Add Gitea build, container tests and registry publication

ci/common.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Shared by host-runner scripts. No credentials are persisted in the workspace.
+set -Eeuo pipefail
+CI_ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$CI_ROOT"
+ARTIFACTS="$CI_ROOT/ci/artifacts"
+mkdir -p "$ARTIFACTS"
+: "${CI_COMMIT:=$(git rev-parse HEAD)}"
+: "${CI_RUN_ID:=local}"
+: "${CI_RUN_ATTEMPT:=1}"
+[[ "$CI_COMMIT" =~ ^[0-9a-f]{40}$ ]] || { echo 'Invalid commit SHA' >&2; exit 1; }
+[[ "$CI_RUN_ID-$CI_RUN_ATTEMPT" =~ ^[a-zA-Z0-9-]+$ ]] || { echo 'Invalid run identifier' >&2; exit 1; }
+RUN_NAME="agiledancers-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"
+BACKEND_IMAGE="agiledancers-ci-backend:${CI_COMMIT}-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"
+FRONTEND_IMAGE="agiledancers-ci-frontend:${CI_COMMIT}-${CI_RUN_ID}-${CI_RUN_ATTEMPT}"
+
+require_platform() {
+    : "${TARGET_PLATFORM:?Set TARGET_PLATFORM to the verified Synology platform (for example linux/amd64)}"
+    local arch native
+    arch=$(docker info --format '{{.Architecture}}')
+    case "$arch" in x86_64|amd64) arch=amd64;; aarch64|arm64) arch=arm64;; esac
+    native="$(docker info --format '{{.OSType}}')/$arch"
+    [[ "$TARGET_PLATFORM" == "$native" ]] || {
+        echo "Target $TARGET_PLATFORM differs from Docker host $native. Resolve and test the architecture before running CI." >&2
+        return 1
+    }
+}
+
+# Anonymous build pulls must not invoke the developer's desktop credential helper.
+# Publication uses the same isolation and logs in only to our registry.
+isolate_docker_config() {
+    if [[ -z "${DOCKER_HOST:-}" ]]; then
+        DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}')
+        export DOCKER_HOST
+    fi
+    unset DOCKER_CONTEXT
+    CI_DOCKER_CONFIG=$(mktemp -d)
+    DOCKER_CONFIG=$CI_DOCKER_CONFIG
+    export DOCKER_CONFIG
+}