ci: use Gitea's built-in GITEA_TOKEN for registry push, drop manual PAT

GITEA_PACKAGE_TOKEN was never a creatable secret name (GITEA_ prefix is
reserved), and Gitea Actions' built-in token can be granted registry
write access directly via `permissions: packages: write` (per
https://docs.gitea.com/usage/actions/token-permissions/) - the
"unauthorized: reqPackageAccess" issue noted earlier looks to have been
exactly this: the default restricted token mode denying package write
unless a job explicitly requests it, not an unfixable bug in the token
itself. Drops the manual-PAT requirement entirely - no secret to create
or maintain.

.gitea/workflows/coder-templates.yml

@@ -13,19 +13,26 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
-#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
-#                          with write:package scope, for pushing templates/web's
-#                          image to this instance's container registry. Only
-#                          the octoturge account's own token is used - login()
-#                          hardcodes that username to match.
 #
-# templates/web builds its Docker image here (build-web-image, on the
+# Pushing each Dockerfile-having template's image to this instance's
-# dedicated "docker-build" runner - see templates/web/main.tf for why: that
+# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
-# runner is scoped to this repo only and has host Docker socket access that
+# manually-created PAT needed) - build-images grants it write access via
-# the shared runner-1 deliberately doesn't). provision then just pulls the
+# `permissions: packages: write` below. See
-# tag build-web-image produced, instead of building it itself at
+# https://docs.gitea.com/usage/actions/token-permissions/
-# `terraform apply` time - keeps the slow Rust toolchain compile off of
+#
-# "someone is waiting to create a workspace".
+# Any templates/<env>/ that has its own Dockerfile gets its image built and
+# pushed here (build-images, on the dedicated "docker-build" runner - see
+# templates/web/main.tf for why: that runner is scoped to this repo only and
+# has host Docker socket access that the shared runner-1 deliberately
+# doesn't). provision then just pulls the tag build-images produced, instead
+# of building it itself at `terraform apply` time - keeps a slow toolchain
+# compile off of "someone is waiting to create a workspace".
+#
+# Each template's image is built independently - one Dockerfile failing to
+# build doesn't stop the others from building, and provision skips pushing
+# only the specific template(s) whose image build failed this run (leaving
+# their previous, already-working Coder template version in place) rather
+# than skipping every template or pushing one with no matching image.
 
 on:
   push:
@@ -36,34 +43,82 @@ on:
   workflow_dispatch: {}
 
 jobs:
-  build-web-image:
+  build-images:
+    # The docker-build runner's docker_host: "" setting already auto-injects
+    # /var/run/docker.sock into job containers - an explicit
+    # container.volumes mount for the same path here fails at container
+    # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
-    container:
+    # The default token permission mode denies package write unless a job
-      volumes:
+    # explicitly asks for it - without this, docker push fails with
-        - /var/run/docker.sock:/var/run/docker.sock
+    # "unauthorized: reqPackageAccess".
+    permissions:
+      packages: write
+    outputs:
+      failed_templates: ${{ steps.build.outputs.failed_templates }}
+    # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
+    # ash) - but run: steps default to bash, which fails with "exec: bash:
+    # executable file not found in $PATH". Both run: steps below are plain
+    # POSIX shell already, so just run them under sh.
+    defaults:
+      run:
+        shell: sh
     steps:
+      # actions/checkout is a JS action and needs Node in the job container -
+      # this job runs in docker:27-cli (Alpine, just the Docker CLI) so it has
+      # no Node, and actions/checkout fails immediately with "exec: node:
+      # executable file not found in $PATH". Alpine does have apk/git though,
+      # so clone directly instead.
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Build and push templates/web's image (skips if the tag already exists)
         run: |
           set -e
-          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
+          apk add --no-cache git
-          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
+          git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" .
-          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+
+      - name: Build and push every template's image (skips a tag that's already in the registry)
+        id: build
+        run: |
+          set -e
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
+
+          FAILED=""
+          for dockerfile in templates/*/Dockerfile; do
+            [ -e "$dockerfile" ] || continue
+            dir="$(dirname "$dockerfile")"
+            name="$(basename "$dir")"
+            TAG="$(sha1sum "$dockerfile" | cut -d' ' -f1)"
+            IMAGE="git.octoturge.com/octo-tech/profiles-${name}:${TAG}"
+
+            echo "::group::${name}"
             if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
               echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
-            exit 0
+            elif docker build -t "$IMAGE" "$dir" && docker push "$IMAGE"; then
+              echo "Built and pushed $IMAGE"
+            else
+              echo "::warning::Failed to build/push $IMAGE - templates/$name will be skipped this run."
+              FAILED="$FAILED $name"
             fi
-          docker build -t "$IMAGE" templates/web
+            echo "::endgroup::"
-          docker push "$IMAGE"
+          done
+
+          echo "failed_templates=${FAILED# }" >> "$GITHUB_OUTPUT"
 
   provision:
-    needs: build-web-image
+    # needs: build-images orders this after the image builds (so a fresh
+    # template push never points at a tag that isn't in the registry yet)
+    # without making every template's reprovisioning depend on ALL builds
+    # succeeding - if:always() overrides the default "skip if a dependency
+    # failed" behavior, since build-images only fails outright on an
+    # infra-level problem (e.g. registry login); a single template's build
+    # failure is reported via failed_templates instead and only skips that
+    # one template below.
+    needs: build-images
+    if: always()
     runs-on: ubuntu-latest
     env:
       CODER_URL: ${{ secrets.CODER_URL }}
       CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
+      FAILED_TEMPLATES: ${{ needs.build-images.outputs.failed_templates }}
     steps:
       - name: Checkout (full history, needed to detect removed templates)
         uses: actions/checkout@v4
@@ -80,9 +135,16 @@ jobs:
         run: |
           set -e
           for dir in templates/*/; do
-            name="profiles-$(basename "$dir")"
+            name="$(basename "$dir")"
-            echo "::group::Pushing $name from $dir"
+            full="profiles-$name"
-            coder templates push "$name" -d "$dir" --yes \
+            case " $FAILED_TEMPLATES " in
+              *" $name "*)
+                echo "::warning::Skipping $full - its Docker image failed to build this run (see build-images), leaving the previous template version in place."
+                continue
+                ;;
+            esac
+            echo "::group::Pushing $full from $dir"
+            coder templates push "$full" -d "$dir" --yes \
               -m "auto-provisioned from ${GITHUB_SHA:0:12}"
             echo "::endgroup::"
           done