ci: add reusable container pipeline

.gitea/workflows/container-cd.yml

@@ -0,0 +1,84 @@
+name: Generic Container CI/CD
+
+on:
+  workflow_call:
+    inputs:
+      image_name:
+        description: Fully qualified image repository without a tag
+        required: true
+        type: string
+      dockerfile:
+        required: false
+        default: Dockerfile
+        type: string
+      build_context:
+        required: false
+        default: .
+        type: string
+      test_command:
+        description: Source-level test command supplied by the calling repository
+        required: false
+        default: ""
+        type: string
+      image_test_command:
+        description: Optional command executed inside the built image
+        required: false
+        default: ""
+        type: string
+      candidate_command:
+        description: Optional Dev candidate-stack command executed after image push
+        required: false
+        default: ""
+        type: string
+      promote_command:
+        description: Optional atomic Dev promotion command executed only for v* tags
+        required: false
+        default: ""
+        type: string
+    secrets:
+      REGISTRY_USERNAME:
+        required: true
+      REGISTRY_PASSWORD:
+        required: true
+      DEV_DEPLOY_SSH_KEY:
+        required: false
+
+jobs:
+  test-build-publish:
+    runs-on: ubuntu-22.04
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: meta
+        run: echo "image_tag=sha-${GITEA_SHA}" >> "$GITHUB_OUTPUT"
+      - name: Source tests
+        if: ${{ inputs.test_command != '' }}
+        run: ${{ inputs.test_command }}
+      - name: Build immutable candidate image
+        run: docker build --pull=false -f "${{ inputs.dockerfile }}" -t "${{ inputs.image_name }}:sha-${GITEA_SHA}" "${{ inputs.build_context }}"
+      - name: Image tests
+        if: ${{ inputs.image_test_command != '' }}
+        run: docker run --rm "${{ inputs.image_name }}:sha-${GITEA_SHA}" sh -lc '${{ inputs.image_test_command }}'
+      - name: Publish candidate image
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -eu
+          registry="$(printf '%s' '${{ inputs.image_name }}' | cut -d/ -f1)"
+          printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" -u "$REGISTRY_USERNAME" --password-stdin
+          docker push "${{ inputs.image_name }}:sha-${GITEA_SHA}"
+      - name: Candidate test on Dev
+        if: ${{ inputs.candidate_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
+        env:
+          DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
+        run: |
+          set -eu
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ${{ inputs.candidate_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"
+      - name: Promote release after candidate health check
+        if: ${{ startsWith(gitea.ref, 'refs/tags/v') && inputs.promote_command != '' && secrets.DEV_DEPLOY_SSH_KEY != '' }}
+        run: ${{ inputs.promote_command }} "${{ inputs.image_name }}:sha-${GITEA_SHA}"