forgerunner/test/sample-workflows/docker-build-push.yml

name: Smoke — Docker Build and Push

# Runs on the `host` label so docker build/push use the runner container's
# bundled Docker CLI and the mounted /var/run/docker.sock. The `ubuntu-latest`
# label runs steps inside a node job container that has neither.
#
# Requires repo Action secrets:
#   REGISTRY_USER  — registry username (e.g. your Gitea user)
#   REGISTRY_TOKEN — a scoped package read/write token (NOT an admin API token)

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: host
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: registry.alwisp.com
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and Push
        run: |
          # gitea.repository is already "owner/repo" (e.g. jason/forgerunner)
          IMAGE="registry.alwisp.com/${{ gitea.repository }}"
          docker build \
            -t "${IMAGE}:latest" \
            -t "${IMAGE}:${{ gitea.sha }}" \
            -f docker/runner/Dockerfile \
            .
          docker push "${IMAGE}:latest"
          docker push "${IMAGE}:${{ gitea.sha }}"

      # Dangling-only prune: removes untagged leftovers from previous builds.
      # Never removes tagged images (the fresh :latest may be deployed on the
      # host) or any image referenced by a container. See
      # docs/troubleshooting.md "Orphan images piling up on the host".
      - name: Prune dangling images on host
        if: always()
        run: docker image prune -f 2>/dev/null || true