From 1026b1ba33206f0f30a65c1b6dc6f5bfb9c6097b Mon Sep 17 00:00:00 2001
From: "Wiktor A. Falkowski" <wfalkowski@kvj.ovh>
Date: Sun, 18 Oct 2026 20:48:19 +0000
Subject: [PATCH] Automate Gitea Docker image publishing

---
 .dockerignore               |  9 +++++++
 .gitea/workflows/docker.yml | 49 +++++++++++++++++++++++++++++++++++++
 README.md                   |  6 +++++
 3 files changed, 64 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 .gitea/workflows/docker.yml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..f5b4780
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+.gitea
+.env*
+.DS_Store
+node_modules
+dist
+build
+recovered-production
+npm-debug.log*
diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
new file mode 100644
index 0000000..0cee783
--- /dev/null
+++ b/.gitea/workflows/docker.yml
@@ -0,0 +1,49 @@
+name: Build and publish Docker image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: builtin:checkout
+
+      - name: Log in to Gitea Container Registry
+        env:
+          REGISTRY_USER: ${{ gitea.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: printf '%s' "$REGISTRY_TOKEN" | docker login git.anchorhost.eu --username "$REGISTRY_USER" --password-stdin
+
+      - name: Build and tag image
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          image='git.anchorhost.eu/anchorhost.eu/anchorhost-frontend'
+          short_sha="$(printf '%.12s' "$COMMIT_SHA")"
+          docker build \
+            --label "org.opencontainers.image.revision=$COMMIT_SHA" \
+            --tag "$image:main-$short_sha" \
+            --tag "$image:main-latest" \
+            .
+
+      - name: Push image tags
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          image='git.anchorhost.eu/anchorhost.eu/anchorhost-frontend'
+          short_sha="$(printf '%.12s' "$COMMIT_SHA")"
+          docker push "$image:main-$short_sha"
+          docker push "$image:main-latest"
+
+      - name: Log out from Gitea Container Registry
+        if: always()
+        run: docker logout git.anchorhost.eu
diff --git a/README.md b/README.md
index c36e198..af624bd 100644
--- a/README.md
+++ b/README.md
@@ -14,3 +14,9 @@ React single-page application for the AnchorHost.eu hosting platform. The app so
 ## Rebrand the deployment
 
 Edit the root `branding.json` to set the product name, domain, logo path, public copy, contact addresses, documentation and source links, and footer credit. Replace the logo file at the configured path under `public/`. The app imports this file for its UI, API defaults, document metadata, and web app manifest. Keep `.env` API and WebSocket overrides for deployments whose service endpoints differ from the public brand domain.
+
+## Gitea Actions Docker publishing
+
+`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:main-latest` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. The workflow uses Gitea's job token with only `contents: read` and `packages: write`; no registry password secret is needed.
+
+Enable Actions and the Container Registry for the repository, and register an `ubuntu-latest` runner that has the Docker CLI and access to a working Docker daemon. The workflow cannot build until that runner is available. `.dockerignore` keeps local dependencies, Git history, build output, and recovered production artifacts out of the build context.