fix gitea backend: plain docker commands, internal HTTP registry

Root cause: docker/build-push-action pushes via HTTPS to the
FQDN registry, hitting the self-signed cert. Also, GitHub
Actions (setup-buildx, login-action, trivy-action) have
compatibility issues with Gitea's act_runner.

Fix: replace ALL GitHub Actions with plain docker CLI commands:
- docker login gitea:3000 (internal HTTP, no TLS)
- docker build -t ... -f Dockerfile context/
- docker push (each tag)
- trivy via docker run (no action resolution needed)

ci_registry = "gitea:3000" in [ci.gitea] for internal push.
Host Docker daemon configured with insecure-registries for gitea:3000.

.gitea/workflows/deploy.yml

@@ -14,60 +14,53 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Log in to container registry
-        uses: https://github.com/docker/login-action@v3
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-        with:
-          registry: gitea.homelab.fhirworx.io
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Build notebooks
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f notebooks/Dockerfile -t gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/notebooks:latest notebooks/
-        with:
+
-          context: notebooks/
+      - name: Push notebooks
-          file: notebooks/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/notebooks:latest
+          docker push gitea:3000/homelab/stack/notebooks:latest
 
       - name: Build zotero
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f zotero/Dockerfile -t gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/zotero:latest zotero/
-        with:
+
-          context: zotero/
+      - name: Push zotero
-          file: zotero/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/zotero:latest
+          docker push gitea:3000/homelab/stack/zotero:latest
 
       - name: Build docs
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f docs/Dockerfile -t gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/docs:latest .
-        with:
+
-          context: .
+      - name: Push docs
-          file: docs/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/docs:latest
+          docker push gitea:3000/homelab/stack/docs:latest
 
       - name: Build api
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f api/Dockerfile -t gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/api:latest .
-        with:
+
-          context: .
+      - name: Push api
-          file: api/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/api:latest
+          docker push gitea:3000/homelab/stack/api:latest
 
       - name: Build mc
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f rustfs/Dockerfile.mc -t gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/mc:latest rustfs/
-        with:
+
-          context: rustfs/
+      - name: Push mc
-          file: rustfs/Dockerfile.mc
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/mc:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/mc:latest
+          docker push gitea:3000/homelab/stack/mc:latest
 
   scan:
     runs-on: ubuntu-latest
@@ -80,40 +73,40 @@ jobs:
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Scan notebooks
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: notebooks-scan.json
+          gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
 
       - name: Scan zotero
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: zotero-scan.json
+          gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
 
       - name: Scan docs
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: docs-scan.json
+          gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
 
       - name: Scan api
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: api-scan.json
+          gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

.gitea/workflows/harden.yml

@@ -15,62 +15,50 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Log in to container registry
-        uses: https://github.com/docker/login-action@v3
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-        with:
-          registry: gitea.homelab.fhirworx.io
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build notebooks
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build --no-cache -f notebooks/Dockerfile -t gitea:3000/homelab/stack/notebooks:hardened -t gitea:3000/homelab/stack/notebooks:latest notebooks/
-        with:
+
-          context: notebooks/
+      - name: Push notebooks
-          file: notebooks/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/notebooks:hardened
-          tags: gitea.homelab.fhirworx.io/homelab/stack/notebooks:hardened,gitea.homelab.fhirworx.io/homelab/stack/notebooks:latest
+          docker push gitea:3000/homelab/stack/notebooks:latest
-          no-cache: true
 
       - name: Build zotero
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build --no-cache -f zotero/Dockerfile -t gitea:3000/homelab/stack/zotero:hardened -t gitea:3000/homelab/stack/zotero:latest zotero/
-        with:
+
-          context: zotero/
+      - name: Push zotero
-          file: zotero/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/zotero:hardened
-          tags: gitea.homelab.fhirworx.io/homelab/stack/zotero:hardened,gitea.homelab.fhirworx.io/homelab/stack/zotero:latest
+          docker push gitea:3000/homelab/stack/zotero:latest
-          no-cache: true
 
       - name: Build docs
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build --no-cache -f docs/Dockerfile -t gitea:3000/homelab/stack/docs:hardened -t gitea:3000/homelab/stack/docs:latest .
-        with:
+
-          context: .
+      - name: Push docs
-          file: docs/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/docs:hardened
-          tags: gitea.homelab.fhirworx.io/homelab/stack/docs:hardened,gitea.homelab.fhirworx.io/homelab/stack/docs:latest
+          docker push gitea:3000/homelab/stack/docs:latest
-          no-cache: true
 
       - name: Build api
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build --no-cache -f api/Dockerfile -t gitea:3000/homelab/stack/api:hardened -t gitea:3000/homelab/stack/api:latest .
-        with:
+
-          context: .
+      - name: Push api
-          file: api/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/api:hardened
-          tags: gitea.homelab.fhirworx.io/homelab/stack/api:hardened,gitea.homelab.fhirworx.io/homelab/stack/api:latest
+          docker push gitea:3000/homelab/stack/api:latest
-          no-cache: true
 
