ci: auto build & push image on main (:latest) + v* tags

Mirror mort-ci.yml's build-and-push: BuildKit secrets (REGISTRY_USER/
REGISTRY_PASSWORD) for private majordomo access instead of build-args, and the
LAN --add-host so the builder can reach the registry. push main -> :latest +
:sha-<short>; tag v* -> :<tag> + :latest; other branches -> :branch-<safe>;
PRs build-only (no push). Optional DISCORD_WEBHOOK_URL notifications.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,47 +1,113 @@
 name: Build & push image
 
 # Builds the Gadfly reviewer container and pushes it to the Gitea container
-# registry. Tag a release (v1, v1.2.0, …) to publish that version + :latest.
+# registry. Mirrors mort-ci.yml's build-and-push (BuildKit secrets for private
+# module access + the LAN --add-host so the builder can reach the registry).
+#
+#   push to main      -> :latest + :sha-<short>
+#   push tag v*       -> :<tag> + :latest
+#   other branch push -> :branch-<safe> + :sha-<short>
+#   pull_request       -> build only (no push), as a sanity check
 #
 # Required repo secrets:
 #   REGISTRY_USER / REGISTRY_PASSWORD  Gitea creds with registry push + read
 #                                      access to the private majordomo module.
+# Optional:
+#   DISCORD_WEBHOOK_URL  build notifications (unset => silent).
 
 on:
   push:
+    branches: [main]
     tags: ["v*"]
+  pull_request:
+    types: [opened, synchronize, reopened]
   workflow_dispatch: {}
 
+concurrency:
+  group: gadfly-image-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
-  IMAGE: gitea.stevedudenhoeffer.com/steve/gadfly
+  IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/gadfly
 
 jobs:
-  image:
+  build-and-push:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        run: docker buildx create --use --name gadfly-builder --driver docker-container 2>/dev/null || docker buildx use gadfly-builder
+
       - name: Log in to the registry
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" \
-            | docker login gitea.stevedudenhoeffer.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+        if: github.event_name != 'pull_request'
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
 
-      - name: Resolve tags
-        id: tags
+      - name: Compute tags
+        id: meta
         run: |
-          if [ "${{ github.ref_type }}" = "tag" ]; then
-            echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          PUSH=true
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # Build-only sanity check; nothing published.
+            TAGS="${IMAGE_NAME}:pr-${{ github.event.pull_request.number }}"
+            PUSH=false
+          elif [ "${{ github.ref_type }}" = "tag" ]; then
+            TAGS="${IMAGE_NAME}:${GITHUB_REF_NAME},${IMAGE_NAME}:latest"
+          elif [ "${GITHUB_REF_NAME}" = "main" ]; then
+            TAGS="${IMAGE_NAME}:latest,${IMAGE_NAME}:sha-${SHA_SHORT}"
           else
-            echo "version=dev-$(echo ${{ github.sha }} | cut -c1-8)" >> "$GITHUB_OUTPUT"
+            BRANCH_SAFE=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^-//; s/-$//')
+            TAGS="${IMAGE_NAME}:branch-${BRANCH_SAFE},${IMAGE_NAME}:sha-${SHA_SHORT}"
           fi
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "push=${PUSH}" >> "$GITHUB_OUTPUT"
+          echo "Tags: ${TAGS} (push=${PUSH})"
 
-      - name: Build & push
+      - name: Notify Discord (started)
+        if: github.event_name != 'pull_request'
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
-          docker build \
-            --build-arg GIT_USER="${{ secrets.REGISTRY_USER }}" \
-            --build-arg GIT_TOKEN="${{ secrets.REGISTRY_PASSWORD }}" \
-            -t "${IMAGE}:${{ steps.tags.outputs.version }}" \
-            -t "${IMAGE}:latest" \
+          [ -z "$WEBHOOK_URL" ] && exit 0
+          MSG="🪰 Gadfly image build #${{ github.run_number }} started on \`${{ github.ref_name }}\` (${{ github.sha }})."
+          curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true
+
+      - name: Build and push
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          TAG_FLAGS=""
+          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
+          for tag in "${TAG_ARRAY[@]}"; do TAG_FLAGS="$TAG_FLAGS --tag $tag"; done
+
+          PUSH_FLAG="--push"
+          [ "${{ steps.meta.outputs.push }}" = "false" ] && PUSH_FLAG="--output=type=cacheonly"
+
+          docker buildx build \
+            $PUSH_FLAG \
+            --platform linux/amd64 \
+            $TAG_FLAGS \
+            --add-host gitea.stevedudenhoeffer.com:192.168.0.134 \
+            --secret id=REGISTRY_USER,env=REGISTRY_USER \
+            --secret id=REGISTRY_PASSWORD,env=REGISTRY_PASSWORD \
+            --file ./Dockerfile \
             .
-          docker push "${IMAGE}:${{ steps.tags.outputs.version }}"
-          docker push "${IMAGE}:latest"
+
+      - name: Notify Discord (result)
+        if: always() && github.event_name != 'pull_request'
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          [ -z "$WEBHOOK_URL" ] && exit 0
+          if [ "${{ job.status }}" = "success" ]; then
+            MSG="✅ Gadfly image build #${{ github.run_number }} succeeded. Tags: \`${{ steps.meta.outputs.tags }}\`."
+          else
+            MSG="❌ Gadfly image build #${{ github.run_number }} failed. Check Actions logs."
+          fi
+          curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true