Distilled from the image-build workflows across the other projects on this Gitea instance, plus a few improvements none of them combine:
Triggers: any tag push, or manual workflow_dispatch with a tag input (house convention — no builds from main).
Lightweight test gate before the build: go vet / go build / go test -short (verified passing locally on this exact tree).
Pushes gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator:<tag>plus an immutable sha-<12> tag on every build.
:latest moves only on real tag pushes — a manual dispatch of an old ref can't clobber it.
GIT_COMMIT build arg wired to the Dockerfile so internal/version.Commit and the OCI revision label get the real commit.
concurrency group cancels superseded runs of the same ref.
Also replaces the CLAUDE.md CI TODO with a CI/CD subsection, and includes the plan + execution notes in docs/.
Prerequisite before first run: create the REGISTRY_TOKEN secret in this repo (Settings → Actions → Secrets) — a Gitea PAT with write:package, same as the other projects.
Suggested verification after merge: manual dispatch with tag manual-test → expect manual-test + sha-… in Packages and :latest untouched; then a real v0.1.0 tag → expect all three tags.
Distilled from the image-build workflows across the other projects on this Gitea instance, plus a few improvements none of them combine:
- Triggers: any tag push, or manual workflow_dispatch with a `tag` input (house convention — no builds from main).
- Lightweight test gate before the build: `go vet` / `go build` / `go test -short` (verified passing locally on this exact tree).
- Pushes `gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator:<tag>` **plus an immutable `sha-<12>` tag** on every build.
- `:latest` moves **only on real tag pushes** — a manual dispatch of an old ref can't clobber it.
- `GIT_COMMIT` build arg wired to the Dockerfile so `internal/version.Commit` and the OCI revision label get the real commit.
- `concurrency` group cancels superseded runs of the same ref.
Also replaces the CLAUDE.md CI TODO with a CI/CD subsection, and includes the plan + execution notes in `docs/`.
**Prerequisite before first run:** create the `REGISTRY_TOKEN` secret in this repo (Settings → Actions → Secrets) — a Gitea PAT with `write:package`, same as the other projects.
**Suggested verification after merge:** manual dispatch with tag `manual-test` → expect `manual-test` + `sha-…` in Packages and `:latest` untouched; then a real `v0.1.0` tag → expect all three tags.
Distilled from the house pattern across sibling projects: tag push +
workflow_dispatch triggers, REGISTRY_TOKEN login, raw docker build/push
to gitea.home.hrajfrisbee.cz. Adds a lightweight test gate, an immutable
sha-<12> tag, :latest only on real tag pushes, and a concurrency group.
Co-Authored-By: Claude <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Distilled from the image-build workflows across the other projects on this Gitea instance, plus a few improvements none of them combine:
taginput (house convention — no builds from main).go vet/go build/go test -short(verified passing locally on this exact tree).gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator:<tag>plus an immutablesha-<12>tag on every build.:latestmoves only on real tag pushes — a manual dispatch of an old ref can't clobber it.GIT_COMMITbuild arg wired to the Dockerfile sointernal/version.Commitand the OCI revision label get the real commit.concurrencygroup cancels superseded runs of the same ref.Also replaces the CLAUDE.md CI TODO with a CI/CD subsection, and includes the plan + execution notes in
docs/.Prerequisite before first run: create the
REGISTRY_TOKENsecret in this repo (Settings → Actions → Secrets) — a Gitea PAT withwrite:package, same as the other projects.Suggested verification after merge: manual dispatch with tag
manual-test→ expectmanual-test+sha-…in Packages and:latestuntouched; then a realv0.1.0tag → expect all three tags.