Automate Gitea Docker image publishing

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.gitea
+.env*
+.DS_Store
+node_modules
+dist
+build
+recovered-production
+npm-debug.log*

.gitea/workflows/docker.yml

@@ -0,0 +1,49 @@
+name: Build and publish Docker image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: builtin:checkout
+
+      - name: Log in to Gitea Container Registry
+        env:
+          REGISTRY_USER: ${{ gitea.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: printf '%s' "$REGISTRY_TOKEN" | docker login git.anchorhost.eu --username "$REGISTRY_USER" --password-stdin
+
+      - name: Build and tag image
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          image='git.anchorhost.eu/anchorhost.eu/anchorhost-frontend'
+          short_sha="$(printf '%.12s' "$COMMIT_SHA")"
+          docker build \
+            --label "org.opencontainers.image.revision=$COMMIT_SHA" \
+            --tag "$image:main-$short_sha" \
+            --tag "$image:main-latest" \
+            .
+
+      - name: Push image tags
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          image='git.anchorhost.eu/anchorhost.eu/anchorhost-frontend'
+          short_sha="$(printf '%.12s' "$COMMIT_SHA")"
+          docker push "$image:main-$short_sha"
+          docker push "$image:main-latest"
+
+      - name: Log out from Gitea Container Registry
+        if: always()
+        run: docker logout git.anchorhost.eu

README.md

@@ -14,3 +14,9 @@ React single-page application for the AnchorHost.eu hosting platform. The app so
 ## Rebrand the deployment
 
 Edit the root `branding.json` to set the product name, domain, logo path, public copy, contact addresses, documentation and source links, and footer credit. Replace the logo file at the configured path under `public/`. The app imports this file for its UI, API defaults, document metadata, and web app manifest. Keep `.env` API and WebSocket overrides for deployments whose service endpoints differ from the public brand domain.
+
+## Gitea Actions Docker publishing
+
+`.gitea/workflows/docker.yml` builds the Docker image when `main` is updated and can also be started manually from the Actions page. It publishes `git.anchorhost.eu/anchorhost.eu/anchorhost-frontend:main-latest` and a commit-specific `main-<12 character SHA>` tag to the Gitea Container Registry. The workflow uses Gitea's job token with only `contents: read` and `packages: write`; no registry password secret is needed.
+
+Enable Actions and the Container Registry for the repository, and register an `ubuntu-latest` runner that has the Docker CLI and access to a working Docker daemon. The workflow cannot build until that runner is available. `.dockerignore` keeps local dependencies, Git history, build output, and recovered production artifacts out of the build context.