ci: build & publish app + bot images to Gitea registry on merge #53

wtclaude · 2026-07-11T23:00:18Z

wtclaude commented

2026-07-11 23:00:18 +00:00

What

Adds a Gitea Actions workflow (.gitea/workflows/build-images.yml) that builds and pushes the Docker images to Gitea's built-in container registry on every merge to main, so production pulls prebuilt images instead of building on the host.

On the always-on ubuntu-latest runner it:

Checks out the merged commit.
Verifies the host Docker daemon is reachable (fails fast with a clear message if the socket isn't mounted into the job).
Logs into gitea.whitlocktech.com with a PAT.
Builds & pushes both images from the existing Dockerfiles, each tagged :latest and :sha-<7char>:
- gitea.whitlocktech.com/<owner>/website-app — ./Dockerfile (server + client; the client is built inside the image)
- gitea.whitlocktech.com/<owner>/website-bot — ./bot/Dockerfile
Logs out.

Design choices: raw docker CLI (no marketplace actions → portable on self-hosted Gitea); the shared host Docker socket gives free layer caching between runs; registry owner is lowercased for Docker refs; concurrency cancels superseded builds.

Required setup before this runs green

Two repo secrets (Settings → Actions → Secrets):

Secret	Value
`REGISTRY_USER`	Gitea username that owns the token below
`REGISTRY_TOKEN`	Gitea access token with `write:package` scope

Create the token under avatar → Settings → Applications → Manage Access Tokens (scope: package → write). Also ensure Actions is enabled for the repo, and the runner mounts /var/run/docker.sock into its job containers (act_runner container.docker_host: "-").

Testing

Merge this PR (or use Actions → Build container images → Run workflow) to trigger it, then docker pull gitea.whitlocktech.com/<owner>/website-app:latest on the host to confirm.

Follow-up (separate PR, once this is verified)

Wire docker-compose.yml (or a docker-compose.prod.yml override) to use image: from this registry instead of build:, so the host pulls the published images. Optional after that: an auto-deploy job and a v* semver-tag trigger.

🤖 Generated with Claude Code

https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

## What Adds a Gitea Actions workflow (`.gitea/workflows/build-images.yml`) that builds and pushes the Docker images to Gitea's built-in container registry on every merge to `main`, so production pulls prebuilt images instead of building on the host. On the always-on `ubuntu-latest` runner it: 1. Checks out the merged commit. 2. Verifies the host Docker daemon is reachable (fails fast with a clear message if the socket isn't mounted into the job). 3. Logs into `gitea.whitlocktech.com` with a PAT. 4. Builds & pushes **both** images from the existing Dockerfiles, each tagged `:latest` and `:sha-<7char>`: - `gitea.whitlocktech.com/<owner>/website-app` — `./Dockerfile` (server + client; the client is built inside the image) - `gitea.whitlocktech.com/<owner>/website-bot` — `./bot/Dockerfile` 5. Logs out. **Design choices:** raw `docker` CLI (no marketplace actions → portable on self-hosted Gitea); the shared **host Docker socket** gives free layer caching between runs; registry owner is lowercased for Docker refs; `concurrency` cancels superseded builds. ## Required setup before this runs green Two repo secrets (**Settings → Actions → Secrets**): | Secret | Value | |---|---| | `REGISTRY_USER` | Gitea username that owns the token below | | `REGISTRY_TOKEN` | Gitea access token with `write:package` scope | Create the token under **avatar → Settings → Applications → Manage Access Tokens** (scope: `package` → `write`). Also ensure **Actions is enabled** for the repo, and the runner mounts `/var/run/docker.sock` into its job containers (`act_runner` `container.docker_host: "-"`). ## Testing Merge this PR (or use **Actions → Build container images → Run workflow**) to trigger it, then `docker pull gitea.whitlocktech.com/<owner>/website-app:latest` on the host to confirm. ## Follow-up (separate PR, once this is verified) Wire `docker-compose.yml` (or a `docker-compose.prod.yml` override) to use `image:` from this registry instead of `build:`, so the host pulls the published images. Optional after that: an auto-deploy job and a `v*` semver-tag trigger. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

wtclaude added 1 commit 2026-07-11 23:00:21 +00:00

ci: build & publish app + bot images to Gitea registry on merge 4f24959d49

Add a Gitea Actions workflow (.gitea/workflows/build-images.yml) that fires on
push to main (and workflow_dispatch). On the always-on ubuntu-latest runner it:

  - verifies the host Docker daemon is reachable (socket must be mounted)
  - logs into gitea.whitlocktech.com with a PAT (REGISTRY_USER / REGISTRY_TOKEN)
  - builds & pushes both images from the existing Dockerfiles, each tagged
    :latest and :sha-<7>:
      gitea.whitlocktech.com/<owner>/website-app  (./Dockerfile — server+client)
      gitea.whitlocktech.com/<owner>/website-bot   (./bot/Dockerfile)

Raw docker CLI (no marketplace actions) for portability on self-hosted Gitea;
the shared host daemon gives free layer caching between runs. Registry owner is
lowercased for Docker refs. Deploy (compose image: + pull) is a follow-up.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

whitlocktech approved these changes 2026-07-11 23:00:54 +00:00

whitlocktech merged commit 042a151358 into main

2026-07-11 23:01:05 +00:00

whitlocktech referenced this issue from a commit

2026-07-11 23:01:07 +00:00

Merge pull request 'ci: build & publish app + bot images to Gitea registry on merge' (#53) from ci/gitea-actions-image-build into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#53