CI/CD Pipeline

iForge has a built-in complete CI/CD system, ready to use out of the box without external Runners.

Core Concepts

Concept	Description
Pipeline	A pipeline triggered by a push, containing multiple Jobs
Job	A task step in a pipeline
Runner	The engine that executes Jobs (built-in Docker Executor / external Runner)
Artifact	Output artifacts from a Job
Environment	Deployment environment (staging/production)
Cron	Pipelines triggered on a schedule

Configuration File

Add .iforge-ci.yml to the repository root directory:

stages:
  - test
  - build
  - deploy

test:
  stage: test
  image: golang:1.21
  script:
    - go test ./...
  only:
    - main
    - merge-requests

build:
  stage: build
  image: golang:1.21
  script:
    - go build -o iforge ./cmd/server
  artifacts:
    paths:
      - iforge

deploy:
  stage: deploy
  image: alpine:latest
  script:
    - echo "Deploying..."
  only:
    - main
  when: manual

Image must be specified

All CI/CD Jobs must specify the image field to ensure execution in isolated Docker containers. This ensures consistency of the execution environment and prevents direct execution of user code on the host.

Trigger Methods

• Push trigger: Automatically triggered when pushing to specified branches
• MR trigger: Triggered when creating/updating MRs
• Manual trigger: Manually trigger Jobs in the Pipeline details page
• Scheduled trigger: Configure Cron expressions for scheduled execution

Security Mechanisms

Docker Sandbox Isolation

All Jobs run in Docker containers by default, with the following security restrictions:

Restriction	Value	Description
--memory	2g	Memory limit 2GB
--memory-swap	2g	Prohibit swap usage
--cpus	2	CPU limit 2 cores
--pids-limit	256	Process limit
--network	none	Network access disabled by default

Shell Executor (Disabled by Default)

Security Warning

Shell Executor directly executes user code on the host, posing serious security risks. Production environments must keep it disabled.

To enable in the development environment (local debugging only):

IFORGE_CI_ALLOW_SHELL_EXECUTOR=true

Runner Permission Isolation

External Runners support three-level scope:

Scope	Description
Global Runner	Can execute Jobs for all users
User-level Runner	Can only execute Jobs for specified users
Repository-level Runner	Can only execute Jobs for specified repositories

External Runners

Supports external Runner mode:

1. Administrators register Runners on the settings page to obtain tokens
2. Runners use token authentication and poll for tasks
3. Suitable for distributed build scenarios

See Docker Deployment - CI/CD Runner Deployment for details.

Working Directory Cleanup

After Job execution is complete, the working directory is automatically cleaned up to prevent disk space exhaustion. To keep the working directory for debugging:

IFORGE_CI_KEEP_WORKDIR=true