From e57e12cc84a6bbda7da279b419429da29eca150f Mon Sep 17 00:00:00 2001
From: Bakhomious Basta <bakhomioussvp@gmail.com>
Date: Tue, 27 Oct 2026 20:31:18 +0100
Subject: [PATCH] ci: build the image in the homelab's Gitea

A Gitea workflow on the mirror builds with BuildKit and pushes to Gitea's registry, as the homelab's image-smoke workflow does.
---
 .gitea/workflows/image.yaml | 57 +++++++++++++++++++++++++++++++++++++
 docs/plan.md                |  2 +-
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 .gitea/workflows/image.yaml

diff --git a/.gitea/workflows/image.yaml b/.gitea/workflows/image.yaml
new file mode 100644
index 0000000..075299d
--- /dev/null
+++ b/.gitea/workflows/image.yaml
@@ -0,0 +1,57 @@
+# Builds the container image with BuildKit and pushes it to Gitea's registry, on every push to
+# main and on every v* tag, in the homelab's Gitea, which mirrors this repository (docs/plan.md,
+# decision 36). GitHub ignores .gitea/.
+name: image
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+defaults:
+  run:
+    shell: bash
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      BUILDKIT_HOST: tcp://buildkitd.buildkit.svc:1234
+      REGISTRY: git.tail9e9088.ts.net
+      IMAGE: git.tail9e9088.ts.net/codedogapp/nudge
+      # renovate: datasource=github-releases depName=moby/buildkit
+      BUILDKIT_VERSION: v0.34.1
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install buildctl
+        run: |
+          curl -fsSL "https://github.com/moby/buildkit/releases/download/$BUILDKIT_VERSION/buildkit-$BUILDKIT_VERSION.linux-amd64.tar.gz" \
+            | tar -xz -C /usr/local bin/buildctl
+      - name: Log in to the registry
+        env:
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          mkdir -p ~/.docker
+          auth=$(printf 'bakh:%s' "$TOKEN" | base64 -w0)
+          printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$auth" > ~/.docker/config.json
+      - name: Build and push
+        run: |
+          if [ "$GITHUB_REF_TYPE" = tag ]; then
+            version=$GITHUB_REF_NAME
+            names="$IMAGE:$version"
+          else
+            version=$(git describe --tags --always)
+            names="$IMAGE:main,$IMAGE:sha-${GITHUB_SHA:0:7}"
+          fi
+          buildctl build --frontend dockerfile.v0 \
+            --local context=. --local dockerfile=. \
+            --opt platform=linux/amd64 --opt "build-arg:VERSION=$version" \
+            --output "type=image,\"name=$names\",push=true"
diff --git a/docs/plan.md b/docs/plan.md
index c44e4c8..4f3ae79 100644
--- a/docs/plan.md
+++ b/docs/plan.md
@@ -61,7 +61,7 @@ This document is the source of truth for scope and the work breakdown. How we wo
 | `ingress-check` | A throwaway pod behind a `tailscale` Ingress in the homelab: does the proxy send `Tailscale-User-Login` and the Ingress's name as `Host`, and does it keep a request open for hours (risk 12). Done: the proxy sends both; a request held 330 s was answered; hours untested | Done |
 | `container-image` | A Dockerfile in this repo: a static `linux/amd64` Go binary, non-root, `nudge serve` as the entrypoint. Done: it cross-compiles on the build host (QEMU crashed the Go toolchain on a Mac); 5.7 MB; ran with a read-only root and answered 200 with the login header and 403 without | Done |
 | `server-setting` | A `server` key in the settings file, read by `nudge ask` and `nudge mcp` as `NUDGE_SERVER` is (decision 36). `nudge setup` doesn't write it yet; the user adds it to the settings file by hand | Done |
-| `image-workflow` | `.gitea/workflows/image.yaml`: builds with BuildKit and pushes `git.tail9e9088.ts.net/codedogapp/nudge:<tag>` from the Gitea mirror | Todo |
+| `image-workflow` | `.gitea/workflows/image.yaml`: builds with BuildKit and pushes `git.tail9e9088.ts.net/codedogapp/nudge` (`:main` and `:sha-<7>` for main, `:vX.Y.Z` for a tag) from the Gitea mirror. Needs the mirror with Actions on (the user, in Gitea); untested until then | Todo |
 | `k8s-manifests` | `cluster/nudge/` in the homelab repo (plain YAML, Flux): Deployment, volume, Service, Ingress, and a doc there (decision 36) | Todo |
 | `cutover` | Tag v0.4.0, deploy, point the Macs and the iPhone at the cluster; after the user confirms it works, stop the Mac's `brew services` nudge and `tailscale serve` | Todo |
 | `multi-device` | The steps above, together: the user's end check that a question from a second machine reaches the iPhone (decisions 32, 34 and 35) | Todo |