ci: container build workflow

- Tune .gitignore
- Pin cert for gitea

.gitea/workflows/push.yaml

@@ -0,0 +1,72 @@
+name: push
+run-name: Push action runner container to registry
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - "Dockerfile"
+      - "gitea-ca.pem"
+      - ".gitea/workflows/**"
+
+env:
+  REGISTRY: 192.168.1.33
+  IMAGE_NAME: gitea-masters/runners
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: actions/setup-qemu-action@v3
+
+      - name: Fetch registry TLS certificate
+        run: |
+          mkdir -p "$RUNNER_TEMP/certs"
+          for host in 192.168.1.33 192.168.1.90; do
+            openssl s_client -connect "$host:443" -servername "$host" </dev/null 2>/dev/null \
+              | openssl x509 -outform PEM > "$RUNNER_TEMP/certs/$host.crt"
+          done
+          cat "$RUNNER_TEMP/certs/"*.crt
+
+      - name: Build custom buildkit image with trusted CA
+        run: |
+          cat > "$RUNNER_TEMP/Dockerfile.buildkit" <<'EOF'
+          FROM moby/buildkit:buildx-stable-1
+          COPY certs/*.crt /usr/local/share/ca-certificates/
+          RUN cat /usr/local/share/ca-certificates/*.crt >> /etc/ssl/certs/ca-certificates.crt
+          EOF
+          docker build -t local/buildkit-with-ca:latest \
+            -f "$RUNNER_TEMP/Dockerfile.buildkit" "$RUNNER_TEMP"
+
+      - name: Set up Docker Buildx
+        uses: actions/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: |
+            image=local/buildkit-with-ca:latest
+
+      - name: Login to registry
+        uses: actions/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.OCI_TOKEN }}
+
+      - name: docker
+        uses: actions/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: |
+            linux/amd64
+            linux/arm64/v8
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ gitea.ref_name }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+

.gitignore

@@ -1,4 +1,3 @@
 .env
 .docker
-*.pem
 docker-compose.yaml

Dockerfile

@@ -1,6 +1,6 @@
-FROM docker.gitea.com/runner-images@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
+FROM 192.168.1.90/gitea/runner-images:latest
 
-COPY gitea-ca.pem /usr/local/share/ca-certificates/gitea-ca.crt
+COPY ./gitea-ca.pem /usr/local/share/ca-certificates/gitea-ca.crt
 RUN update-ca-certificates
 
 ENV NODE_OPTIONS="--use-system-ca"

gitea-ca.pem

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFGDCCAwCgAwIBAgIUQJtepbe1U2C3TXO1q7eRukkHhgAwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIaW50ZXJuYWwwHhcNMjYwODIzMTE0OTMxWhcNMjcwODIz
+MTE0OTMxWjATMREwDwYDVQQDDAhpbnRlcm5hbDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAJnVjeTwEaZeeqfNwDCCz9hwosWm8agv45eHJEG2UYOEXCea
+f/hJzHICikHnYxLnP0vOJ7lQQh0hAaSqFBitIpqml3DFMbSRY2ajM/rUTbwdk5F2
+7zqolpGHKH/JPuSN/C0lxCmbG28lEbpm9b7WeZD2/WJJYq1y4rNuvzkOAPTlUjKR
+QGdxPQaj0sbuoeBIkrL51ldyPgrO/SyDuRBu2Rny3fX4Vt/wZoU0w0yxG7FiL4n2
+JHEF4+DS8w0gWyYUGmcSADgPcNuT8HGVe7rw3dUOr7IDOrrxObHN4Zq29DfsoS9o
+bq/YTwG/yEHFiUYDEojBv/Aa9/ieTkq7ztnlCJwrTb7LAnkdWk4KIsm3iiKfh/t3
+iHPcj2ftOb59HbVsmoAaMcI01IyZonpoFkgEfBdTG1efq4yk5O0NTGax/w/1jeTL
+Di5ZPHAWiMoCPUVRl4C5+IXTUkoAOkfQKsbNSLILdaOJ7keIGp+HRfv3+A2TWP0l
+12Cf3+v4Zi29gg02KRLgqpqVNbgAclDMO1vZYQoNuDNXyEWo7bieSapt9d7Ab5bR
+95SJw9gr4RdonffHYg6lmfZDRSWF2jpIwNqzb5QsscIuwQjDAGjy4Opg1ui3i1ja
+odZIWcLza9oBvABvmsk8xH12O8UxbV6oK3yU7E26iZ3e91S2XhQWiYkqxDiXAgMB
+AAGjZDBiMB0GA1UdDgQWBBRhRYY4Ko1OCfyNBifJK9DT8hjcMTAfBgNVHSMEGDAW
+gBRhRYY4Ko1OCfyNBifJK9DT8hjcMTAPBgNVHRMBAf8EBTADAQH/MA8GA1UdEQQI
+MAaHBMCoASEwDQYJKoZIhvcNAQELBQADggIBABg8eOYu6Duv2UW7E9epNuHntqR6
+ySM3/5ES7ANaFre88Mf3Lc7DKoHDjVwZUvIz7o8U2ByYjBaCbkL1eGdmmWrK3pta
+w2GYLALYvDwalKEPPycd9uIGrzyOBbnxYn+Y+5kB4bI7oSMlvJuGydHrRICVAJkz
+WKR1tbH3qv9T70pSmigkKXqxFtzOf6oLI33sUUO7ShODsUIRlrC7GXmXR2PrUaux
+jTnUsgFslKEReBCa5SHaUcql5q1rYeb1FrbeBXBeqFjAhCv0Ocx93F5aXSQoUjdZ
+neUhX4S+fo31l4bb5WTvv+CK+vBRDb9odwXX19KEzCs7bd7z1gg83RbvJLyi9if7
+6D40h2zu1le70NThEkgx82s+OMSdTHKkmjf0EVmFkuHRpwfl7fVCFKmRGA0aed1c
+NCc/ZEclzWItSoxtDfXx2YsUPkZp41Fc77KHot7o1D6uELqUve0qODNBLeiHA6K+
+4BYbQJ0Ec4C9zZkOhXz/kHUBlcMtxNqWT1qaL/i6wMGm1S0xxX0Mme/3c2ae51a1
+Xb1Oms9QYfSrACsBUHbm9412Ke4AW8w+MM0SQmGdksKPvLHooV6u09GQW5dL6uD4
+CA16ikKeZzPP+XRPN+JlQhBzZdnjgqb3OHrE9T2JL1//KPSKBtnyBCwdcJk5DuRK
+XAU1LOPeYy4gcbOX
+-----END CERTIFICATE-----