From 027bb7910e24766860daad18d2bc74ed910c6d73 Mon Sep 17 00:00:00 2001
From: claude <claude@verso>
Date: Tue, 30 Jun 2026 09:05:47 +0000
Subject: [PATCH] Add Gitea Actions workflow to build and push Docker images

Builds server and client images via BuildKit job in the ci namespace,
pushing to registry.git.svc.cluster.local:5000.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/build.yaml | 104 ++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 .gitea/workflows/build.yaml

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
new file mode 100644
index 0000000..3795c41
--- /dev/null
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,104 @@
+name: Build and push ManyCoqDecks
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: native
+    timeout-minutes: 120
+
+    steps:
+      - name: Build and push ManyCoqDecks images with BuildKit
+        run: |
+          kubectl -n ci delete job manycoqdecks-buildkit --ignore-not-found=true --wait=true
+
+          BRANCH=${GITEA_REF_NAME:-${GITHUB_REF_NAME:-main}}
+          cat <<'EOF' | sed "s|__BRANCH__|${BRANCH}|g" | kubectl apply -f -
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: manycoqdecks-buildkit
+            namespace: ci
+          spec:
+            backoffLimit: 0
+            template:
+              spec:
+                restartPolicy: Never
+                initContainers:
+                  - name: prepare
+                    image: alpine/git:latest
+                    command: ["sh", "-c"]
+                    args:
+                      - |
+                        set -eux
+                        git clone --depth 1 --branch __BRANCH__ https://git.alocoq.fr/alois/ManyCoqDecks.git /workspace/repo
+                    volumeMounts:
+                      - name: workspace
+                        mountPath: /workspace
+
+                containers:
+                  - name: buildkit
+                    image: moby/buildkit:latest
+                    securityContext:
+                      privileged: true
+                    command: ["sh", "-c"]
+                    args:
+                      - |
+                        set -eux
+
+                        REG=registry.git.svc.cluster.local:5000
+
+                        mkdir -p /etc/buildkit
+                        printf '[registry."%s"]\n  http = true\n  insecure = true\n' "$REG" > /etc/buildkit/buildkitd.toml
+
+                        cache_flag() {
+                          local image="$1" tag="$2"
+                          if wget -qO- "http://$REG/v2/$image/tags/list" 2>/dev/null | grep -q "\"$tag\""; then
+                            echo "--import-cache type=registry,ref=$REG/$image:$tag"
+                          fi
+                        }
+
+                        # Build server image
+                        buildctl-daemonless.sh build \
+                          --frontend=dockerfile.v0 \
+                          --local context=/workspace/repo/server \
+                          --local dockerfile=/workspace/repo/server \
+                          $(cache_flag manycoqdecks-cache server) \
+                          --export-cache type=registry,ref=$REG/manycoqdecks-cache:server,mode=max \
+                          --output type=image,name=$REG/manycoqdecks-server:latest,push=true,registry.insecure=true
+
+                        # Build client image
+                        buildctl-daemonless.sh build \
+                          --frontend=dockerfile.v0 \
+                          --local context=/workspace/repo/client \
+                          --local dockerfile=/workspace/repo/client \
+                          $(cache_flag manycoqdecks-cache client) \
+                          --export-cache type=registry,ref=$REG/manycoqdecks-cache:client,mode=max \
+                          --output type=image,name=$REG/manycoqdecks-client:latest,push=true,registry.insecure=true
+                    volumeMounts:
+                      - name: workspace
+                        mountPath: /workspace
+
+                volumes:
+                  - name: workspace
+                    emptyDir: {}
+          EOF
+
+      - name: Wait for build
+        run: |
+          kubectl -n ci wait --for=condition=complete job/manycoqdecks-buildkit --timeout=7200s
+
+      - name: Show build logs
+        if: always()
+        run: |
+          kubectl -n ci logs job/manycoqdecks-buildkit -c prepare || true
+          kubectl -n ci logs job/manycoqdecks-buildkit -c buildkit || true
+
+      - name: Cleanup
+        if: always()
+        run: |
+          kubectl -n ci delete job manycoqdecks-buildkit --ignore-not-found=true --wait=true