgejoActionsProps {
+    /** Runner replicas (default 1 — runners are stateless, scale freely) */
+    replicas?: number;
+    /** forgejo-runner image tag (default '6.3.1' — pinned, 'latest' rejected) */
+    version?: string;
+    /**
+     * Pre-created Secret holding the runner registration token (key:
+     * `registration-token`). Copy the token from Forgejo (Site administration
+     * → Actions → Runners → Create registration token) into your secrets
+     * store at `<path>/<name>/runner-registration-token` — the backend then
+     * provisions the Secret — or reference an existing Secret here.
+     */
+    registrationTokenSecretName?: string;
+    /** Runner job labels (default: forgejo runner-images ubuntu-latest) */
+    labels?: string[];
+}
+export interface ForgejoProps {
+    /** Resource name (defaults to 'forgejo') */
+    name?: string;
+    /** Kubernetes namespace (inherited from <Platform>/<Namespace> unless set) */
+    namespace?: string;
+    /**
+     * Forgejo image tag (defaults to '11' — tracks patch releases within the
+     * major). PINNED VERSION REQUIRED — 'latest' is rejected.
+     */
+    version?: string;
+    /** Public hostname (required) — web UI, git-over-HTTPS and the advertised SSH host */
+    host: string;
+    /**
+     * Repository data on an RWO PVC mounted at /data. Defaults to '20Gi'.
+     * Pass `false` to manage storage yourself. Forgejo is single-replica:
+     * repos, LFS (pvc mode) and attachments live on this volume.
+     */
+    storage?: string | {
+        size?: string;
+        storageClass?: string;
+    } | false;
+    /** CNPG cluster name (also the database and user name). Defaults to 'forgejo-db' */
+    dbName?: string;
+    /** Number of CNPG instances (defaults to 2) */
+    dbInstances?: number;
+    /** CNPG data volume size (defaults to '20Gi') */
+    dbStorage?: string;
+    /** CNPG storage class (defaults to cluster default) */
+    dbStorageClass?: string;
+    /** CNPG backup passthrough — defaults to **enabled** via the platform's S3Provider; `false` opts out */
+    backup?: DatabaseProps['backup'];
+    /**
+     * LFS storage. `'s3'` derives bucket and credentials from the S3Provider
+     * (the default when one is in scope), `'pvc'` keeps large files on the
+     * data volume (the fallback without an S3Provider), `false` disables LFS.
+     */
+    lfs?: 's3' | 'pvc' | false;
+    /**
+     * Actions runners — enabled by default (a GitHub-like forge ships
+     * Actions). Each runner is a forgejo-runner Deployment with a
+     * docker-in-docker sidecar (privileged — run untrusted-code runners in a
+     * dedicated namespace/node pool). `false` opts out.
+     */
+    actions?: ForgejoActionsProps | true | false;
+    /** Open registration (default false — private forge; open deliberately) */
+    registration?: boolean;
+    /** Expose Prometheus /metrics (default false) */
+    metrics?: boolean;
+    /**
+     * Reference a pre-created Secret holding `SECRET_KEY`, `INTERNAL_TOKEN`
+     * and `LFS_JWT_SECRET` instead of backend provisioning.
+     */
+    credentialsSecretName?: string;
+    /** Extra annotations merged onto the Endpoint */
+    endpointAnnotations?: Record<string, string>;
+    /** TLS configuration (defaults to letsencrypt-prod cluster issuer) */
+    tls?: {
+        secretName: string;
+        clusterIssuer: string;
+    };
+    /**
+     * SSH over a dedicated LoadBalancer Service (default: enabled, port 22).
+     * `port` changes the external port AND the port advertised in clone
+     * URLs; `annotations` merge onto the Service (MetalLB pools etc.).
+     * `false` = git over HTTPS only.
+     */
+    ssh?: {
+        port?: number;
+        annotations?: Record<string, string>;
+    } | false;
+    /** Operator version override (CNPG) */
+    operatorVersion?: string;
+}
+/**
+ * Forgejo — self-hosted git forge (GitHub-like: repos, PRs, Actions
+ * runners, LFS).
