Publish tested website images to Gitea Registry

.gitea/workflows/container.yml

@@ -1,4 +1,4 @@
-name: Build and test website container
+name: Build and publish website container
 
 on:
   push:
@@ -11,6 +11,9 @@ jobs:
     timeout-minutes: 35
     container:
       image: docker:29.1.3-cli
+    env:
+      IMAGE_REPOSITORY: gitea.kenanzhu.com/autolibrary/website
+      RELEASE_SHA: ${{ gitea.sha }}
     steps:
       - name: Install checkout tools
         shell: sh
@@ -24,12 +27,34 @@ jobs:
 
       - name: Build and test the image
         shell: bash
-        env:
-          RELEASE_SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
           docker info --format '{{range .SecurityOptions}}{{println .}}{{end}}' | grep -Fx 'name=rootless'
-          image="autolibrary-web:${RELEASE_SHA}"
-          trap 'docker image rm "$image" >/dev/null || true' EXIT
+          image="${IMAGE_REPOSITORY}:${RELEASE_SHA}"
           docker build -t "$image" .
           bash deploy/smoke-container.sh "$image"
+
+      - name: Push the tested image to Gitea
+        if: ${{ gitea.ref == 'refs/heads/main' || gitea.ref == 'refs/heads/container-ci' }}
+        shell: bash
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          : "${REGISTRY_USERNAME:?Add the REGISTRY_USERNAME repository secret}"
+          : "${REGISTRY_TOKEN:?Add the REGISTRY_TOKEN repository secret}"
+          DOCKER_CONFIG=$(mktemp -d)
+          export DOCKER_CONFIG
+          trap 'rm -rf -- "$DOCKER_CONFIG"' EXIT
+          printf '%s\n' "$REGISTRY_TOKEN" | docker login "${IMAGE_REPOSITORY%%/*}" \
+            --username "$REGISTRY_USERNAME" --password-stdin
+          docker push "${IMAGE_REPOSITORY}:${RELEASE_SHA}" | tee "$DOCKER_CONFIG/push.log"
+          digest=$(awk '$2 == "digest:" {print $3}' "$DOCKER_CONFIG/push.log")
+          [[ $digest =~ ^sha256:[0-9a-f]{64}$ ]]
+          echo "Published ${IMAGE_REPOSITORY}@${digest}"
+
+      - name: Remove the local image tag
+        if: always()
+        shell: bash
+        run: docker image rm "${IMAGE_REPOSITORY}:${RELEASE_SHA}" >/dev/null 2>&1 || true