forked from kamba4/sunders
Use kaniko to build image #39
2026-11-15
chore: Re-adds Docker Compose test as disabled job
The compose smoke test needs a Docker daemon, which jobs on the current docker runner do not have. It is kept commented out so it can be re-enabled once such a runner exists.
fix: Uses repository registry credentials
This repository has REGISTRY_USERNAME/REGISTRY_TOKEN configured, not PACKAGES_TOKEN. Both are still only passed to kaniko when publishing from main.
fix: Builds images with kaniko on the docker runner
There are no Windows runners, so the workflow never ran. Builds now follow the kaniko setup used in CCCHH/oci-images: - kaniko in a container on the `docker` runner, one matrix job per image - authenticates as forgejo-actions with the PACKAGES_TOKEN secret - adds OCI annotations (ref.name, revision, url, source) Publishing is limited to pushes to refs/heads/main, which push `latest` and an immutable `sha-<commit>` tag. All other refs build with KANIKO_NO_PUSH and do not receive the token. Tags are no longer derived from ref names, so a branch named `latest` or a tag named `main` can no longer overwrite the production image. The docker compose smoke test is dropped, as there is no Docker daemon inside the kaniko container.