ci: auto build & push image on main (:latest) + v* tags

Mirror mort-ci.yml's build-and-push: BuildKit secrets (REGISTRY_USER/
REGISTRY_PASSWORD) for private majordomo access instead of build-args, and the
LAN --add-host so the builder can reach the registry. push main -> :latest +
:sha-<short>; tag v* -> :<tag> + :latest; other branches -> :branch-<safe>;
PRs build-only (no push). Optional DISCORD_WEBHOOK_URL notifications.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,47 +1,113 @@
 name: Build & push image
 
 # Builds the Gadfly reviewer container and pushes it to the Gitea container
-# registry. Tag a release (v1, v1.2.0, …) to publish that version + :latest.
+# registry. Mirrors mort-ci.yml's build-and-push (BuildKit secrets for private
+# module access + the LAN --add-host so the builder can reach the registry).
+#
+#   push to main      -> :latest + :sha-<short>
+#   push tag v*       -> :<tag> + :latest
+#   other branch push -> :branch-<safe> + :sha-<short>
+#   pull_request       -> build only (no push), as a sanity check
 #
 # Required repo secrets:
 #   REGISTRY_USER / REGISTRY_PASSWORD  Gitea creds with registry push + read
 #                                      access to the private majordomo module.
+# Optional:
+#   DISCORD_WEBHOOK_URL  build notifications (unset => silent).
 
 on:
   push:
+    branches: [main]
     tags: ["v*"]
+  pull_request:
+    types: [opened, synchronize, reopened]
   workflow_dispatch: {}
 
+concurrency:
+  group: gadfly-image-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
-  IMAGE: gitea.stevedudenhoeffer.com/steve/gadfly
+  IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/gadfly
 
 jobs:
-  image:
+  build-and-push:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Docker Buildx
+        run: docker buildx create --use --name gadfly-builder --driver docker-container 2>/dev/null || docker buildx use gadfly-builder
+
       - name: Log in to the registry
-        run: |
+        if: github.event_name != 'pull_request'
-          echo "${{ secrets.REGISTRY_PASSWORD }}" \
+        env:
-            | docker login gitea.stevedudenhoeffer.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
 
-      - name: Resolve tags
+      - name: Compute tags
-        id: tags
+        id: meta
         run: |
-          if [ "${{ github.ref_type }}" = "tag" ]; then
+          SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
-            echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          PUSH=true
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # Build-only sanity check; nothing published.
+            TAGS="${IMAGE_NAME}:pr-${{ github.event.pull_request.number }}"
+            PUSH=false
+          elif [ "${{ github.ref_type }}" = "tag" ]; then
+            TAGS="${IMAGE_NAME}:${GITHUB_REF_NAME},${IMAGE_NAME}:latest"
+          elif [ "${GITHUB_REF_NAME}" = "main" ]; then
+            TAGS="${IMAGE_NAME}:latest,${IMAGE_NAME}:sha-${SHA_SHORT}"
           else
-            echo "version=dev-$(echo ${{ github.sha }} | cut -c1-8)" >> "$GITHUB_OUTPUT"
+            BRANCH_SAFE=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^-//; s/-$//')
+            TAGS="${IMAGE_NAME}:branch-${BRANCH_SAFE},${IMAGE_NAME}:sha-${SHA_SHORT}"
           fi
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "push=${PUSH}" >> "$GITHUB_OUTPUT"
+          echo "Tags: ${TAGS} (push=${PUSH})"
 
