Use Kaniko for Docker builds

.forgejo/workflows/production.yaml

@@ -5,10 +5,6 @@ on:
     branches:
       - main
 
-# Image hosted on Codeberg's container registry. The shared
-# REGISTRY_USER / REGISTRY_PASSWORD secrets carry Codeberg credentials;
-# login URL is the hardcoded env.REGISTRY rather than secrets.REGISTRY_URL
-# so a stale URL secret can't push to the wrong registry.
 env:
   REGISTRY: git.mcintire.me
   IMAGE_NAME: graham/towerops
@@ -115,100 +111,26 @@ jobs:
           SHORT_SHA=$(git rev-parse --short=7 HEAD | cut -c1-7)
           TAG="${BRANCH}-${TIMESTAMP}-${SHORT_SHA}"
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "Full image tag: ${TAG}"
 
-      # Static docker + buildx download. The runner image's bookworm
-      # apt repos have broken GPG signatures, so we bypass apt entirely.
-      # buildx is needed because k8s/Dockerfile uses `# syntax=` and
-      # pulls FROM the prebuilt towerops-base — buildx authenticates
-      # against Codeberg via the docker login below.
-      - name: Install Docker CLI and buildx
-        run: |
-          curl -fsSL -o /tmp/docker.tgz \
-            https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz
-          tar xzf /tmp/docker.tgz -C /tmp
-          install -m 0755 /tmp/docker/docker /usr/local/bin/docker
-          rm -rf /tmp/docker /tmp/docker.tgz
+      - name: Build and Push via Kaniko
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          dockerfile: k8s/Dockerfile
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: ${{ steps.tag.outputs.tag }}
 
-          mkdir -p /usr/libexec/docker/cli-plugins
-          curl -fsSL -o /usr/libexec/docker/cli-plugins/docker-buildx \
-            https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
-          chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
-
-          docker --version
-          docker buildx version
-
-      - name: Wait for Docker daemon
-        run: |
-          for i in $(seq 1 30); do
-            if docker info >/dev/null 2>&1; then
-              echo "Docker daemon reachable after ${i}s"
-              exit 0
-            fi
-            echo "Waiting for Docker daemon... ($i/30)"
-            sleep 1
-          done
-          echo "Docker daemon never became reachable" >&2
-          exit 1
-
-      # Login BEFORE the build so buildx can pull the private base image.
-      - name: Log in to Codeberg container registry
-        run: |
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if echo "${{ secrets.FORGEJO_TOKEN }}" | \
-                docker login "${{ env.REGISTRY }}" \
-                  -u "graham" \
-                  --password-stdin; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker login failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker login attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
-
-      - name: Build and push Docker image
-        run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-
-          attempt=1
-          max_attempts=3
-          while : ; do
-            if docker buildx build \
-                --build-arg MIX_ENV=prod \
-                --file k8s/Dockerfile \
-                -t "${IMAGE}:${TAG}" \
-                -t "${IMAGE}:production" \
-                --push \
-                .; then
-              exit 0
-            fi
-            if [ "$attempt" -ge "$max_attempts" ]; then
-              echo "docker buildx build failed after $attempt attempts" >&2
-              exit 1
-            fi
-            delay=$((2 ** attempt))
-            echo "docker buildx build attempt $attempt failed; retrying in ${delay}s"
-            sleep "$delay"
-            attempt=$((attempt + 1))
-          done
+      - name: Tag as production
+        uses: graham/infra/.forgejo/actions/kaniko-build@main
+        with:
+          dockerfile: k8s/Dockerfile
+          token: ${{ secrets.FORGEJO_TOKEN }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tag: production
+          extra_args: ""
 
       - name: Deployment summary
         run: |
           echo "### ✅ Image Built and Pushed" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Image:** \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "FluxCD will automatically detect and deploy the new image." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Monitor deployment:**" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
-          echo "kubectl rollout status deployment/towerops -n towerops" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY