test_repo/.gitea/workflows/build-and-push.yaml

name: Build and Push Container Image

on:
  push:
    branches:
      - main
    tags:
      - "v*"

jobs:
  build-and-push:
    runs-on: orchestration-platform
    container:
      image: docker:latest

    steps:
      - name: Install tools
        run: |
          apk add --no-cache git curl

      - name: Checkout code
        run: |
          git clone --branch "${GITHUB_REF_NAME}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .

      - name: Determine image tag
        id: meta
        run: |
          if echo "${{ gitea.ref }}" | grep -q "refs/tags/"; then
            TAG=$(echo "${{ gitea.ref }}" | sed 's|refs/tags/||')
          else
            TAG="latest"
          fi
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

      - name: Build image
        run: |
          REGISTRY_HOST=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
          IMAGE="${REGISTRY_HOST}/${{ gitea.repository }}:${{ steps.meta.outputs.tag }}"
          docker build -t "${IMAGE}" .
          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
        id: build

      # TODO: Registry push is currently blocked.
      # The Gitea ingress only routes /gitea/ to the backend; the Docker registry
      # API (/v2/) returns 404 from nginx. A separate Ingress rule for /v2 -> gitea-http:3000
      # (without rewrite-target) is needed before push can work.
      - name: Push image (skipped - registry ingress not configured)
        run: |
          REGISTRY_HOST=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
          IMAGE="${REGISTRY_HOST}/${{ gitea.repository }}:${{ steps.meta.outputs.tag }}"
          echo "⚠️  Skipping push: Gitea container registry is not reachable."
          echo "   The ingress does not route /v2/ to Gitea (returns 404 from nginx)."
          echo "   Fix: Add a separate Ingress for path /v2 pointing to gitea-http:3000 without rewrite-target."
          echo ""
          echo "   Image built successfully: ${IMAGE}"
          echo "   To push manually once ingress is fixed:"
          echo "     crane auth login \${REGISTRY_HOST} -u <user> -p <token>"
          echo "     crane push image.tar \${IMAGE}"