Multi-stage Dockerfile builds the web bundle, embeds it into the static
Go binary (CGO_ENABLED=0), and ships it in a minimal alpine runtime:
non-root user, ca-certificates + tzdata, SQLite on a /data volume,
healthcheck on /api/v1/healthz, OCI provenance labels.

build-image.yml pushes to the Gitea registry on every branch push:
  * main             -> :latest
  * any other branch -> :<branch-name> (sanitized to valid tag chars)
  * every build      -> :sha-<short>   (immutable, for pinning)

A push to a PR branch covers the PR, so there is no separate
pull_request trigger. README documents the image, tags, and a
docker run / Komodo compose snippet. Modeled on mort's CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -0,0 +1,26 @@
+# VCS / editor / docs — not needed in the image build context.

@@ -0,0 +26,4 @@
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout

@@ -0,0 +38,4 @@
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin

@@ -0,0 +45,4 @@
+        run: |
+          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          if [ "${GITHUB_REF_NAME}" = "main" ]; then
+            PRIMARY="latest"

@@ -0,0 +55,4 @@
+          echo "Building tags: ${TAGS}"
+
+      - name: Build and push (linux/amd64)
+        run: |

@@ -0,0 +8,4 @@
+FROM node:22-alpine AS web
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci

@@ -0,0 +14,4 @@
+
+# ---- stage 2: build the static Go binary (web bundle embedded) --------------
+FROM golang:1.26-alpine AS build
+ENV CGO_ENABLED=0 GOTOOLCHAIN=auto

@@ -0,0 +21,4 @@
+COPY . .
+# Overlay the freshly built frontend into the embed directory before compiling
+# (//go:embed all:dist in internal/webdist).
+COPY --from=web /web/dist ./internal/webdist/dist

@@ -0,0 +33,4 @@
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.title="pansy" \
+      org.opencontainers.image.description="Self-hostable garden planner" \
+      org.opencontainers.image.source="https://gitea.stevedudenhoeffer.com/steve/pansy" \

@@ -0,0 +54,4 @@
+VOLUME /data
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \

@@ -61,0 +63,4 @@
+
+CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push:
+
+| Ref | Tag |

@@ -61,0 +72,4 @@
+The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly:
+
+```sh
+docker run -d --name pansy \