+ *
+ * @title Forgejo
+ * @category Developer Tools
+ *
+ * Composes:
+ * - Forgejo Deployment (single replica + Recreate — repos live on an RWO
+ *   PVC at /data) with env-to-ini wiring (FORGEJO__section__KEY)
+ * - CNPG Postgres cluster (2 instances) with backups on by default via the
+ *   platform S3Provider
+ * - LFS on S3 when an S3Provider is in scope (PVC fallback otherwise)
+ * - Actions runners by default: forgejo-runner + docker-in-docker sidecar,
+ *   registered via a token from the secrets backend
+ * - Credential bundle (SECRET_KEY, INTERNAL_TOKEN, LFS_JWT_SECRET)
+ *   provisioned through the Platform secrets backend with rotation restart
+ * - Endpoint with TLS + generous proxy limits (LFS uploads, repo pushes)
+ * - SSH over a dedicated LoadBalancer Service (git clone git@…)
+ *
+ * @example
+ * import { Platform, Namespace, S3Provider, MinIO } from '@r8s/recipes'
+ * import { Forgejo } from '@r8s/forgejo'
+ *
+ * // Backups + LFS derive from the S3Provider; runners ship by default
+ * export default (
+ *   <S3Provider provider={<MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />}>
+ *     <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'forgejo' }}>
+ *       <Namespace name="git">
+ *         <Forgejo host="git.example.com" />
+ *       </Namespace>
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ */
+export declare function Forgejo(props: ForgejoProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,aAAa,EACnB,MAAM,cAAc,CAAA;AAErB,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;IACnE,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wGAAwG;IACxG,MAAM,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC;;;;OAIG;IACH,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,CAAA;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,KAAK,CAAA;IAC5C,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5C,sEAAsE;IACtE,GAAG,CAAC,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;KACtB,CAAA;IACD;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,KAAK,CAAA;IACrE,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,kCAoY1C"}

package/dist/index.js

@@ -0,0 +1,369 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Forgejo = Forgejo;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const recipes_1 = require("@r8s/recipes");
+/** Default runner job label — Forgejo's own runner images */
+const DEFAULT_RUNNER_LABELS = [
+    'docker:docker://code.forgejo.org/forgejo/runner-images:ubuntu-latest',
+];
+/**
+ * Forgejo — self-hosted git forge (GitHub-like: repos, PRs, Actions
+ * runners, LFS).
+ *
+ * @title Forgejo
+ * @category Developer Tools
+ *
+ * Composes:
+ * - Forgejo Deployment (single replica + Recreate — repos live on an RWO
+ *   PVC at /data) with env-to-ini wiring (FORGEJO__section__KEY)
+ * - CNPG Postgres cluster (2 instances) with backups on by default via the
+ *   platform S3Provider
+ * - LFS on S3 when an S3Provider is in scope (PVC fallback otherwise)
+ * - Actions runners by default: forgejo-runner + docker-in-docker sidecar,
+ *   registered via a token from the secrets backend
+ * - Credential bundle (SECRET_KEY, INTERNAL_TOKEN, LFS_JWT_SECRET)
+ *   provisioned through the Platform secrets backend with rotation restart
+ * - Endpoint with TLS + generous proxy limits (LFS uploads, repo pushes)
+ * - SSH over a dedicated LoadBalancer Service (git clone git@…)
+ *
+ * @example
+ * import { Platform, Namespace, S3Provider, MinIO } from '@r8s/recipes'
+ * import { Forgejo } from '@r8s/forgejo'
+ *
+ * // Backups + LFS derive from the S3Provider; runners ship by default
+ * export default (
+ *   <S3Provider provider={<MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />}>
+ *     <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'forgejo' }}>
+ *       <Namespace name="git">
+ *         <Forgejo host="git.example.com" />
+ *       </Namespace>
+ *     </Platform>
+ *   </S3Provider>
+ * )
+ */
+function Forgejo(props) {
+    const { name = 'forgejo', namespace: namespaceProp, version = '11', host, storage = '20Gi', dbName = 'forgejo-db', dbInstances = 2, dbStorage = '20Gi', dbStorageClass, backup, lfs, actions = true, registration = false, metrics = false, credentialsSecretName, endpointAnnotations = {}, tls = { secretName: `${name}-tls`, clusterIssuer: 'letsencrypt-prod' }, ssh = {}, operatorVersion, } = props;
