Switch to composite actions (Forgejo 11 lacks workflow_call)

build-push/action.yaml

@@ -0,0 +1,47 @@
+name: build-push
+description: >
+  Language-agnostic image build + push to the homelab Forgejo registry.
+  The app's Dockerfile owns the toolchain. Run after actions/checkout, on
+  the `host` runner label (host docker daemon has the insecure-registry
+  config -- see homelab nixos/hosts/forgejo/default.nix). Tags pushed:
+  <short-sha> and latest.
+inputs:
+  app-name:
+    description: Image name (registry path is <registry>/<owner>/<app-name>)
+    required: true
+  context:
+    description: Docker build context
+    required: false
+    default: "."
+  dockerfile:
+    description: Path to Dockerfile
+    required: false
+    default: Dockerfile
+  registry:
+    description: Registry host:port
+    required: false
+    default: "192.168.1.230:3000"
+  registry-user:
+    description: Registry login user (pass secrets.REGISTRY_USER)
+    required: true
+  registry-token:
+    description: Registry token, write:package scope (pass secrets.REGISTRY_TOKEN)
+    required: true
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        REGISTRY_USER: ${{ inputs.registry-user }}
+        REGISTRY_TOKEN: ${{ inputs.registry-token }}
+      run: |
+        set -euo pipefail
+        TAG="${GITHUB_SHA:0:8}"
+        IMAGE="$REGISTRY/$GITHUB_REPOSITORY_OWNER/${{ inputs.app-name }}"
+        echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+        docker build -f "${{ inputs.dockerfile }}" \
+          --build-arg GIT_SHA="$TAG" \
+          -t "$IMAGE:$TAG" -t "$IMAGE:latest" "${{ inputs.context }}"
+        docker push "$IMAGE:$TAG"
+        docker push "$IMAGE:latest"