From d6161b3b34cb82636bfb76c67ac652400addfa05 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@local>
Date: Thu, 21 May 2026 21:43:53 +0200
Subject: [PATCH] ci: add tag-triggered container publish workflow

---
 .gitea/workflows/release-container.yml | 59 ++++++++++++++++++++++++++
 README.md                              | 26 ++++++++++++
 2 files changed, 85 insertions(+)
 create mode 100644 .gitea/workflows/release-container.yml

diff --git a/.gitea/workflows/release-container.yml b/.gitea/workflows/release-container.yml
new file mode 100644
index 0000000..7a7d390
--- /dev/null
+++ b/.gitea/workflows/release-container.yml
@@ -0,0 +1,59 @@
+name: Publish container image
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    name: Build and push image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Derive image coordinates
+        id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+          image="192.168.33.22:3300/gemma/arcana-fx"
+          raw_tag="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-unknown}}"
+          safe_tag="$(printf '%s' "$raw_tag" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9_.-]#-#g')"
+
+          if [ -z "$safe_tag" ]; then
+            echo "failed to derive image tag from ref name: $raw_tag" >&2
+            exit 1
+          fi
+
+          echo "image=$image" >> "$GITHUB_OUTPUT"
+          echo "tag=$safe_tag" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to Gitea container registry
+        shell: bash
+        env:
+          PACKAGES_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$PACKAGES_TOKEN" | docker login 192.168.33.22:3300 --username gemma --password-stdin
+
+      - name: Build image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build \
+            --tag "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}" \
+            --tag "${{ steps.meta.outputs.image }}:latest" \
+            .
+
+      - name: Push image tags
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker push "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}"
+          docker push "${{ steps.meta.outputs.image }}:latest"
diff --git a/README.md b/README.md
index a232226..9be12a9 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,32 @@ docker compose up -d --build
 
 Then open `http://<host>:8091`.
 
+## Container publishing pipeline
+
+A Gitea Actions workflow lives at `.gitea/workflows/release-container.yml`.
+Whenever a git tag is pushed, the self-hosted runner:
+
+1. checks out the tagged commit,
+2. builds the Docker image from `Dockerfile`,
+3. tags it as both the sanitized git tag and `latest`,
+4. pushes both tags to the Gitea container registry at
+   `192.168.33.22:3300/gemma/arcana-fx`.
+
+The workflow authenticates with the repository Actions secret `PACKAGES_TOKEN`.
+Example release flow:
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+After the workflow finishes, the image can be pulled with:
+
+```bash
+docker pull 192.168.33.22:3300/gemma/arcana-fx:v0.1.0
+docker pull 192.168.33.22:3300/gemma/arcana-fx:latest
+```
+
 ## Run locally (no Docker)
 
 Requires Node.js 20+.