ci: add Forgejo build and deployment workflows

.forgejo/workflows/ci-cd.yaml

@@ -0,0 +1,101 @@
+name: Build, test, publish, deploy
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.27.1"
+  NODE_VERSION: "24"
+  REGISTRY: nexus.urpi.be
+  IMAGE_NAME: docker-hosted/go-bananas
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: |
+            web/package-lock.json
+            sdk/package-lock.json
+      - name: Build and test Go server
+        run: |
+          go vet ./...
+          make test-go
+          make build-go
+      - name: Build and test admin UI
+        run: |
+          npm ci --no-audit --no-fund
+          npm run lint
+          npm test
+          npm run build
+        working-directory: web
+      - name: Build and test SDK
+        run: |
+          npm ci --no-audit --no-fund
+          npm run typecheck
+          npm test
+          npm run build
+        working-directory: sdk
+      - uses: azure/setup-helm@v4
+        with:
+          version: v3.18.6
+      - name: Validate production chart
+        run: helm lint --strict deploy/helm/go-bananas -f deploy/helm/go-bananas/values-prd.yaml
+
+  publish:
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+    needs: build-test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.NEXUS_USERNAME }}
+          password: ${{ secrets.NEXUS_PASSWORD }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+
+  deploy-prd:
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4
+        with:
+          version: v3.18.6
+      - uses: azure/setup-kubectl@v4
+        with:
+          version: v1.32.2
+      - name: Bootstrap resources and deploy go-bananas
+        env:
+          KUBECONFIG_PRD: ${{ secrets.KUBECONFIG_PRD }}
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+          GO_BANANAS_OIDC_CLIENT_SECRET: ${{ secrets.GO_BANANAS_OIDC_CLIENT_SECRET }}
+        run: |
+          set -Eeuo pipefail
+          : "${GO_BANANAS_OIDC_CLIENT_SECRET:?Add Forgejo secret GO_BANANAS_OIDC_CLIENT_SECRET}"
+          bash .forgejo/scripts/deploy-prd.sh deploy/helm/go-bananas go-bananas go-bananas "${{ github.sha }}" \
+            --set-string identity.oidc.issuer=https://auth.urpi.be/realms/urpi \
+            --set-string identity.oidc.clientId=go-bananas \
+            --set-string identity.oidc.existingSecret=go-bananas-auth \
+            --set identity.oidc.generateSecret=false