ci: use DinD pattern matching other repos

Replace docker/build-push-action with raw docker commands that work
reliably with Forgejo runners' DinD sidecar setup.

.gitea/workflows/build-prod.yaml

@@ -4,50 +4,54 @@ on:
   push:
     branches: [main]
 
-jobs:
+concurrency:
-  build-push:
+  group: build-${{ github.ref }}
-    runs-on: golang
+  cancel-in-progress: true
-    permissions:
+
-      packages: write
-      contents: read
 env:
   REGISTRY: forgejo.riotpiao.com
-      IMAGE_NAME: rock/kmsvc-manage
+  IMAGE: forgejo.riotpiao.com/rock/kmsvc-manage
-      REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+jobs:
+  push:
+    name: Build and push image
+    runs-on: golang
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
     steps:
-      - name: Checkout code
+      - name: install node (required by JS-based actions)
-        uses: actions/checkout@v4
+        run: apk add --no-cache nodejs git
 
-      - name: Get commit short SHA
+      - uses: actions/checkout@v4
-        id: short_sha
-        run: echo "sha=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT
 
-      - name: Set up Docker Buildx
+      - name: Get short SHA
-        uses: docker/setup-buildx-action@v3
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Log in to Forgejo Container Registry
+      - name: Registry login
-        uses: docker/login-action@v3
+        run: |
-        with:
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
-          registry: ${{ env.REGISTRY }}
+            --username rock --password-stdin
-          username: rock
+        env:
-          password: ${{ env.REGISTRY_PAT }}
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
 
-      - name: Extract metadata (tags, labels)
+      - name: Build image
-        id: meta
+        run: |
-        uses: docker/metadata-action@v5
+          docker build \
-        with:
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-          tags: |
+            -t "${IMAGE}:latest" \
-            type=raw,value=${{ steps.short_sha.outputs.sha }}
+            .
-            type=raw,value=latest,enable={{is_default_branch}}
 
-      - name: Build and push image
+      - name: Push image
-        uses: docker/build-push-action@v6
+        run: |
-        with:
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          context: .
+          docker push "${IMAGE}:latest"
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max