From 975e11e077d9a47f4fff1f0edef9b3cd3bfcfa52 Mon Sep 17 00:00:00 2001
From: dhkatz <dev@t5de.dev>
Date: Sat, 31 Oct 2026 15:53:10 +0000
Subject: [PATCH] CI builds and pushes the images; Komodo only deploys

After the tests pass, main pushes :latest-main and :main-<commit>, and vX.Y.Z tags push :X.Y.Z, :X.Y and
:latest to git.t5de.dev (registry login: the t5de org secret REGISTRY_TOKEN). Komodo deploys them once the
ref's CI has passed; it no longer builds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a25d450..002ce61 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,9 +1,11 @@
-# Type-checks, tests (the API against PGlite, an in-process Postgres) and builds the hub.
+# Type-checks, tests (the API against PGlite, an in-process Postgres) and builds the hub; then, for main and vX.Y.Z
+# tags, builds its images and pushes them to git.t5de.dev. Komodo deploys them (dhkatz/infra); CI never deploys.
 name: CI
 
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
   workflow_dispatch:
 
@@ -32,3 +34,37 @@ jobs:
 
       - name: Build
         run: bun run build
+
+  # main → :latest-main and :main-<commit>; vX.Y.Z → :X.Y.Z, :X.Y and :latest. Built by the runner's Docker.
+  image:
+    needs: test
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - { image: t5de-hub-api, dockerfile: apps/api/Dockerfile }
+          - { image: t5de-hub-web, dockerfile: apps/web/Dockerfile }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build and push
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          IMAGE: git.t5de.dev/t5de/${{ matrix.image }}
+          DOCKERFILE: ${{ matrix.dockerfile }}
+        run: |
+          case "$GITHUB_REF" in
+            refs/heads/main) version="main-${GITHUB_SHA::12}"; tags="latest-main $version" ;;
+            refs/tags/v*)
+              version="${GITHUB_REF#refs/tags/v}"
+              [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Not a vX.Y.Z tag: no image"; exit 0; }
+              tags="$version ${version%.*} latest" ;;
+            *) echo "Not main or a tag: no image"; exit 0 ;;
+          esac
+          echo "$REGISTRY_TOKEN" | docker login git.t5de.dev -u deploy --password-stdin
+          docker build -f "$DOCKERFILE" --label org.opencontainers.image.source="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --label org.opencontainers.image.revision="$GITHUB_SHA" --label org.opencontainers.image.version="$version" \
+            $(for t in $tags; do echo "-t $IMAGE:$t"; done) .
+          for t in $tags; do docker push -q "$IMAGE:$t"; done
+          docker logout git.t5de.dev