pikasTech-unidesk/.agents/skills/unidesk-cicd/references/gitea-pac.md

Gitea + Pipelines-as-Code

Gitea/Pipelines-as-Code migrated CI/CD uses one formal path:

GitHub PR merge -> GitHub webhook bridge -> Gitea controlled mirror and immutable snapshot refs -> Gitea Repository webhook -> Pipelines-as-Code -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime

GitHub remains the upstream write authority. A delivery should be triggered by merging the GitHub PR into the consumer's YAML-declared source branch, then observing the target node's Gitea mirror, PaC, Tekton, GitOps, Argo and runtime status. Do not replace this with Gitea Actions, act_runner, branch-follower, host worktree, direct GitHub-in-Pipeline, direct Gitea pushes, manual PipelineRun creation, trigger-current, webhook-test, or custom script fallback. Gitea Actions material under config/cicd-gitea-actions-poc.yaml is archived read-only POC context only; webhook-test is only a connectivity diagnostic.

Source Of Truth

• Gitea source authority, GitHub webhook bridge, public exposure and source snapshots: config/platform-infra/gitea.yaml.
• PaC controller, Repository CRs, consumer parameters, Tekton pipeline names and Argo applications: config/platform-infra/pipelines-as-code.yaml.
• Historical snapshot prefixes containing gitea-actions are retained only for existing refs. They do not mean Gitea Actions is the active trigger architecture.
• Node-level status for these consumers is bun scripts/cli.ts cicd status --node <NODE>. Consumer drill-down is platform-infra pipelines-as-code status|history|closeout --target <NODE> --consumer <id>.
• Multi-node PaC consumers that share a GitHub upstream must not share a webhook bridge URL. Each target node declares its own GitHub webhook public path and FRP remote port in config/platform-infra/gitea.yaml#targets[].webhookSync, then platform-infra gitea apply --target <NODE> --confirm renders the node-local bridge, FRPC proxy and PK01 Caddy path.

Coverage Matrix

Consumer	Source	PaC namespace	Pipeline	Argo application	Status
agentrun-jd01-v02	pikasTech/agentrun@v0.2	agentrun-ci	agentrun-jd01-v02-ci-image-publish	agentrun-jd01-v02	platform-infra pipelines-as-code closeout --target JD01 --consumer agentrun-jd01-v02 --source-commit <sha> --wait
sentinel-jd01-v03	pikasTech/unidesk@master	devops-infra	hwlab-web-probe-sentinel-jd01-pac	hwlab-web-probe-sentinel-jd01	platform-infra pipelines-as-code closeout --target JD01 --consumer sentinel-jd01-v03 --source-commit <sha> --wait
hwlab-jd01-v03	pikasTech/HWLAB@v0.3	hwlab-ci	hwlab-jd01-v03-ci-image-publish	hwlab-node-v03	platform-infra pipelines-as-code closeout --target JD01 --consumer hwlab-jd01-v03 --source-commit <sha> --wait
agentrun-nc01-v02	pikasTech/agentrun@v0.2	agentrun-ci	agentrun-nc01-v02-ci-image-publish	agentrun-nc01-v02	platform-infra pipelines-as-code closeout --target NC01 --consumer agentrun-nc01-v02 --source-commit <sha> --wait
sentinel-nc01-v03	pikasTech/unidesk@master	devops-infra	hwlab-web-probe-sentinel-nc01-pac	hwlab-web-probe-sentinel-nc01	platform-infra pipelines-as-code closeout --target NC01 --consumer sentinel-nc01-v03 --source-commit <sha> --wait
hwlab-nc01-v03	pikasTech/HWLAB@v0.3	hwlab-ci	hwlab-nc01-v03-ci-image-publish	hwlab-node-v03	platform-infra pipelines-as-code closeout --target NC01 --consumer hwlab-nc01-v03 --source-commit <sha> --wait

Use bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --limit 10 for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on the target node, aggregate on the target side, and print READ_ERRORS.

Closeout Order

1. bun scripts/cli.ts platform-infra gitea mirror status --target <NODE>
2. bun scripts/cli.ts platform-infra gitea mirror webhook status --target <NODE>
3. bun scripts/cli.ts platform-infra pipelines-as-code closeout --target <NODE> --consumer <id> --source-commit <sha> --wait
4. bun scripts/cli.ts platform-infra pipelines-as-code status --target <NODE> --consumer <id>
5. bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --consumer <id> --limit 10
6. For ambiguous rows, drill into the PipelineRun with bun scripts/cli.ts platform-infra pipelines-as-code history --target <NODE> --id <pipelinerun>.

closeout is the common formal entry for all migrated JD01 consumers. It waits only for PaC/Tekton/GitOps/Argo/runtime observation from live target-side summaries and does not trigger legacy publish paths. Consumer-specific debug commands such as Web sentinel publish-current are recovery/test steps only and must not be shown as the normal next action for formal delivery.

Do not use cicd branch-follower status to decide whether the three migrated JD01 consumers are current. It is historical/migration-only and may contain stale state from before PaC cutover.

For migrated sentinel CI/CD half-state triage, the PaC status command owns the source/registry/GitOps/Argo/runtime diagnosis. It must classify registry-missing, GitOps-missing, Argo-pending and runtime-mismatch states from target-side short probes, using YAML-declared probe endpoints such as registry_probe_base; do not reintroduce old control-plane status as the primary architecture or use registry manifest HEAD as the readiness check.

Reuse Interpretation

• AgentRun IMAGE_STATUS=reused means the image build was skipped or registry artifact was reused for the same env identity.
• Sentinel ENV_REUSE=hit means dependency reuse was available; cache=hit is separate BuildKit evidence.
• HWLAB skipped,skip=<n> means service-level artifact planning skipped reusable builds; inspect the PipelineRun detail when deciding which service changed.

Missing reuse text is not proof of a failed reuse path. Check the consumer type and PipelineRun detail first.