Forgejo Runner Images

This repository is split into two independent image trees so they can later become separate repos and separate Docker images:

• java-runner/ for Java build workloads
• security-runner/ for Trivy and security workloads

The Forgejo Runner daemon is managed by your existing runner-registration script. This repo only provides the job images that the script will reference in runner labels, such as java-ci:docker://docker-hosted.nexus.ftmahringer.com/forgejo-runner-java:1.0.0.

For the CI workflow in .forgejo/workflows/build-and-push.yml, register an ubuntu label in your runner script that points at the immutable docker-hosted.nexus.ftmahringer.com/forgejo-runner-java:${VERSION} tag. That image contains the Docker CLI and Buildx tooling needed to build and push both images.

Build and push

Use your Nexus secrets:

The Forgejo workflow performs the Nexus login and push directly. If you build locally, use:

printf '%s' "$NEXUS_PASSWORD" | docker login docker-hosted.nexus.ftmahringer.com -u "$NEXUS_USERNAME" --password-stdin
version="$(< VERSION)"
revision="$(git rev-parse HEAD)"
docker buildx build --push \
  --build-arg RUNNER_VERSION="${version}" \
  --build-arg VCS_REF="${revision}" \
  -t "docker-hosted.nexus.ftmahringer.com/forgejo-runner-java:${version}" \
  -t docker-hosted.nexus.ftmahringer.com/forgejo-runner-java:latest \
  ./java-runner
docker buildx build --push \
  --build-arg RUNNER_VERSION="${version}" \
  --build-arg VCS_REF="${revision}" \
  -t "docker-hosted.nexus.ftmahringer.com/forgejo-runner-security:${version}" \
  -t docker-hosted.nexus.ftmahringer.com/forgejo-runner-security:latest \
  ./security-runner

Release and runner selection

VERSION is manually maintained. To publish a release, update and commit VERSION, then create and push the matching Git tag v${VERSION}. For example, VERSION=1.0.0 requires the release tag v1.0.0.

A matching v${VERSION} release publishes and retains its immutable ${VERSION} image tag while overwriting latest. Main and manual workflow runs also overwrite latest, so latest is always the most recent published image and is convenience-only. Runner labels must select the immutable ${VERSION} image tag that was published for the intended release, not latest.

The workflow uses the following Nexus targets:

• docker-hosted.nexus.ftmahringer.com/forgejo-runner-java
• docker-hosted.nexus.ftmahringer.com/forgejo-runner-security

Scope

• Build and publish the Java runner image
• Build and publish the Security runner image
• Keep the repository structure ready for later split into two repos