+    const namespace = (0, defaults_1.useNamespace)(namespaceProp);
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const s3 = (0, recipes_1.useS3)();
+    const resources_ = [];
+    if (version === 'latest') {
+        throw new Error(`Forgejo "${name}" requires a pinned version.\n` +
+            `\n` +
+            `A git forge holds your entire history — an untested floating tag can\n` +
+            `break migrations on upgrade.\n` +
+            `\n` +
+            `Fix: <Forgejo version="11" ... />`);
+    }
+    // --- Credential bundle (SECRET_KEY, INTERNAL_TOKEN, LFS_JWT_SECRET) --------
+    const credentialsName = credentialsSecretName ?? `${name}-credentials`;
+    if (!credentialsSecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Forgejo', name, 'the instance credential bundle (SECRET_KEY, INTERNAL_TOKEN, LFS_JWT_SECRET)', {
+                propName: 'credentialsSecretName',
+                exampleValue: `${name}-credentials`,
+                keys: ['SECRET_KEY', 'INTERNAL_TOKEN', 'LFS_JWT_SECRET'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-credentials`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}`,
+            secretName: credentialsName,
+            keys: ['SECRET_KEY', 'INTERNAL_TOKEN', 'LFS_JWT_SECRET'],
+            restart: [{ kind: 'Deployment', name }],
+        }));
+    }
+    // --- LFS storage: S3 when a provider is in scope, PVC otherwise ------------
+    const lfsMode = lfs === undefined ? (s3 ? 's3' : 'pvc') : lfs;
+    if (lfsMode === 's3' && !s3) {
+        throw new Error(`Forgejo "${name}": lfs='s3' requires an <S3Provider> in scope.\n` +
+            `\n` +
+            `Add one to the Platform (bucket and credentials derive from it):\n` +
+            `  <S3Provider provider={<MinIO endpoint="https://rustfs:9000" bucket="infra" credentialsSecret="infra-s3-creds" />}>\n` +
+            `\n` +
+            `or keep LFS on the data volume: <Forgejo lfs="pvc" />`);
+    }
+    if (lfsMode === 's3' && !s3.credentialsSecret) {
+        throw new Error(`Forgejo "${name}": the S3Provider has no credentialsSecret — LFS on S3 needs the bucket credentials.`);
+    }
+    if (lfsMode === 'pvc' && !storage) {
+        throw new Error(`Forgejo "${name}": lfs='pvc' with storage={false} writes LFS files to ephemeral\n` +
+            `container storage — they would be lost on pod restart. LFS on PVC lives on the /data volume.\n` +
+            `\n` +
+            `Fix: give the instance storage (<Forgejo storage="20Gi" />),\n` +
+            `put LFS on S3 via an <S3Provider>, or disable LFS explicitly:\n` +
+            `  <Forgejo storage={false} lfs={false} />`);
+    }
+    const lfsEnabled = lfsMode !== false;
+    // MinIO clients want host:port without scheme + an explicit SSL flag
+    const minioEndpoint = s3 ? s3.endpoint.replace(/^https?:\/\//, '') : '';
+    const minioUseSsl = s3 ? (s3.endpoint.startsWith('https') ? 'true' : 'false') : 'false';
+    // --- Actions runners (default on) ------------------------------------------
+    const actionsEnabled = actions !== false;
+    const actionsCfg = actions === true || actions === false ? {} : actions;
+    const runnerName = `${name}-runner`;
+    const runnerTokenSecret = actionsCfg.registrationTokenSecretName ?? `${name}-runner-registration`;
+    if (actionsEnabled && !actionsCfg.registrationTokenSecretName) {
+        if (!(0, recipes_1.canProvisionSecrets)(secretProvider)) {
+            throw (0, recipes_1.secretsRequiredError)('Forgejo', name, 'an Actions runner registration token (Forgejo admin UI → Actions → Runners → Create registration token)', {
+                propName: 'actions.registrationTokenSecretName',
+                exampleValue: `${name}-runner-registration`,
+                keys: ['registration-token'],
+            });
+        }
+        resources_.push((0, core_1.jsx)(recipes_1.StaticSecret, {
+            name: `${name}-runner-registration`,
+            namespace,
+            path: `${secretProvider.path ?? name}/${name}/runner-registration-token`,
+            secretName: runnerTokenSecret,
+            keys: ['registration-token'],
+        }));
+    }
+    // --- Env-to-ini wiring -------------------------------------------------------
+    // Every credential is delivered via secretKeyRef — no plaintext in the
+    // manifest. FORGEJO__section__KEY maps onto app.ini at boot.