-      - name: Build & push
+      - name: Notify Discord (started)
+        if: github.event_name != 'pull_request'
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
         run: |
-          docker build \
+          [ -z "$WEBHOOK_URL" ] && exit 0
-            --build-arg GIT_USER="${{ secrets.REGISTRY_USER }}" \
+          MSG="🪰 Gadfly image build #${{ github.run_number }} started on \`${{ github.ref_name }}\` (${{ github.sha }})."
-            --build-arg GIT_TOKEN="${{ secrets.REGISTRY_PASSWORD }}" \
+          curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true
-            -t "${IMAGE}:${{ steps.tags.outputs.version }}" \
+
-            -t "${IMAGE}:latest" \
+      - name: Build and push
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          TAG_FLAGS=""
+          IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
+          for tag in "${TAG_ARRAY[@]}"; do TAG_FLAGS="$TAG_FLAGS --tag $tag"; done
+
+          PUSH_FLAG="--push"
+          [ "${{ steps.meta.outputs.push }}" = "false" ] && PUSH_FLAG="--output=type=cacheonly"
+
+          docker buildx build \
+            $PUSH_FLAG \
+            --platform linux/amd64 \
+            $TAG_FLAGS \
+            --add-host gitea.stevedudenhoeffer.com:192.168.0.134 \
+            --secret id=REGISTRY_USER,env=REGISTRY_USER \
+            --secret id=REGISTRY_PASSWORD,env=REGISTRY_PASSWORD \
+            --file ./Dockerfile \
             .
-          docker push "${IMAGE}:${{ steps.tags.outputs.version }}"
+
-          docker push "${IMAGE}:latest"
+      - name: Notify Discord (result)
+        if: always() && github.event_name != 'pull_request'
+        env:
+          WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
+        run: |
+          [ -z "$WEBHOOK_URL" ] && exit 0
+          if [ "${{ job.status }}" = "success" ]; then
+            MSG="✅ Gadfly image build #${{ github.run_number }} succeeded. Tags: \`${{ steps.meta.outputs.tags }}\`."
+          else
+            MSG="❌ Gadfly image build #${{ github.run_number }} failed. Check Actions logs."
+          fi
+          curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true

Dockerfile

@@ -1,25 +1,27 @@
 # syntax=docker/dockerfile:1
 #
-# Multi-stage so the private-module access token used to fetch the majordomo
+# Multi-stage so the private-module credentials (used to fetch the majordomo
-# dependency lives ONLY in the build stage and never lands in the final image.
+# dependency) live ONLY in the build stage via BuildKit secrets and never land
+# in the final image. Mirrors mort's Dockerfile secret idiom.
 
 FROM golang:1.26 AS build
 ARG GIT_HOST=gitea.stevedudenhoeffer.com
-ARG GIT_USER=
-ARG GIT_TOKEN=
 ENV CGO_ENABLED=0 \
     GOFLAGS=-mod=mod \
-    GOSUMDB=off
+    GOSUMDB=off \
+    GOTOOLCHAIN=auto
 ENV GOPRIVATE=${GIT_HOST}/* GONOSUMDB=${GIT_HOST}/*
 WORKDIR /src
-# Private Go module access (majordomo). Token is confined to this stage.
-RUN if [ -n "$GIT_TOKEN" ]; then \
-      git config --global url."https://${GIT_USER}:${GIT_TOKEN}@${GIT_HOST}/".insteadOf "https://${GIT_HOST}/"; \
-    fi
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=secret,id=REGISTRY_USER \
+    --mount=type=secret,id=REGISTRY_PASSWORD \
+    --mount=type=cache,target=/go/pkg/mod \
+    git config --global url."https://$(cat /run/secrets/REGISTRY_USER):$(cat /run/secrets/REGISTRY_PASSWORD)@${GIT_HOST}/".insteadOf "https://${GIT_HOST}/" \
+    && go mod download
 COPY . .
-RUN go build -trimpath -ldflags="-s -w" -o /out/gadfly ./cmd/gadfly
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -trimpath -ldflags="-s -w" -o /out/gadfly ./cmd/gadfly
 
 FROM alpine:3.20
 RUN apk add --no-cache bash git curl jq ca-certificates

README.md

@@ -65,13 +65,15 @@ cmd/gadfly/            the agentic reviewer binary (majordomo + Ollama Cloud); z
 scripts/run.sh         fetches the PR diff, runs the reviewer, upserts one labeled comment
 scripts/system-prompt.txt  the reviewer persona + verification discipline
 entrypoint.sh          the container brains: trigger gating, clone, model loop (logic lives here, not in YAML)
-Dockerfile             multi-stage; the build-time module token never reaches the final image
+Dockerfile             multi-stage; build-time module creds (BuildKit secrets) never reach the final image
-.gitea/workflows/build-image.yml   tags v* → build & push the image
+.gitea/workflows/build-image.yml   push to main → :latest; tag v* → :<tag> + :latest
 examples/              the ~15-line stub a consuming repo drops in
 ```
 
-The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Push a `v*` tag to
+The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Every push to `main`
-build and publish a new version (and `:latest`).
+rebuilds and republishes `:latest` (plus `:sha-<short>`); pushing a `v*` tag publishes that
+pinned version (plus `:latest`). Pin consumers to a `:vN` tag for stability, or track
+`:latest` to ride main.
 
 ## Configuration (advanced)