MokoConsulting/MokoGitea-Fork
1
0
Fork 0
Code Issues 133 Pull Requests 1 Releases 96 Wiki Activity

fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy #737

Merged
jmiller merged 1 commits from fix/deploy-dev-var-expansion into dev 2026-07-05 06:15:11 +00:00
Conversation 0 Commits 1 Files Changed 1
+23 -13
jmiller commented 2026-07-05 06:09:01 +00:00
Owner
Copy Link
Copy Source

Problem

The dev deploy (custom/deploy-dev.yml) has never succeeded — every run fails at the Docker build with:

ERROR: failed to build: invalid tag "git.mokoconsulting.tech/mokoconsulting/mokogitea:": invalid reference format

This blocked the runtime-validation gate for the org-governance release (#733): the migrations and server boot never got exercised because the image never built.

Root cause

The build/deploy step used an unquoted SSH heredoc (<<DEPLOY_EOF) and referenced runner-side values as \$TAG / \$REGISTRY_TOKEN. The backslash defers expansion to the remote shell — but those variables only exist on the runner (the step's env:). On the remote side they're unset, so the tag collapsed to mokogitea: (empty) → invalid reference format. REGISTRY_TOKEN had the same defect (remote docker login would have received the literal string $REGISTRY_TOKEN), and HEALTH_FMT was defined on the runner but referenced remotely.

This was not caused by the org-governance code — that compiles and vets clean locally (go build ./... clean, go vet clean on 380 packages).

Fix

  • Inject the two runner-side values as an env prefix on the ssh command: TAG='...' REGISTRY_TOKEN='...' bash -s.
  • Switch to a quoted heredoc (<<'DEPLOY_EOF') so every $var in the script expands in exactly one place — the remote host. Removes the fragile local/remote expansion mix that caused the bug.
  • Move HEALTH_FMT into the remote script body.
  • Add an explicit empty-TAG guard so any future regression fails loudly with a clear message instead of building an untagged image.

Actions ${{ env.* }} expressions are unaffected (templated before bash runs, independent of heredoc quoting).

Validation

  • YAML parses cleanly; no trailing whitespace.
  • Once merged to dev, the push auto-triggers deploy-dev.yml — this is the real runtime gate for #733 (image builds, migrations 362–366 apply, container reports healthy).

https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

## Problem The dev deploy (`custom/deploy-dev.yml`) has **never succeeded** — every run fails at the Docker build with: ``` ERROR: failed to build: invalid tag "git.mokoconsulting.tech/mokoconsulting/mokogitea:": invalid reference format ``` This blocked the runtime-validation gate for the org-governance release (#733): the migrations and server boot never got exercised because the image never built. ### Root cause The build/deploy step used an **unquoted** SSH heredoc (`<<DEPLOY_EOF`) and referenced runner-side values as `\$TAG` / `\$REGISTRY_TOKEN`. The backslash *defers* expansion to the **remote** shell — but those variables only exist on the runner (the step's `env:`). On the remote side they're unset, so the tag collapsed to `mokogitea:` (empty) → invalid reference format. `REGISTRY_TOKEN` had the same defect (remote `docker login` would have received the literal string `$REGISTRY_TOKEN`), and `HEALTH_FMT` was defined on the runner but referenced remotely. This was **not** caused by the org-governance code — that compiles and vets clean locally (`go build ./...` clean, `go vet` clean on 380 packages). ## Fix - Inject the two runner-side values as an **env prefix on the ssh command**: `TAG='...' REGISTRY_TOKEN='...' bash -s`. - Switch to a **quoted** heredoc (`<<'DEPLOY_EOF'`) so every `$var` in the script expands in exactly one place — the remote host. Removes the fragile local/remote expansion mix that caused the bug. - Move `HEALTH_FMT` into the remote script body. - Add an explicit **empty-TAG guard** so any future regression fails loudly with a clear message instead of building an untagged image. Actions `${{ env.* }}` expressions are unaffected (templated before bash runs, independent of heredoc quoting). ## Validation - YAML parses cleanly; no trailing whitespace. - Once merged to `dev`, the push auto-triggers `deploy-dev.yml` — this is the real runtime gate for #733 (image builds, migrations 362–366 apply, container reports healthy). https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT
jmiller added 1 commit 2026-07-05 06:09:04 +00:00
fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy
Universal: PR Check / Branch Policy (pull_request) Successful in 2s
Details
PR RC Release / Build RC Release (pull_request) Successful in 3s
Details
Universal: PR Check / Validate PR (pull_request) Successful in 12s
Details
Generic: Project CI / Lint & Validate (pull_request) Successful in 37s
Details
Universal: Pre-Release / Build Pre-Release (${{ inputs.stability || github.ref_name }}) (push) Successful in 1m7s
Details
Universal: PR Check / Secret Scan (pull_request) Successful in 1m12s
Details
RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped
Details
Branch Cleanup / Delete merged branch (pull_request) Successful in 1s
Details
Generic: Project CI / Tests (pull_request) Has been cancelled
Details
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Details
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Details
3917bf6a29 
The dev deploy step used an unquoted SSH heredoc and referenced
runner-side values as \$TAG / \$REGISTRY_TOKEN, deferring their
expansion to the remote shell where those names are unset. The
Docker build tag collapsed to "mokogitea:" and every dev deploy
failed with `invalid tag ... invalid reference format` before any
migration or server boot could run.

Inject TAG and REGISTRY_TOKEN as an env prefix on the ssh command
(`TAG='...' REGISTRY_TOKEN='...' bash -s`) and switch to a quoted
heredoc so every $var expands in exactly one place: the remote host.
Also fixes HEALTH_FMT (was defined on the runner but referenced
remotely) and adds an explicit empty-TAG guard so a future
regression fails loudly instead of building an untagged image.

Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT
jmiller merged commit 2713c49aec into dev 2026-07-05 06:15:11 +00:00
jmiller deleted branch fix/deploy-dev-var-expansion 2026-07-05 06:15:12 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
breaking-change
Breaking API or behavior change
 ci-cd
CI/CD pipeline changes
 config
Configuration changes
 dependencies
Dependency updates
 deploy-failure
Deployment failed
 docker
Docker/container changes
 documentation
Documentation changes
 feature: wiki
Wiki system enhancements
 good first issue
Good for newcomers
 health-check
Repo health check result
 help wanted
Extra attention needed
 mokostandards
Related to MokoStandards framework
 push-failure
Git push operation failed
 security
Security vulnerability or hardening
 size/l
200-500 lines changed
 size/m
50-200 lines changed
 size/s
10-50 lines changed
 size/xl
500+ lines changed
 size/xs
< 10 lines changed
 standards-drift
Deviates from MokoStandards
 standards-update
MokoStandards compliance update
 sync-failure
Sync or mirror failed
 tech-debt
Technical debt and TODO/FIXME items
 upstream
upstream
Inherited from upstream Gitea
 work-in-progress
Draft or incomplete work
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels
Priority -
Type -
Milestone
No items
No Milestone
Assignees
Clear assignees
jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#737
Delete Branch "fix/deploy-dev-var-expansion"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?