+    const sshEnabled = ssh !== false;
+    const sshCfg = ssh === false ? {} : ssh;
+    const env = {
+        FORGEJO__server__DOMAIN: host,
+        FORGEJO__server__ROOT_URL: `https://${host}`,
+        FORGEJO__server__HTTP_PORT: '3000',
+        ...(sshEnabled
+            ? {
+                FORGEJO__server__SSH_DOMAIN: host,
+                FORGEJO__server__SSH_LISTEN_PORT: '22',
+                FORGEJO__server__SSH_PORT: String(sshCfg.port ?? 22),
+            }
+            : { FORGEJO__server__DISABLE_SSH: 'true' }),
+        FORGEJO__database__DB_TYPE: 'postgres',
+        FORGEJO__database__HOST: `${dbName}-rw.${namespace}.svc.cluster.local:5432`,
+        FORGEJO__database__NAME: dbName,
+        FORGEJO__database__USER: dbName,
+        FORGEJO__database__SSL_MODE: 'disable',
+        FORGEJO__security__INSTALL_LOCK: 'true',
+        FORGEJO__service__DISABLE_REGISTRATION: registration ? 'false' : 'true',
+        ...(lfsEnabled ? { FORGEJO__lfs__ENABLED: 'true' } : {}),
+        ...(lfsMode === 's3'
+            ? {
+                'FORGEJO__storage.lfs__STORAGE_TYPE': 'minio',
+                'FORGEJO__storage.lfs__MINIO_ENDPOINT': minioEndpoint,
+                'FORGEJO__storage.lfs__MINIO_USE_SSL': minioUseSsl,
+                'FORGEJO__storage.lfs__MINIO_BUCKET_LOOKUP_TYPE': s3.forcePathStyle ? 'path' : 'dns',
+                'FORGEJO__storage.lfs__MINIO_BUCKET': s3.bucket,
+            }
+            : {}),
+        ...(metrics ? { FORGEJO__metrics__ENABLED: 'true' } : {}),
+        ...(actionsEnabled ? { FORGEJO__actions__ENABLED: 'true' } : {}),
+    };
+    const secrets = {
+        FORGEJO__database__PASSWD: { secret: `${dbName}-db-credentials`, key: 'password' },
+        FORGEJO__security__SECRET_KEY: { secret: credentialsName, key: 'SECRET_KEY' },
+        FORGEJO__security__INTERNAL_TOKEN: { secret: credentialsName, key: 'INTERNAL_TOKEN' },
+        ...(lfsEnabled
+            ? { FORGEJO__lfs__LFS_JWT_SECRET: { secret: credentialsName, key: 'LFS_JWT_SECRET' } }
+            : {}),
+        ...(lfsMode === 's3'
+            ? {
+                'FORGEJO__storage.lfs__MINIO_ACCESS_KEY_ID': {
+                    secret: s3.credentialsSecret,
+                    key: 'access-key-id',
+                },
+                'FORGEJO__storage.lfs__MINIO_SECRET_ACCESS_KEY': {
+                    secret: s3.credentialsSecret,
+                    key: 'secret-access-key',
+                },
+            }
+            : {}),
+    };
+    // --- Repository data volume --------------------------------------------------
+    if (storage) {
+        const size = typeof storage === 'string' ? storage : (storage.size ?? '20Gi');
+        const storageClass = typeof storage === 'object' ? storage.storageClass : undefined;
+        resources_.push((0, core_1.jsx)('PersistentVolumeClaim', {
+            apiVersion: 'v1',
+            kind: 'PersistentVolumeClaim',
+            metadata: { name: `${name}-data`, namespace },
+            spec: {
+                accessModes: ['ReadWriteOnce'],
+                ...(storageClass ? { storageClassName: storageClass } : {}),
+                resources: { requests: { storage: size } },
+            },
+        }));
+    }
+    resources_.push((0, core_1.jsx)(recipes_1.Database, {
+        name: dbName,
+        namespace,
+        instances: dbInstances,
+        storage: dbStorage,
+        ...(dbStorageClass ? { storageClass: dbStorageClass } : {}),
+        backup: backup ?? true,
+        operatorVersion,
+    }), (0, core_1.jsx)(recipes_1.WebService, {
+        name,
+        namespace,
+        image: `codeberg.org/forgejo/forgejo:${version}`,
+        port: 3000,
+        replicas: 1,
+        strategy: 'Recreate',
+        resources: {
+            requests: { memory: '512Mi', cpu: '250m' },
+            limits: { memory: '2Gi', cpu: '2' },
+        },
+        env,
+        secrets,
+        volumes: storage
+            ? [{ name: 'data', persistentVolumeClaim: { claimName: `${name}-data` } }]
+            : [],
+        volumeMounts: storage ? [{ name: 'data', mountPath: '/data' }] : [],
+        probes: {
