From 4f4d9e44fcf03ef2158c7e8961575feb4f7ba293 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Tue, 5 May 2026 10:22:31 -0500
Subject: [PATCH] chore(ci): host prop-base on codeberg.org

Move the runtime base image from git.mcintire.me/graham/prop-base
to codeberg.org/gmcintire/prop-base. The shared REGISTRY_USER /
REGISTRY_PASSWORD secrets are pointed at Codeberg credentials;
the build-base workflow hardcodes env.REGISTRY=codeberg.org so it
can't accidentally push to a different registry if the URL secret
drifts.

The main app + prop-grid-rs builds still pull this base via the
BASE_IMAGE arg in Dockerfile, now codeberg.org/gmcintire/prop-base:latest.
---
 .forgejo/workflows/build-base.yaml | 19 +++++++++++++++----
 Dockerfile                         |  4 ++--
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/build-base.yaml b/.forgejo/workflows/build-base.yaml
index f7d39d4e..f66ab4d8 100644
--- a/.forgejo/workflows/build-base.yaml
+++ b/.forgejo/workflows/build-base.yaml
@@ -22,9 +22,14 @@ on:
     - cron: '0 6 * * 0'
   workflow_dispatch:
 
+# Base image lives on Codeberg's container registry. The shared
+# REGISTRY_USER / REGISTRY_PASSWORD secrets are set to Codeberg
+# credentials; the registry URL is hardcoded here rather than read
+# from secrets.REGISTRY_URL so the workflow can't accidentally push
+# to a different registry if that secret drifts.
 env:
-  REGISTRY: git.mcintire.me
-  IMAGE_NAME: graham/prop-base
+  REGISTRY: codeberg.org
+  IMAGE_NAME: gmcintire/prop-base
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -90,13 +95,19 @@ jobs:
           TAG="wgrib2-${WGRIB2}-g2c-${G2C}-${TIMESTAMP}"
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
-      - name: Log in to container registry
+      - name: Log in to Codeberg container registry
         run: |
+          # Reuses the shared REGISTRY_USER / REGISTRY_PASSWORD
+          # Forgejo Actions secrets — already set with Codeberg
+          # credentials (token must have `write:package` scope).
+          # Login URL is the hardcoded env.REGISTRY rather than
+          # secrets.REGISTRY_URL so this workflow can't accidentally
+          # push to whatever registry the URL secret points at.
           attempt=1
           max_attempts=3
           while : ; do
             if echo "${{ secrets.REGISTRY_PASSWORD }}" | \
-                docker login "${{ secrets.REGISTRY_URL }}" \
+                docker login "${{ env.REGISTRY }}" \
                   -u "${{ secrets.REGISTRY_USER }}" \
                   --password-stdin; then
               exit 0
diff --git a/Dockerfile b/Dockerfile
index 2455c528..d873c19d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,7 @@
 # This file is based on these images:
 #
 #   - https://hub.docker.com/r/hexpm/elixir/tags - for the build image
-#   - git.mcintire.me/graham/prop-base - prebuilt runtime base (see Dockerfile.base)
+#   - codeberg.org/gmcintire/prop-base - prebuilt runtime base (see Dockerfile.base)
 #   - Ex: docker.io/hexpm/elixir:1.19.5-erlang-28.4.1-debian-trixie-20260316-slim
 #
 ARG ELIXIR_VERSION=1.19.5
@@ -21,7 +21,7 @@ ARG BUILDER_IMAGE="docker.io/hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION
 # only when Dockerfile.base changes, so this Dockerfile pulls a
 # ready-made layer instead of recompiling wgrib2 + reinstalling cdo
 # (~10 min) on every push.
-ARG BASE_IMAGE="git.mcintire.me/graham/prop-base:latest"
+ARG BASE_IMAGE="codeberg.org/gmcintire/prop-base:latest"
 
 # ---- Elixir build stage ----
 FROM ${BUILDER_IMAGE} AS builder