From ea1f310b1fa0f21191e51807f714307e2333b533 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Thu, 13 Aug 2026 11:06:08 +0200
Subject: [PATCH] fix pushing image to registry

---
 .gitea/workflows/build.yml | 46 +++++++++++++++++++++++++++-----------
 docs/gitea-actions.md      | 30 +++++++++++++++++++++----
 2 files changed, 59 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index f4771e5..132ef6a 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -6,14 +6,21 @@ on:
       - "**"
     tags:
       - "**"
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
   pull_request:
+    paths-ignore:
+      - "docs/**"
+      - "*.md"
   workflow_dispatch:
 
 env:
   QT_VERSION: "6.11.1"
   ANDROID_NDK_VERSION: "27.2.12479018"
-  BUILD_IMAGE: "localhost/evcharger-ci:qt-6.11.1-${{ gitea.sha }}"
-  BUILD_CACHE_IMAGE: "localhost/evcharger-ci:qt-6.11.1-cache"
+  # Bump the rN suffix whenever the Dockerfile toolchain must be rebuilt.
+  REGISTRY: "registry.brunner.ninja"
+  BUILD_IMAGE: "registry.brunner.ninja/feedc0de/evcharger-ci:qt-6.11.1-r1"
 
 defaults:
   run:
@@ -44,15 +51,32 @@ jobs:
           restore-keys: |
             evcharger-${{ runner.os }}-qt-6.11.1-
 
-      - name: Build the pinned Qt toolchain image
+      - name: Pull or publish the pinned Qt toolchain image
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -Eeuo pipefail
-          podman image inspect "$BUILD_CACHE_IMAGE" >/dev/null 2>&1 || true
-          podman build --pull=always \
-            --cache-from "$BUILD_CACHE_IMAGE" \
-            --tag "$BUILD_IMAGE" \
-            .
-          podman tag "$BUILD_IMAGE" "$BUILD_CACHE_IMAGE"
+          if podman pull "$BUILD_IMAGE"; then
+            echo "Using published toolchain image: $BUILD_IMAGE"
+          else
+            : "${REGISTRY_USERNAME:?REGISTRY_USERNAME secret is required to publish a new toolchain image}"
+            : "${REGISTRY_PASSWORD:?REGISTRY_PASSWORD secret is required to publish a new toolchain image}"
+
+            auth_file="${RUNNER_TEMP:-/tmp}/evcharger-registry-auth-${GITHUB_RUN_ID}.json"
+            export REGISTRY_AUTH_FILE="$auth_file"
+            trap 'rm -f -- "$auth_file"' EXIT
+            printf '%s' "$REGISTRY_PASSWORD" | podman login "$REGISTRY" \
+              --username "$REGISTRY_USERNAME" \
+              --password-stdin
+
+            echo "Toolchain image is not published yet; building $BUILD_IMAGE"
+            podman build --pull=always \
+              --layers \
+              --tag "$BUILD_IMAGE" \
+              .
+            podman push "$BUILD_IMAGE"
+          fi
 
       - name: Build Linux development executable
         run: |
@@ -110,7 +134,3 @@ jobs:
           path: dist/android/
           if-no-files-found: error
           retention-days: 30
-
-      - name: Remove the commit-specific image tag
-        if: always()
-        run: podman image rm "$BUILD_IMAGE" >/dev/null 2>&1 || true
diff --git a/docs/gitea-actions.md b/docs/gitea-actions.md
index ba7faca..bc29a08 100644
--- a/docs/gitea-actions.md
+++ b/docs/gitea-actions.md
@@ -10,10 +10,15 @@ then compiles the Linux and Android packages. Its toolchain is:
 - a pinned KDAB Android OpenSSL revision;
 - `arm64-v8a` and `armeabi-v7a` device ABIs.
 
-The runner's rootless Podman storage retains the large image layers. The first run must
-download Qt and the Android SDK, but ordinary later runs reuse that local cache.
-No Gitea Container Registry credentials are required. A runner replacement or
-Podman cache cleanup causes the toolchain to be downloaded again.
+The complete toolchain image is stored in `registry.brunner.ninja`. The
+first run for a new toolchain revision downloads Qt and the Android SDK, then
+publishes the image. Ordinary runs—including runs on a new or freshly cleaned
+runner—pull that image and skip the image build. Bump the `rN` suffix of
+`BUILD_IMAGE` in the workflow whenever the Dockerfile toolchain changes. Tags
+are treated as immutable; never reuse an existing revision for changed content.
+
+Documentation-only commits do not start this workflow. Source, build-system,
+toolchain, tag, and manually dispatched runs continue to build the application.
 
 Qt's current Gradle template is intentionally not copied into the source tree.
 `androiddeployqt` overlays the custom manifest and resources from
@@ -53,6 +58,23 @@ The workflow timeout is three hours because the uncached first image build is
 large. The toolchain image is cached independently from the ccache and Gradle
 caches stored by Gitea Actions.
 
+## Toolchain registry credentials
+
+Runners pull the public image anonymously. Publishing a new toolchain revision
+uses the existing credentials for `registry.brunner.ninja`. Add these repository
+secrets under **Settings > Actions > Secrets**:
+
+| Secret | Value |
+| --- | --- |
+| `REGISTRY_USERNAME` | Registry account allowed to push `feedc0de/evcharger-ci` |
+| `REGISTRY_PASSWORD` | Password or token for that registry account |
+
+The image is published as
+`registry.brunner.ninja/feedc0de/evcharger-ci:qt-6.11.1-r1`. Runners only use
+the credentials when the tag does not exist and must be built and pushed.
+Credentials are written to a per-job temporary authentication file and removed
+before the step exits.
+
 ## Signing secrets
 
 Without a keystore, the workflow deliberately produces unsigned validation