initial scaffold

.forgejo/workflows/build-hello-app.yml

@@ -0,0 +1,40 @@
+name: build-hello-app
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/hello-app/src/**"
+
+jobs:
+  build-and-push:
+    runs-on: docker
+    # kaniko builds the image itself with no daemon and no special host
+    # privileges, so the runner host only ever needs a rootless Podman
+    # socket to launch this container — never docker.sock, never sudo.
+    container:
+      image: gcr.io/kaniko-project/executor:debug
+      options: --entrypoint ""
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Write registry auth
+        run: |
+          mkdir -p /kaniko/.docker
+          AUTH=$(printf '%s:%s' "${{ vars.FORGEJO_USER }}" "${{ secrets.FORGEJO_TOKEN }}" | base64 -w0)
+          printf '{"auths":{"git.boglabob.com":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+
+      - name: Inject build info
+        run: |
+          SHORT_SHA="${GITHUB_SHA::7}"
+          BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          sed -i "s/__GIT_SHA__/$SHORT_SHA/; s/__BUILD_TIME__/$BUILD_TIME/" apps/hello-app/src/index.html
+
+      - name: Build and push
+        run: |
+          TAG="main-${GITHUB_SHA::7}-$(date +%s)"
+          /kaniko/executor \
+            --context="${{ github.workspace }}/apps/hello-app/src" \
+            --dockerfile="${{ github.workspace }}/apps/hello-app/src/Dockerfile" \
+            --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:$TAG" \
+            --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:latest"

.forgejo/workflows/terraform.yml

@@ -0,0 +1,35 @@
+name: terraform
+
+on:
+  pull_request:
+    paths:
+      - "terraform/**"
+  push:
+    branches: [main]
+    paths:
+      - "terraform/**"
+
+jobs:
+  validate:
+    runs-on: docker
+    container:
+      image: ghcr.io/opentofu/opentofu:1.8
+    defaults:
+      run:
+        working-directory: terraform
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: tofu fmt
+        run: tofu fmt -check -recursive
+
+      - name: tofu init
+        run: tofu init -backend=false
+
+      - name: tofu validate
+        run: tofu validate
+
+      # No `tofu plan` here: the libvirt provider needs to reach the T630's
+      # libvirt socket, which this ephemeral job container doesn't have
+      # access to. Real applies happen from the T630 itself as the `k8s`
+      # user (docs/SETUP.md step 5) - fmt/validate is what CI checks.