Publish Packwiz site as immutable image

.gitea/README.md

@@ -43,6 +43,10 @@ https://mc.ahmza.com/playground/dev/pack.toml
 mc-modpacks/
 ├── .gitea/
 │   └── workflows/
+├── scripts/
+│   └── build-site.sh
+├── Dockerfile
+├── sws.toml
 ├── forever/
 │   ├── pack.toml
 │   ├── index.toml
@@ -168,6 +172,24 @@ Packwiz is responsible for modpack contents and side filtering.
 Pterodactyl is responsible for Java, server process management and resources.
 
 Kubernetes/SWS provides static hosting for the published Packwiz repositories.
+The publishing workflow runs [`scripts/build-site.sh`](../scripts/build-site.sh),
+which exports committed Git revisions into the documented URL layout, then
+builds the multi-architecture image
+`tea.ahmza.com/ahmza/mcpacks-site`.
+
+The workflow finally commits that image's immutable OCI digest to
+`apps/mcpacks/deployment.yaml` in the `ahmza/k8s-starter-pack` repository.
+Argo CD notices that commit and performs the rollout; the workflow does not
+hold Kubernetes credentials or change the cluster directly.
+
+The Gitea Actions repository secret `GITEATOKEN` must be able to:
+
+- push packages owned by `ahmza`
+- read and write `ahmza/k8s-starter-pack`
+
+The `latest` image tag exists only to bootstrap the first Argo CD sync and for
+human inspection. Normal rollouts use the exact content digest recorded in the
+GitOps manifest, making the running version auditable and rollback-friendly.
 
 ## Rollback
 

.gitea/workflows/deploy-dev.yml

@@ -1,4 +0,0 @@
-on:
-  push:
-    branches:
-      - main

.gitea/workflows/publish.yml

@@ -0,0 +1,137 @@
+name: Publish Packwiz site
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "forever-v*"
+
+# A branch push and release tag can happen close together. Serializing them
+# prevents two jobs from racing to update the GitOps deployment manifest.
+concurrency:
+  group: mcpacks-publish
+  cancel-in-progress: false
+
+env:
+  REGISTRY: tea.ahmza.com
+  IMAGE_NAME: ahmza/mcpacks-site
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Check out all pack history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch current main and release tags
+        # A tag-triggered checkout points HEAD at that tag. Fetching main
+        # explicitly ensures /dev still contains today's development branch.
+        run: git fetch origin main:refs/remotes/origin/main --tags --force
+
+      - name: Assemble static Packwiz site
+        env:
+          EVENT_REF: ${{ gitea.ref }}
+          EVENT_SHA: ${{ gitea.sha }}
+        run: |
+          chmod +x scripts/build-site.sh
+          # A branch job must publish exactly the commit that triggered it,
+          # even if a newer main commit arrives while this job is queued. A
+          # tag job uses current main for /dev while exporting the tag itself
+          # to /releases in scripts/build-site.sh.
+          case "$EVENT_REF" in
+            refs/tags/*) dev_ref=origin/main ;;
+            *)           dev_ref=$EVENT_SHA ;;
+          esac
+          ./scripts/build-site.sh "$dev_ref"
+          test -s .build/site/forever/dev/pack.toml
+
+      - name: Verify tagged release output
+        if: startsWith(gitea.ref, 'refs/tags/')
+        env:
+          RELEASE_TAG: ${{ gitea.ref_name }}
+        run: |
+          version=${RELEASE_TAG#forever-}
+          test -s ".build/site/forever/releases/$version/pack.toml"
+          test -s .build/site/forever/stable/pack.toml
+
+      - name: Log in to Gitea Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.repository_owner }}
+          password: ${{ secrets.GITEATOKEN }}
+
+      # The SWS runtime image already publishes amd64 and arm64 variants and
+      # this Dockerfile has no target-architecture RUN commands, so Buildx can
+      # create both variants without slow QEMU emulation.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push immutable site image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          build-args: |
+            VCS_REF=${{ gitea.sha }}
+          # latest bootstraps the first deployment and is convenient for
+          # inspection. Kubernetes runs the immutable manifest digest emitted
+          # by this step, never this mutable tag.
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+
+      - name: Check out cluster GitOps repository
+        uses: actions/checkout@v4
+        with:
+          repository: ahmza/k8s-starter-pack
+          ref: main
+          token: ${{ secrets.GITEATOKEN }}
+          path: _gitops
+
+      - name: Record the deployed image in Git
+        env:
+          # A digest identifies the actual multi-architecture image contents.
+          # This changes for a release build even when its tag points at the
+          # same Git commit previously built by the main-branch workflow.
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
+        run: |
+          python3 - "$IMAGE" <<'PY'
+          from pathlib import Path
+          import sys
+
+          manifest = Path("_gitops/apps/mcpacks/deployment.yaml")
+          image = sys.argv[1]
+          prefix = "          image: "
+          repository = "tea.ahmza.com/ahmza/mcpacks-site"
+          lines = manifest.read_text().splitlines()
+          matches = [
+              i for i, line in enumerate(lines)
+              if line.startswith(prefix + repository)
+          ]
+          if len(matches) != 1:
+              raise SystemExit(f"expected one mcpacks image line, found {len(matches)}")
+          lines[matches[0]] = f"{prefix}{image}"
+          manifest.write_text("\n".join(lines) + "\n")
+          PY
+
+          cd _gitops
+          if git diff --quiet -- apps/mcpacks/deployment.yaml; then
+            echo "GitOps manifest already references $IMAGE"
+            exit 0
+          fi
+          git config user.name "gitea-actions[bot]"
+          git config user.email "gitea-actions[bot]@tea.ahmza.com"
+          git add apps/mcpacks/deployment.yaml
+          git commit -m "Deploy mcpacks ${GITEA_SHA}"
+          git push origin HEAD:main

.gitea/workflows/release.yml

@@ -1,4 +0,0 @@
-on:
-  push:
-    tags:
-      - "forever-v*"