+            // Upgrades run schema migrations — give the startup probe room
+            startup: { path: '/api/healthz', periodSeconds: 5, failureThreshold: 60 },
+            readiness: { path: '/api/healthz', periodSeconds: 10, failureThreshold: 3 },
+            liveness: { path: '/api/healthz', periodSeconds: 30, failureThreshold: 3 },
+        },
+    }), (0, core_1.jsx)(recipes_1.Endpoint, {
+        name: `${name}-endpoint`,
+        namespace,
+        host,
+        serviceName: name,
+        servicePort: 80,
+        annotations: {
+            // LFS uploads and repo pushes can be large and slow
+            'nginx.ingress.kubernetes.io/proxy-body-size': '512m',
+            'nginx.ingress.kubernetes.io/proxy-read-timeout': '900',
+            'nginx.ingress.kubernetes.io/proxy-send-timeout': '900',
+            ...endpointAnnotations,
+        },
+        tls,
+    }));
+    // --- SSH over a dedicated LoadBalancer (git clone git@…) ---------------------
+    if (sshEnabled) {
+        resources_.push((0, core_1.jsx)('Service', {
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: {
+                name: `${name}-ssh`,
+                namespace,
+                ...(sshCfg.annotations ? { annotations: sshCfg.annotations } : {}),
+            },
+            spec: {
+                type: 'LoadBalancer',
+                selector: { app: name },
+                ports: [{ name: 'ssh', port: sshCfg.port ?? 22, targetPort: 22, protocol: 'TCP' }],
+            },
+        }));
+    }
+    // --- Actions runner: forgejo-runner + docker-in-docker ----------------------------
+    if (actionsEnabled) {
+        const runnerLabels = actionsCfg.labels ?? DEFAULT_RUNNER_LABELS;
+        const runnerConfig = [
+            'runner:',
+            '  file: /runner/.runner',
+            '  capacity: 2',
+            '  timeout: 3h',
+            '  labels:',
+            ...runnerLabels.map((l) => `    - '${l}'`),
+            'container:',
+            '  docker_host: unix:///var/run/docker.sock',
+            '  privileged: false',
+        ].join('\n');
+        resources_.push((0, core_1.jsx)('ConfigMap', {
+            apiVersion: 'v1',
+            kind: 'ConfigMap',
+            metadata: { name: `${name}-runner-config`, namespace },
+            data: { 'config.yaml': runnerConfig },
+        }), (0, core_1.jsx)('Deployment', {
+            apiVersion: 'apps/v1',
+            kind: 'Deployment',
+            metadata: { name: runnerName, namespace },
+            spec: {
+                replicas: actionsCfg.replicas ?? 1,
+                selector: { matchLabels: { app: runnerName } },
+                template: {
+                    metadata: { labels: { app: runnerName } },
+                    spec: {
+                        // the runner talks to Forgejo over HTTPS, never the kube API —
+                        // don't hand a privileged (dind) pod API credentials for free
+                        automountServiceAccountToken: false,
+                        volumes: [
+                            { name: 'runner', emptyDir: {} },
+                            { name: 'config', configMap: { name: `${name}-runner-config` } },
+                            { name: 'docker-sock', emptyDir: {} },
+                        ],
+                        initContainers: [
+                            {
+                                name: 'runner-register',
+                                image: `code.forgejo.org/forgejo/runner:${actionsCfg.version ?? '6.3.1'}`,
+                                command: ['sh', '-c'],
+                                args: [
+                                    'forgejo-runner register --instance "$INSTANCE_URL" --token "$REGISTRATION_TOKEN" --name "$RUNNER_NAME" --no-interactive',
+                                ],
+                                env: [
+                                    // In-cluster URL: registration and job polling must not
+                                    // depend on ingress DNS or hairpinning through the LB —
+                                    // the Service exposes port 80 → the container's 3000.
+                                    {
+                                        name: 'INSTANCE_URL',
+                                        value: `http://${name}.${namespace}.svc.cluster.local`,
+                                    },
+                                    {
+                                        name: 'RUNNER_NAME',
+                                        valueFrom: { fieldRef: { fieldPath: 'metadata.name' } },
+                                    },
+                                    {
+                                        name: 'REGISTRATION_TOKEN',
+                                        valueFrom: {
+                                            secretKeyRef: { name: runnerTokenSecret, key: 'registration-token' },
+                                        },
+                                    },
+                                ],
+                                workingDir: '/runner',
+                                volumeMounts: [{ name: 'runner', mountPath: '/runner' }],
+                            },
+                        ],
+                        containers: [
+                            {
+                                name: 'runner',
+                                image: `code.forgejo.org/forgejo/runner:${actionsCfg.version ?? '6.3.1'}`,
+                                command: ['forgejo-runner', 'daemon', '--config', '/runner-config/config.yaml'],
+                                env: [{ name: 'DOCKER_HOST', value: 'unix:///var/run/docker.sock' }],
+                                volumeMounts: [
+                                    { name: 'runner', mountPath: '/runner' },
+                                    { name: 'config', mountPath: '/runner-config' },
+                                    { name: 'docker-sock', mountPath: '/var/run' },
+                                ],
+                                resources: {
+                                    requests: { memory: '256Mi', cpu: '100m' },
+                                    limits: { memory: '1Gi', cpu: '1' },
+                                },
+                            },
+                            {
+                                name: 'dind',
+                                image: 'docker:27-dind',
+                                // dockerd creates the socket as root; the runner sidecar
+                                // runs as a non-root uid — open the socket once it appears
+                                // (2-min budget) or the runner CrashLoops on permission
+                                command: ['sh', '-c'],
+                                args: [
+                                    'dockerd-entrypoint.sh & DOCKERD=$!; for i in $(seq 1 240); do [ -S /var/run/docker.sock ] && break; sleep 0.5; done; chmod 666 /var/run/docker.sock 2>/dev/null || true; wait $DOCKERD',
+                                ],
+                                env: [{ name: 'DOCKER_TLS_CERTDIR', value: '' }],
+                                securityContext: { privileged: true },
+                                volumeMounts: [{ name: 'docker-sock', mountPath: '/var/run' }],
+                                resources: {
+                                    requests: { memory: '512Mi', cpu: '250m' },
+                                    limits: { memory: '4Gi', cpu: '2' },
+                                },
+                            },
+                        ],
+                    },
+                },
+            },
+        }));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources_ });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AA0IA,0BAoYC;AA9gBD,oCAAqD;AACrD,iDAAgE;AAChE,0CASqB;AAuFrB,6DAA6D;AAC7D,MAAM,qBAAqB,GAAG;IAC5B,sEAAsE;CACvE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAgB,OAAO,CAAC,KAAmB;IACzC,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAG,IAAI,EACd,IAAI,EACJ,OAAO,GAAG,MAAM,EAChB,MAAM,GAAG,YAAY,EACrB,WAAW,GAAG,CAAC,EACf,SAAS,GAAG,MAAM,EAClB,cAAc,EACd,MAAM,EACN,GAAG,EACH,OAAO,GAAG,IAAI,EACd,YAAY,GAAG,KAAK,EACpB,OAAO,GAAG,KAAK,EACf,qBAAqB,EACrB,mBAAmB,GAAG,EAAE,EACxB,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,IAAI,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,EACtE,GAAG,GAAG,EAAE,EACR,eAAe,GAChB,GAAG,KAAK,CAAA;IAET,MAAM,SAAS,GAAG,IAAA,uBAAY,EAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,IAAA,eAAK,GAAE,CAAA;IAClB,MAAM,UAAU,GAA6B,EAAE,CAAA;IAE/C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