Move to Gitea: Gitea Actions workflow (BlueBuild CLI), registry git.lazypugs.com

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,41 @@
+# Gitea Actions workflow. Uses the BlueBuild CLI directly — the blue-build/github-action
+# is a GitHub-context composite and is not supported outside GitHub/GitLab CI.
+# Runner requirement: act_runner must allow privileged job containers
+# (container.privileged: true in the runner's config.yaml) — buildah needs it.
+name: bluebuild
+on:
+  schedule:
+    - cron: "00 06 * * *" # daily rebuild pulls in base-image updates (self-updating)
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+  workflow_dispatch:
+
+jobs:
+  bluebuild:
+    name: Build Custom Image
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/blue-build/cli:v0.9
+      options: --privileged
+    env:
+      # Auto-signs on push when this + cosign.pub (repo root) are present.
+      COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+      # Gitea's auto job token cannot push packages (documented limitation),
+      # so registry auth uses a PAT with write:package scope.
+      BB_REGISTRY: git.lazypugs.com
+      BB_REGISTRY_NAMESPACE: ckoch
+      BB_USERNAME: ckoch
+      BB_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      # Plain clone instead of actions/checkout: the CLI job container isn't
+      # guaranteed to have node, and the repo is public.
+      - name: Clone repo
+        run: |
+          git config --global --add safe.directory "$(pwd)"
+          git clone --depth 1 --branch "${GITHUB_REF_NAME:-main}" "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .
+
+      - name: Build and push signed image
+        run: bluebuild build --verbose --push --retry-push recipes/recipe.yml