- deploy.yml: on push to main, builds linux/arm64 image, pushes to
Gitea registry, deploys via SSH kubectl set image
- ci.yml: gate to PRs targeting main only
- finance-api deployment: imagePullPolicy Always so SHA-tagged images
are always pulled on rollout
Requires GitHub Actions secrets: GITEA_REGISTRY_PASSWORD, VPS_HOST,
VPS_USER, VPS_SSH_KEY.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub Actions now only runs tests (free, cloud runners, no setup).
Deployment is manual via `make deploy-finance` / `make deploy-all`
which builds locally, imports into k3d, and applies with kubectl.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes all ghcr.io and registry dependencies. Workflows now build
images locally, import them into k3d, and deploy with kubectl set image
— all on the self-hosted runner which already has Docker and kubectl.
Also removes the github Terraform provider and ci.tf since no registry
pull secrets or GitHub Actions secrets are needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three path-filtered workflows (finance-api, auth-users, auth-gateway)
each build, push to ghcr.io, and rollout to k3s on push to main.
Deployment manifests updated from local image refs to ghcr.io with
imagePullSecrets referencing a ghcr-credentials k8s secret.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
