ci(main): trigger image builds on main branch commits

.gitea/workflows/build-prod.yaml

@@ -0,0 +1,59 @@
+# Build and push on main branch — triggered automatically when commits land on main.
+# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
+# Image: forgejo.riotpiao.com/rock/api-gateway:<commit-sha>
+#
+# ArgoCD auto-deploys to api namespace as revisions roll in.
+name: Build and push
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
+jobs:
+  build:
+    name: Build and push image
+    runs-on: golang
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Build
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            .
+
+      - name: Push
+        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Report digest
+        run: |
+          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

.gitea/workflows/build.yaml

@@ -67,10 +67,10 @@ jobs:
 
       - name: Registry login
         run: |
-          echo "${GITHUB_TOKEN}" | docker login "${REGISTRY}" \
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
             --username rock --password-stdin
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
 
       - name: Build
         run: |