Episode 2: Forgejo Actions — runner, Docker sandbox, own registry, locked-down deploy

examples/deploy-hello-ops.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# The only thing the CI key is allowed to do. Argument comes from the CI job.
+set -eu
+TAG=$(printf "%s" "${SSH_ORIGINAL_COMMAND:-latest}" | tr -cd "a-f0-9")
+[ -n "$TAG" ] || TAG=latest
+IMAGE=git.example.com/youruser/hello-ops:$TAG
+docker pull "$IMAGE"
+docker rm -f hello-ops 2>/dev/null || true
+docker run -d --name hello-ops --restart unless-stopped \
+  --network selfhostedops-stack_proxy -e APP_VERSION="$TAG" "$IMAGE"
+echo "deployed $TAG"