From 6197c649b33b128897e1fb1f3ea2a3170c0a15f8 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@noreply.git.mcintire.me>
Date: Fri, 24 Jul 2026 14:36:26 -0500
Subject: [PATCH] Use Kaniko for Docker builds

---
 .forgejo/workflows/build.yaml | 115 ++++------------------------------
 1 file changed, 13 insertions(+), 102 deletions(-)

diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 4dc0fba8..a213d5c8 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -5,10 +5,6 @@ on:
     branches:
       - main
 
-# Hosted on Codeberg's container registry. Registry host + creds
-# are sourced from the shared REGISTRY_URL / REGISTRY_USER /
-# REGISTRY_PASSWORD secrets so the registry can be rotated without
-# editing every workflow file.
 env:
   REGISTRY: git.mcintire.me
   IMAGE_NAME: graham/prop
@@ -26,56 +22,6 @@ jobs:
       - name: Checkout code
         uses: https://github.com/actions/checkout@v4
 
-      - name: Install Docker CLI and buildx
-        run: |
-          # Dodge apt entirely — the runner image's bookworm repos have been
-          # failing GPG verification with "At least one invalid signature".
-          # The static Docker client binary talks to the host's daemon socket
-          # that act_runner mounts into the job container. buildx is needed
-          # separately because the Dockerfile uses `--mount=type=cache`,
-          # which is a BuildKit-only feature.
-          curl -fsSL -o /tmp/docker.tgz \
-            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
-          tar xzf /tmp/docker.tgz -C /tmp
-          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
-          rm -rf /tmp/docker /tmp/docker.tgz
-
-          mkdir -p /usr/libexec/docker/cli-plugins
-          curl -fsSL -o /usr/libexec/docker/cli-plugins/docker-buildx \
-            https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
-          chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
-
-          docker --version
-          docker buildx version
-
-      - name: Wait for Docker daemon
-        run: |
-          # act_runner mounts the host docker socket into the job, but
-          # the daemon side sometimes takes a moment to answer. Poll
-          # `docker info` until it responds so the login/build steps
-          # below don't race the socket and fail with "unable to
-          # connect to docker".
-          sock="${DOCKER_HOST:-unix:///var/run/docker.sock}"
-          echo "Using DOCKER_HOST=${sock}"
-
-          for i in $(seq 1 30); do
-            if docker info >/dev/null 2>&1; then
-              echo "Docker daemon reachable after ${i}s"
-              exit 0
-            fi
-            echo "Waiting for Docker daemon... ($i/30)"
-            sleep 1
-          done
-
-          echo "Docker daemon never became reachable — diagnostics:" >&2
-          echo "--- ls -l /var/run/docker.sock ---" >&2
-          ls -l /var/run/docker.sock 2>&1 || true
-          echo "--- env | grep -i docker ---" >&2
-          env | grep -i docker 2>&1 || true
-          echo "--- docker info (verbose) ---" >&2
-          docker info 2>&1 || true
-          exit 1
-
       - name: Generate image tag
         id: tag
         run: |
@@ -84,52 +30,17 @@ jobs:
           TAG="main-${TIMESTAMP}-${SHORT_SHA}"
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
-      - name: Log in to container registry
-        run: |
-          # Exponential backoff (2s, 4s, 8s) around docker login to
-          # ride out transient registry blips without failing the
-          # whole workflow.
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if echo "${{ secrets.FORGEJO_TOKEN }}" | \
-                docker login "${{ env.REGISTRY }}" \
-                  -u "graham" \
-                  --password-stdin; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker login failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker login attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
+      - name: Build and Push via Kaniko
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: ${{ steps.tag.outputs.tag }}
 
-      - name: Build and push Docker image
-        run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-          BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if docker buildx build \
-                --build-arg BUILD_TIMESTAMP="${BUILD_TIMESTAMP}" \
-                -t "${IMAGE}:${TAG}" -t "${IMAGE}:latest" \
-                --push \
-                .; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker buildx build failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker buildx build attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
+      - name: Tag as latest
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: latest
+          extra_args: ""