From 0643ff76c8260a93c98b91f06eedab9f4f5b2963 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@noreply.git.mcintire.me>
Date: Fri, 24 Jul 2026 14:36:27 -0500
Subject: [PATCH] Use Kaniko for Docker builds

---
 .forgejo/workflows/build-grid-rs.yaml | 117 ++++----------------------
 1 file changed, 15 insertions(+), 102 deletions(-)

diff --git a/.forgejo/workflows/build-grid-rs.yaml b/.forgejo/workflows/build-grid-rs.yaml
index 3e480ec4..7f194888 100644
--- a/.forgejo/workflows/build-grid-rs.yaml
+++ b/.forgejo/workflows/build-grid-rs.yaml
@@ -1,7 +1,5 @@
 name: Build prop-grid-rs
 
-# Path-filtered so this doesn't fire on every Elixir push — only when the
-# Rust crate or the workflow itself changes.
 on:
   push:
     branches:
@@ -10,7 +8,6 @@ on:
       - 'rust/prop_grid_rs/**'
       - '.forgejo/workflows/build-grid-rs.yaml'
 
-# Hosted on Codeberg's container registry. Same setup as build.yaml.
 env:
   REGISTRY: git.mcintire.me
   IMAGE_NAME: graham/prop-grid-rs
@@ -28,55 +25,6 @@ jobs:
       - name: Checkout code
         uses: https://github.com/actions/checkout@v4
 
-      # Same static-binary dance as .forgejo/workflows/build.yaml — the
-      # runner image's apt repos have failing GPG signatures, so we bypass
-      # them entirely. buildx is needed for the BuildKit-only
-      # `--mount=type=cache` feature the Dockerfile uses.
-      - name: Install Docker CLI and buildx
-        run: |
-          curl -fsSL -o /tmp/docker.tgz \
-            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
-          tar xzf /tmp/docker.tgz -C /tmp
-          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
-          rm -rf /tmp/docker /tmp/docker.tgz
-
-          mkdir -p /usr/libexec/docker/cli-plugins
-          curl -fsSL -o /usr/libexec/docker/cli-plugins/docker-buildx \
-            https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
-          chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
-
-          docker --version
-          docker buildx version
-
-      - name: Wait for Docker daemon
-        run: |
-          # act_runner mounts the host docker socket into the job, but
-          # the daemon side sometimes takes a moment to answer. Poll
-          # `docker info` until it responds so the login/build steps
-          # below don't race the socket and fail with "unable to
-          # connect to docker". Mirrors the diagnostics in build.yaml
-          # so failures surface *why* the socket is unreachable.
-          sock="${DOCKER_HOST:-unix:///var/run/docker.sock}"
-          echo "Using DOCKER_HOST=${sock}"
-
-          for i in $(seq 1 30); do
-            if docker info >/dev/null 2>&1; then
-              echo "Docker daemon reachable after ${i}s"
-              exit 0
-            fi
-            echo "Waiting for Docker daemon... ($i/30)"
-            sleep 1
-          done
-
-          echo "Docker daemon never became reachable — diagnostics:" >&2
-          echo "--- ls -l /var/run/docker.sock ---" >&2
-          ls -l /var/run/docker.sock 2>&1 || true
-          echo "--- env | grep -i docker ---" >&2
-          env | grep -i docker 2>&1 || true
-          echo "--- docker info (verbose) ---" >&2
-          docker info 2>&1 || true
-          exit 1
-
       - name: Generate image tag
         id: tag
         run: |
@@ -85,54 +33,19 @@ jobs:
           TAG="main-${TIMESTAMP}-${SHORT_SHA}"
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
-      - name: Log in to container registry
-        run: |
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if echo "${{ secrets.FORGEJO_TOKEN }}" | \
-                docker login "${{ env.REGISTRY }}" \
-                  -u "graham" \
-                  --password-stdin; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker login failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker login attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
+      - name: Build and push via Kaniko
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          context: rust/prop_grid_rs
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: ${{ steps.tag.outputs.tag }}
 
-      # Push three tags so (a) `:main` is a stable handle the k8s manifest
-      # can pin to without flux image-automation wired up, (b) `:latest`
-      # mirrors the Elixir workflow for consistency, (c) the timestamped
-      # tag is what flux image-automation picks up when we add an
-      # ImagePolicy later.
-      - name: Build and push Docker image
-        run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if docker buildx build \
-                -t "${IMAGE}:${TAG}" \
-                -t "${IMAGE}:latest" \
-                -t "${IMAGE}:main" \
-                --push \
-                rust/prop_grid_rs; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker buildx build failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker buildx build attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
+      - name: Tag as latest and main
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          context: rust/prop_grid_rs
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: latest
+          extra_args: ""