Document Gitea CI and required secrets in README

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -167,6 +167,40 @@ cloud.google.com/go/compute v1.65.0. envtest uses the 1.36.2 binary
 bundle (the latest 1.36 patch with published binaries — do not "fix" the
 Makefile's derived version to 1.36.3, which has none).
 
+## Gitea CI
+
+[.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) builds the
+manager image and pushes it to this Gitea instance's container registry.
+It runs on **any tag push** or manually via **Run workflow** (with a `tag`
+input) — never on branch pushes. A lightweight `check` job (`go vet`,
+`go build`, `go test -short`) gates the build.
+
+Every build pushes two tags to
+`gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator`:
+
+- the human tag (the git tag, or the dispatch input), and
+- an immutable `sha-<12-char-commit>` tag — pin deployments to this one.
+
+`:latest` is additionally updated on real tag pushes only, so a manual
+dispatch of an old ref can never clobber it. The commit is baked into the
+binary (`internal/version.Commit`) via the `GIT_COMMIT` build arg.
+
+### Mandatory Gitea secrets
+
+Set under **Settings → Actions → Secrets** in this repo:
+
+| Secret           | Required by                   | What it is                               |
+| ---------------- | ----------------------------- | ---------------------------------------- |
+| `REGISTRY_TOKEN` | `build.yaml` (registry login) | Gitea PAT with the `write:package` scope |
+
+The token is paired with `${{ github.actor }}` as the username, so it
+must belong to the user triggering the workflow — same convention as the
+other projects on this instance.
+
+Without `REGISTRY_TOKEN` the `check` job still passes but the build job
+fails at the `docker login` step. No other secrets are needed — the
+workflow does not deploy anywhere.
+
 ## Development
 
 ```sh

docs/plans-executions/2026-08-11-1935-gitea-build-workflow.md

@@ -4,7 +4,7 @@ Plan: `docs/plans/2026-08-11-1935-gitea-build-workflow.md`
 
 - [x] Step 1 — Create `.gitea/workflows/build.yaml`
 - [x] Step 2 — Replace CLAUDE.md CI TODO with a CI/CD subsection
-- [ ] Step 3 — Push branch + open MR
+- [x] Step 3 — Push branch + open MR
 - [ ] Step 4 — CHANGELOG entry (after the first successful run is confirmed)
 
 ## Steps 1–2 — workflow + CLAUDE.md
@@ -34,6 +34,17 @@ ruby -ryaml -e "YAML.load_file('.gitea/workflows/build.yaml'); puts 'YAML OK'"
 go vet ./... && go build ./... && go test -short ./...   # all packages ok
 ```
 
+## Step 3 — push + MR
+
+Branch pushed and MR opened with `tea` (the worktree was then removed and the main
+checkout switched onto the branch so the files are visible locally):
+
+```bash
+tea pr create --title "Add Gitea Actions image-build workflow" \
+  --description "..." --base main --head feat/gitea-build-workflow
+# → https://gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/pulls/2
+```
+
 Worth noting: the workflow itself cannot run end-to-end until (a) the MR merges
 (it only triggers on tags / manual dispatch, not branch pushes) and (b) the
 `REGISTRY_TOKEN` secret is created in this repo's Gitea settings (PAT with