From 22ae3b05a0996938a6d9188f082ff025e32b3225 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gr=C3=A9goire=20Mureau?= <gregoire.mureau+pro@etik.com>
Date: Wed, 9 Sep 2026 18:14:11 +0200
Subject: [PATCH] Ajouter le job CD P7 : build/push vers le registry OCI
 Forgejo.

Le job ne tourne que sur git.gregoiremureau.com. Pas de cut-over k3s : la prod reste sur Docker Hub.
---
 .github/workflows/cd.yml | 62 ++++++++++++++++++++++++++++++++++++++++
 .github/workflows/ci.yml |  2 +-
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/cd.yml

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
new file mode 100644
index 0000000..4fdb713
--- /dev/null
+++ b/.github/workflows/cd.yml
@@ -0,0 +1,62 @@
+# CD — build/push image vers le registry OCI Forgejo (pilote Phase 6).
+# Même syntaxe GitHub/Forgejo. Le job Docker ne tourne que sur Forgejo
+# (le miroir GitHub n'existe pas encore ; Docker Hub = job ultérieur).
+#
+# Image job = node:22-bookworm. DinD = sidecar 8 Gio (MPC-ADR-052).
+# Push via Tailscale (hostAlias git.gregoiremureau.com → NAS),
+# pas Cloudflare (limite body 100 Mo).
+
+name: CD
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "deployment/api/**"
+      - ".github/workflows/cd.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    if: contains(github.server_url, 'gregoiremureau.com')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker CLI (client only) + daemon DinD
+        run: |
+          set -eu
+          apt-get update
+          apt-get install -y --no-install-recommends ca-certificates curl
+          curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
+            | tar -xz -C /tmp
+          install /tmp/docker/docker /usr/local/bin/docker
+          docker version
+          docker info
+
+      - name: Login registry Forgejo
+        run: |
+          set -eu
+          REGISTRY="${GITHUB_SERVER_URL#https://}"
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login "${REGISTRY}" -u "${GITHUB_ACTOR}" --password-stdin
+
+      - name: Build and push
+        run: |
+          set -eu
+          REGISTRY="${GITHUB_SERVER_URL#https://}"
+          IMAGE="${REGISTRY}/grgmro/oc-p07-sentiment-api"
+          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
+          export DOCKER_BUILDKIT=1
+          docker build \
+            -t "${IMAGE}:${SHORT_SHA}" \
+            -t "${IMAGE}:latest" \
+            -f deployment/api/Dockerfile \
+            deployment/api
+          docker push "${IMAGE}:${SHORT_SHA}"
+          docker push "${IMAGE}:latest"
+          echo "pushed ${IMAGE}:${SHORT_SHA} and :latest"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e84e2d6..eca4a24 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,4 +27,4 @@ jobs:
 
   # test_main.py charge TensorFlow + artefacts MLflow (prod). Pas dans ce job :
   # trop lourd pour le runner (DinD 8 Gio) et exige des secrets MLflow.
-  # Build/push image : Phase 6 (dual registry), après secrets Forgejo.
+  # Build/push image : .github/workflows/cd.yml (registry Forgejo, pas de cut-over k3s).