From 6dc04de222eb7e1b6ba2d8cdc5e27fac802f6772 Mon Sep 17 00:00:00 2001
From: Amir Husayn Panahifar <ahp@panahifar.ir>
Date: Sun, 18 Oct 2026 16:27:58 +0330
Subject: [PATCH] ci: gitea actions build/push + argocd registry repoint

---
 .gitea/workflows/build-and-push.yaml  | 62 +++++++++++++++++++++++++++
 deploy/helm/pargar/values-apollo.yaml |  7 +--
 deploy/helm/pargar/values-prod.yaml   | 13 +++---
 3 files changed, 73 insertions(+), 9 deletions(-)
 create mode 100644 .gitea/workflows/build-and-push.yaml

diff --git a/.gitea/workflows/build-and-push.yaml b/.gitea/workflows/build-and-push.yaml
new file mode 100644
index 0000000..482df3d
--- /dev/null
+++ b/.gitea/workflows/build-and-push.yaml
@@ -0,0 +1,62 @@
+name: build-and-push
+
+# On a version tag push (v*), build both images and publish them to the
+# Gitea container registry. Argo CD then rolls them out via
+# deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
+#
+# Requires a registered Gitea Actions runner and `permissions.packages: write`
+# so the built-in job token (secrets.GITEA_TOKEN) can push to the registry.
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: src.panahifar.ir
+  BACKEND_IMAGE: ahp/pargar-backend
+  FRONTEND_IMAGE: ahp/pargar-frontend
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Image tag (strip leading v)
+        id: meta
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITEA_TOKEN }}
+
+      - name: Build and push backend
+        uses: docker/build-push-action@v6
+        with:
+          context: ./backend
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:${{ steps.meta.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.BACKEND_IMAGE }}:latest
+
+      - name: Build and push frontend
+        uses: docker/build-push-action@v6
+        with:
+          context: ./frontend
+          push: true
+          # Empty = same-origin API/WS through the Traefik reverse proxy
+          # (the production topology). Override via repo variables if needed.
+          build-args: |
+            NEXT_PUBLIC_API_URL=${{ vars.NEXT_PUBLIC_API_URL }}
+            NEXT_PUBLIC_WS_URL=${{ vars.NEXT_PUBLIC_WS_URL }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:${{ steps.meta.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.FRONTEND_IMAGE }}:latest
diff --git a/deploy/helm/pargar/values-apollo.yaml b/deploy/helm/pargar/values-apollo.yaml
index 9f9b2de..bc99dfb 100644
--- a/deploy/helm/pargar/values-apollo.yaml
+++ b/deploy/helm/pargar/values-apollo.yaml
@@ -11,7 +11,7 @@ backend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-backend
-    tag: 0.2.1
+    tag: 0.3.5
   metrics:
     serviceMonitor:
       enabled: true
@@ -41,7 +41,7 @@ frontend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-frontend
-    tag: 0.2.1
+    tag: 0.3.5
   podDisruptionBudget:
     enabled: false
   replicaCount: 2
@@ -55,7 +55,8 @@ frontend:
 global:
   domain: pargar.panahifar.ir
   frontendOrigins: https://pargar.panahifar.ir
-  imageRegistry: ""
+  # Images published by .gitea/workflows/build-and-push.yaml on tag push.
+  imageRegistry: src.panahifar.ir/ahp
   publicUrl: https://pargar.panahifar.ir
 imagePullSecrets: []
 ingress:
diff --git a/deploy/helm/pargar/values-prod.yaml b/deploy/helm/pargar/values-prod.yaml
index b38efc4..686937e 100644
--- a/deploy/helm/pargar/values-prod.yaml
+++ b/deploy/helm/pargar/values-prod.yaml
@@ -3,25 +3,26 @@
 #     -f deploy/helm/pargar/values-prod.yaml
 #
 # Prerequisites:
-#   - images pushed to ghcr.io/pargar/{backend,frontend}:<tag>
+#   - images pushed to src.panahifar.ir/ahp/{pargar-backend,pargar-frontend}:<tag>
+#     (by .gitea/workflows/build-and-push.yaml on a v* tag push)
 #   - Secret pargar-app (jwt-secret, admin-password, metrics-token, database-url, redis-url,
 #     storage-access-key, storage-secret-key)
 #   - cert-manager ClusterIssuer letsencrypt-prod
-#   - imagePullSecrets if the registry is private
+#   - imagePullSecrets if the Gitea package registry visibility is private
 
 global:
   domain: app.example.com
   publicUrl: https://app.example.com
   frontendOrigins: "https://app.example.com"
-  imageRegistry: ghcr.io/pargar
+  imageRegistry: src.panahifar.ir/ahp
 
 imagePullSecrets:
-  - name: ghcr-pull
+  - name: gitea-pull
 
 backend:
   replicaCount: 2
   image:
-    repository: backend
+    repository: pargar-backend
     tag: "0.2.1"
     pullPolicy: IfNotPresent
   existingSecret: pargar-app
@@ -48,7 +49,7 @@ backend:
 frontend:
   replicaCount: 2
   image:
-    repository: frontend
+    repository: pargar-frontend
     tag: "0.2.1"
     pullPolicy: IfNotPresent
   resources: