ci: Gitea Actions workflow, check on every push, image build and push on master/foundations

Pushes only the refs of the current build (never --all-tags: the VM daemon also holds the local :rollback tag).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -0,0 +1,52 @@
+# CI: `npm run check` on every push; on master/foundations also build the image and push it to the Gitea registry.
+# It does not deploy: VM103 pulls the image with deploy/update.sh (docs/DEPLOY.md).
+name: ci
+
+on:
+  push:
+  workflow_dispatch:
+
+env:
+  # Job containers cannot reach Gitea through traefik (its ipwhitelist does not cover the runner networks),
+  # so checkout goes straight to the port Gitea publishes on VM103.
+  GITEA_INTERNAL_URL: http://192.168.0.139:13080
+  REGISTRY: git.mariuszpacek.pl
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    container:
+      image: node:24-bookworm@sha256:6dac556d980b7f0e5498d08f08cee0ca67798b4ad6c23964a9214920e67758d0
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ env.GITEA_INTERNAL_URL }}
+      - run: npm ci
+      - run: npm run check
+
+  publish:
+    needs: check
+    if: github.ref_name == 'master' || github.ref_name == 'foundations'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ env.GITEA_INTERNAL_URL }}
+      - name: Docker CLI available (talks to the VM daemon through the mounted socket)
+        run: command -v docker >/dev/null || (apt-get update -qq && apt-get install -y -qq docker.io >/dev/null); docker version --format '{{.Client.Version}} -> {{.Server.Version}}'
+      - name: Build and push
+        env:
+          REGISTRY_USER: ${{ github.repository_owner }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          image="${REGISTRY}/${GITHUB_REPOSITORY_OWNER}/homelab-upgrade"
+          branch="${GITHUB_REF_NAME//\//-}"
+          refs=("${image}:${GITHUB_SHA}" "${image}:${branch}")
+          [ "${GITHUB_REF_NAME}" = master ] && refs+=("${image}:latest")
+          printf '%s' "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          tag_args=(); for ref in "${refs[@]}"; do tag_args+=(-t "${ref}"); done
+          docker build --build-arg "REVISION=${GITHUB_SHA}" "${tag_args[@]}" .
+          # Push only these refs: the daemon is the VM's, so `--all-tags` would also push the local :rollback tag from update.sh.
+          for ref in "${refs[@]}"; do docker push "${ref}"; done
+          docker logout "${REGISTRY}"