,gCAAgC;YAC9C,IAAI;YACJ,wEAAwE;YACxE,gCAAgC;YAChC,IAAI;YACJ,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,eAAe,GAAG,qBAAqB,IAAI,GAAG,IAAI,cAAc,CAAA;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,SAAS,EACT,IAAI,EACJ,6EAA6E,EAC7E;gBACE,QAAQ,EAAE,uBAAuB;gBACjC,YAAY,EAAE,GAAG,IAAI,cAAc;gBACnC,IAAI,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;aACzD,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;YAC9C,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;YACxD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CACH,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC7D,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,kDAAkD;YAChE,IAAI;YACJ,oEAAoE;YACpE,wHAAwH;YACxH,IAAI;YACJ,uDAAuD,CAC1D,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,EAAG,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,sFAAsF,CACvG,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,mEAAmE;YACjF,gGAAgG;YAChG,IAAI;YACJ,gEAAgE;YAChE,iEAAiE;YACjE,2CAA2C,CAC9C,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,CAAA;IACpC,qEAAqE;IACrE,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAEvF,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,KAAK,KAAK,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACvE,MAAM,UAAU,GAAG,GAAG,IAAI,SAAS,CAAA;IACnC,MAAM,iBAAiB,GAAG,UAAU,CAAC,2BAA2B,IAAI,GAAG,IAAI,sBAAsB,CAAA;IACjG,IAAI,cAAc,IAAI,CAAC,UAAU,CAAC,2BAA2B,EAAE,CAAC;QAC9D,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,CAAC,EAAE,CAAC;YACzC,MAAM,IAAA,8BAAoB,EACxB,SAAS,EACT,IAAI,EACJ,yGAAyG,EACzG;gBACE,QAAQ,EAAE,qCAAqC;gBAC/C,YAAY,EAAE,GAAG,IAAI,sBAAsB;gBAC3C,IAAI,EAAE,CAAC,oBAAoB,CAAC;aAC7B,CACF,CAAA;QACH,CAAC;QACD,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,sBAAY,EAAE;YAChB,IAAI,EAAE,GAAG,IAAI,sBAAsB;YACnC,SAAS;YACT,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,4BAA4B;YACxE,UAAU,EAAE,iBAAiB;YAC7B,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CACH,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,UAAU,GAAG,GAAG,KAAK,KAAK,CAAA;IAChC,MAAM,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACvC,MAAM,GAAG,GAA2B;QAClC,uBAAuB,EAAE,IAAI;QAC7B,yBAAyB,EAAE,WAAW,IAAI,EAAE;QAC5C,0BAA0B,EAAE,MAAM;QAClC,GAAG,CAAC,UAAU;YACZ,CAAC,CAAC;gBACE,2BAA2B,EAAE,IAAI;gBACjC,gCAAgC,EAAE,IAAI;gBACtC,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;aACrD;YACH,CAAC,CAAC,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC;QAC7C,0BAA0B,EAAE,UAAU;QACtC,uBAAuB,EAAE,GAAG,MAAM,OAAO,SAAS,yBAAyB;QAC3E,uBAAuB,EAAE,MAAM;QAC/B,uBAAuB,EAAE,MAAM;QAC/B,2BAA2B,EAAE,SAAS;QACtC,+BAA+B,EAAE,MAAM;QACvC,sCAAsC,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACvE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,KAAK,IAAI;YAClB,CAAC,CAAC;gBACE,oCAAoC,EAAE,OAAO;gBAC7C,sCAAsC,EAAE,aAAa;gBACrD,qCAAqC,EAAE,WAAW;gBAClD,gDAAgD,EAAE,EAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACrF,oCAAoC,EAAE,EAAG,CAAC,MAAM;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAA;IAED,MAAM,OAAO,GAAoD;QAC/D,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,EAAE,GAAG,EAAE,UAAU,EAAE;QAClF,6BAA6B,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE;QAC7E,iCAAiC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,EAAE;QACrF,GAAG,CAAC,UAAU;YACZ,CAAC,CAAC,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,IAAI;YAClB,CAAC,CAAC;gBACE,2CAA2C,EAAE;oBAC3C,MAAM,EAAE,EAAG,CAAC,iBAAkB;oBAC9B,GAAG,EAAE,eAAe;iBACrB;gBACD,+CAA+C,EAAE;oBAC/C,MAAM,EAAE,EAAG,CAAC,iBAAkB;oBAC9B,GAAG,EAAE,mBAAmB;iBACzB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IAED,gFAAgF;IAChF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,CAAA;QAC7E,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QACnF,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,uBAAuB,EAAE;YAC3B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE;YAC7C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,eAAe,CAAC;gBAC9B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;aAC3C;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,MAAM;QACZ,SAAS;QACT,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,MAAM,IAAI,IAAI;QACtB,eAAe;KAChB,CAAC,EACF,IAAA,UAAG,EAAC,oBAAU,EAAE;QACd,IAAI;QACJ,SAAS;QACT,KAAK,EAAE,gCAAgC,OAAO,EAAE;QAChD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;YAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;SACpC;QACD,GAAG;QACH,OAAO;QACP,OAAO,EAAE,OAAO;YACd,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,OAAO,EAAE,EAAE,CAAC;YAC1E,CAAC,CAAC,EAAE;QACN,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACnE,MAAM,EAAE;YACN,+DAA+D;YAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACzE,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;SAC3E;KACF,CAAC,EACF,IAAA,UAAG,EAAC,kBAAQ,EAAE;QACZ,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,SAAS;QACT,IAAI;QACJ,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,oDAAoD;YACpD,6CAA6C,EAAE,MAAM;YACrD,gDAAgD,EAAE,KAAK;YACvD,gDAAgD,EAAE,KAAK;YACvD,GAAG,mBAAmB;SACvB;QACD,GAAG;KACJ,CAAC,CACH,CAAA;IAED,gFAAgF;IAChF,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,SAAS,EAAE;YACb,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,MAAM;gBACnB,SAAS;gBACT,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACvB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aACnF;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,qFAAqF;IACrF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,IAAI,qBAAqB,CAAA;QAC/D,MAAM,YAAY,GAAG;YACnB,SAAS;YACT,yBAAyB;YACzB,eAAe;YACf,eAAe;YACf,WAAW;YACX,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAC1C,YAAY;YACZ,4CAA4C;YAC5C,qBAAqB;SACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEZ,UAAU,CAAC,IAAI,CACb,IAAA,UAAG,EAAC,WAAW,EAAE;YACf,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,SAAS,EAAE;YACtD,IAAI,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;SACtC,CAAC,EACF,IAAA,UAAG,EAAC,YAAY,EAAE;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;YACzC,IAAI,EAAE;gBACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;gBAClC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;gBAC9C,QAAQ,EAAE;oBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;oBACzC,IAAI,EAAE;wBACJ,+DAA+D;wBAC/D,8DAA8D;wBAC9D,4BAA4B,EAAE,KAAK;wBACnC,OAAO,EAAE;4BACP,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;4BAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,EAAE;4BAChE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE;yBACtC;wBACD,cAAc,EAAE;4BACd;gCACE,IAAI,EAAE,iBAAiB;gCACvB,KAAK,EAAE,mCAAmC,UAAU,CAAC,OAAO,IAAI,OAAO,EAAE;gCACzE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;gCACrB,IAAI,EAAE;oCACJ,yHAAyH;iCAC1H;gCACD,GAAG,EAAE;oCACH,wDAAwD;oCACxD,wDAAwD;oCACxD,sDAAsD;oCACtD;wCACE,IAAI,EAAE,cAAc;wCACpB,KAAK,EAAE,UAAU,IAAI,IAAI,SAAS,oBAAoB;qCACvD;oCACD;wCACE,IAAI,EAAE,aAAa;wCACnB,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;qCACxD;oCACD;wCACE,IAAI,EAAE,oBAAoB;wCAC1B,SAAS,EAAE;4CACT,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,EAAE;yCACrE;qCACF;iCACF;gCACD,UAAU,EAAE,SAAS;gCACrB,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;6BACzD;yBACF;wBACD,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,QAAQ;gCACd,KAAK,EAAE,mCAAmC,UAAU,CAAC,OAAO,IAAI,OAAO,EAAE;gCACzE,OAAO,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,4BAA4B,CAAC;gCAC/E,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;gCACpE,YAAY,EAAE;oCACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;oCACxC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE;oCAC/C,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE;iCAC/C;gCACD,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;oCAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;iCACpC;6BACF;4BACD;gCACE,IAAI,EAAE,MAAM;gCACZ,KAAK,EAAE,gBAAgB;gCACvB,yDAAyD;gCACzD,2DAA2D;gCAC3D,wDAAwD;gCACxD,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;gCACrB,IAAI,EAAE;oCACJ,wLAAwL;iCACzL;gCACD,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;gCAChD,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;gCACrC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;gCAC9D,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;oCAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;iCACpC;6BACF;yBACF;qBACF;iBACF;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@r8s/forgejo",
+  "version": "0.3.2",
+  "description": "Forgejo git forge \u2014 repos, PRs, Actions runners (forgejo-runner + dind), LFS on S3, CNPG persistence, SSH via LoadBalancer",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/berget-ai/r8s.git",
+    "directory": "packages/forgejo"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "keywords": [
+    "forgejo",
+    "git",
+    "ci",
+    "actions",
+    "lfs"
+  ],
+  "r8s": {
+    "category": "Developer Tools"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "category": "Developer Tools",
+  "dependencies": {
+    "@r8s/core": "^0.3.0",
+    "@r8s/crds": "^0.3.0",
+    "@r8s/k8s-types": "^0.3.0",
+    "@r8s/recipes": "^0.3.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  },
+  "files": [
+    "dist"
+  ]
+}