commit 46bcafb9cbce26890c4dcdcc7b87ccb2eb4c42c2
Author: Noah Holt <noahryanholt@gmail.com>
Date:   Mon Aug 10 21:44:21 2026 -0500

    Initial commit

diff --git a/.forgejo/workflows/build-and-deploy.yaml b/.forgejo/workflows/build-and-deploy.yaml
new file mode 100644
index 0000000..fa417f4
--- /dev/null
+++ b/.forgejo/workflows/build-and-deploy.yaml
@@ -0,0 +1,88 @@
+# Reusable, language-agnostic build->push->deploy workflow. The app's
+# Dockerfile owns the toolchain; this only needs docker + git + kustomize,
+# which the `host` runner label provides (see the homelab repo's
+# nixos/hosts/forgejo/default.nix hostPackages).
+#
+# Consumers:
+#   jobs:
+#     deploy:
+#       uses: nholtware/workflows/.forgejo/workflows/build-and-deploy.yaml@main
+#       with: { app-name: my-app }
+#       secrets: inherit
+#
+# Required Actions secrets (set once at user/org level):
+#   REGISTRY_USER / REGISTRY_TOKEN  -- Forgejo PAT with write:package
+#   GITOPS_TOKEN                    -- Forgejo PAT with write access to the gitops repo
+on:
+  workflow_call:
+    inputs:
+      app-name:
+        required: true
+        type: string
+      context:
+        required: false
+        type: string
+        default: "."
+      dockerfile:
+        required: false
+        type: string
+        default: "Dockerfile"
+      gitops-repo:
+        required: false
+        type: string
+        default: "nholtware/gitops"
+    secrets:
+      REGISTRY_USER:
+        required: true
+      REGISTRY_TOKEN:
+        required: true
+      GITOPS_TOKEN:
+        required: true
+
+env:
+  # Terraform-pinned static IP of the forgejo host; containerd on the k3s
+  # nodes trusts exactly this registry string (nixos/modules/k3s-registries.nix).
+  REGISTRY: 192.168.1.230:3000
+
+jobs:
+  build-push:
+    runs-on: host
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to Forgejo registry
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+      - name: Build and push image
+        run: |
+          TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
+          IMAGE="$REGISTRY/${{ github.repository_owner }}/${{ inputs.app-name }}"
+          docker build -f "${{ inputs.dockerfile }}" \
+            --build-arg GIT_SHA="$TAG" \
+            -t "$IMAGE:$TAG" -t "$IMAGE:latest" "${{ inputs.context }}"
+          docker push "$IMAGE:$TAG"
+          docker push "$IMAGE:latest"
+
+  bump-gitops:
+    needs: build-push
+    runs-on: host
+    steps:
+      - name: Update image tag in gitops repo
+        env:
+          GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }}
+        run: |
+          TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
+          IMAGE="$REGISTRY/${{ github.repository_owner }}/${{ inputs.app-name }}"
+          rm -rf gitops
+          git clone "http://ci-bot:${GITOPS_TOKEN}@192.168.1.230:3000/${{ inputs.gitops-repo }}.git" gitops
+          cd "gitops/manifests/${{ inputs.app-name }}"
+          kustomize edit set image "${{ inputs.app-name }}=$IMAGE:$TAG"
+          cd ../..
+          git config user.name "ci-bot"
+          git config user.email "ci-bot@forgejo.local"
+          git add -A
+          git commit -m "${{ inputs.app-name }}: deploy $TAG" || echo "no change to commit"
+          git push
diff --git a/.forgejo/workflows/node-checks.yaml b/.forgejo/workflows/node-checks.yaml
new file mode 100644
index 0000000..a00d810
--- /dev/null
+++ b/.forgejo/workflows/node-checks.yaml
@@ -0,0 +1,21 @@
+# Reusable Node/TypeScript checks: install, lint (if present), test (if
+# present). Runs in the docker-label container (node preinstalled).
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        required: false
+        type: string
+        default: "22"
+
+jobs:
+  checks:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version }}
+      - run: npm ci
+      - run: npm run lint --if-present
+      - run: npm test --if-present
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..fc7b09a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,13 @@
+# workflows
+
+Reusable Forgejo Actions workflows for the homelab pipeline.
+
+- `build-and-deploy.yaml` — language-agnostic: docker build -> push to the
+  Forgejo registry (`192.168.1.230:3000`) -> bump the image tag in
+  `nholtware/gitops` (ArgoCD takes it from there). Inputs: `app-name`
+  (required), `context`, `dockerfile`, `gitops-repo`.
+- `node-checks.yaml` — optional TypeScript/Node checks: `npm ci`, lint,
+  test (each `--if-present`).
+
+Secrets expected (user/org-level Actions secrets): `REGISTRY_USER`,
+`REGISTRY_TOKEN` (write:package), `GITOPS_TOKEN` (write to gitops repo).