web: build image in CI, pull it in Terraform instead of building locally

templates/web's docker_image resource used a `build` block, so every
first-use of a new Dockerfile hash triggered a from-scratch build
(including the ~15-20min Rust toolchain compile) right at `terraform
apply` time - i.e. while someone was waiting to create a workspace.

Adds a build-web-image job to coder-templates.yml that builds and pushes
git.octoturge.com/octo-tech/profiles-web:<dockerfile-sha1> to this
instance's container registry, tagged identically to what
docker_image.web now computes and pulls (no build block). provision now
depends on build-web-image so a template never gets pushed pointing at
an image that isn't there yet. Skips the build entirely if that tag's
already in the registry, so an unrelated templates/* change doesn't
pay any cost.

Runs on a new dedicated "docker-build" runner (profiles-web-build),
scoped to just this repo via a repo-level registration token, with
host Docker socket access - deliberately not added to the existing
shared runner-1, which has no such access and stays untouched. Repo is
public, so the pulled image needs no registry auth; the push does, via
a new GITEA_PACKAGE_TOKEN repo secret (write:package scope).

Since CI and this Coder deployment share the same Docker daemon, the
"pull" is normally a same-host cache hit, not a real network pull.

Verified: `terraform validate` passes against the updated
templates/web/main.tf (run directly inside the coder-server container,
which has terraform embedded).

templates/3d-printing/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/cobol/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/default/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/python/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/ttrpg/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi

templates/web/cli-setup-wizard.sh

@@ -143,12 +143,11 @@ else
     fi
   fi
 fi
-TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
-fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -186,13 +185,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
-      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
-          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
       fi
     fi
 
@@ -226,13 +222,10 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
-        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
-            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
-            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
         fi
       fi
     fi