       - name: Build mc
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build --no-cache -f rustfs/Dockerfile.mc -t gitea:3000/homelab/stack/mc:hardened -t gitea:3000/homelab/stack/mc:latest rustfs/
-        with:
+
-          context: rustfs/
+      - name: Push mc
-          file: rustfs/Dockerfile.mc
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/mc:hardened
-          tags: gitea.homelab.fhirworx.io/homelab/stack/mc:hardened,gitea.homelab.fhirworx.io/homelab/stack/mc:latest
+          docker push gitea:3000/homelab/stack/mc:latest
-          no-cache: true
 
   scan:
     runs-on: ubuntu-latest
@@ -80,40 +68,40 @@ jobs:
         uses: https://github.com/actions/checkout@v4
 
       - name: Scan notebooks
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/notebooks:hardened
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: notebooks-scan.json
+          gitea:3000/homelab/stack/notebooks:hardened
 
       - name: Scan zotero
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/zotero:hardened
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: zotero-scan.json
+          gitea:3000/homelab/stack/zotero:hardened
 
       - name: Scan docs
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/docs:hardened
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: docs-scan.json
+          gitea:3000/homelab/stack/docs:hardened
 
       - name: Scan api
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/api:hardened
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: api-scan.json
+          gitea:3000/homelab/stack/api:hardened
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

.gitea/workflows/infra-ci.yml

@@ -35,19 +35,10 @@ jobs:
         with:
           dockerfile: notebooks/Dockerfile
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Build notebooks
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f notebooks/Dockerfile -t ci-test-notebooks notebooks/
-        with:
-          context: notebooks/
-          file: notebooks/Dockerfile
-          push: false
-          tags: ci-test-notebooks
-          load: true
 
   zotero:
     runs-on: ubuntu-latest
@@ -60,19 +51,10 @@ jobs:
         with:
           dockerfile: zotero/Dockerfile
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Build zotero
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f zotero/Dockerfile -t ci-test-zotero zotero/
-        with:
-          context: zotero/
-          file: zotero/Dockerfile
-          push: false
-          tags: ci-test-zotero
-          load: true
 
   docs:
     runs-on: ubuntu-latest
@@ -85,19 +67,10 @@ jobs:
         with:
           dockerfile: docs/Dockerfile
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Build docs
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f docs/Dockerfile -t ci-test-docs .
-        with:
-          context: .
-          file: docs/Dockerfile
-          push: false
-          tags: ci-test-docs
-          load: true
 
   api:
     runs-on: ubuntu-latest
@@ -110,19 +83,10 @@ jobs:
         with:
           dockerfile: api/Dockerfile
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Build api
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f api/Dockerfile -t ci-test-api .
-        with:
-          context: .
-          file: api/Dockerfile
-          push: false
-          tags: ci-test-api
-          load: true
 
   mc:
     runs-on: ubuntu-latest
@@ -135,16 +99,7 @@ jobs:
         with:
           dockerfile: rustfs/Dockerfile.mc
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Build mc
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f rustfs/Dockerfile.mc -t ci-test-mc rustfs/
-        with:
-          context: rustfs/
-          file: rustfs/Dockerfile.mc
-          push: false
-          tags: ci-test-mc
-          load: true

.gitea/workflows/rebuild-all.yml

@@ -13,60 +13,53 @@ jobs:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-      - name: Set up Docker Buildx
+
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker
 
       - name: Log in to container registry
-        uses: https://github.com/docker/login-action@v3
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-        with:
-          registry: gitea.homelab.fhirworx.io
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Build notebooks
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f notebooks/Dockerfile -t gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/notebooks:latest notebooks/
-        with:
+
-          context: notebooks/
+      - name: Push notebooks
-          file: notebooks/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/notebooks:latest
+          docker push gitea:3000/homelab/stack/notebooks:latest
 
       - name: Build zotero
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f zotero/Dockerfile -t gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/zotero:latest zotero/
-        with:
+
-          context: zotero/
+      - name: Push zotero
-          file: zotero/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/zotero:latest
+          docker push gitea:3000/homelab/stack/zotero:latest
 
       - name: Build docs
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f docs/Dockerfile -t gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/docs:latest .
-        with:
+
-          context: .
+      - name: Push docs
-          file: docs/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/docs:latest
+          docker push gitea:3000/homelab/stack/docs:latest
 
       - name: Build api
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f api/Dockerfile -t gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/api:latest .
-        with:
+
-          context: .
+      - name: Push api
-          file: api/Dockerfile
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/api:latest
+          docker push gitea:3000/homelab/stack/api:latest
 
       - name: Build mc
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build -f rustfs/Dockerfile.mc -t gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/mc:latest rustfs/
-        with:
+
-          context: rustfs/
+      - name: Push mc
-          file: rustfs/Dockerfile.mc
+        run: |
-          push: true
+          docker push gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }}
-          tags: gitea.homelab.fhirworx.io/homelab/stack/mc:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/mc:latest
+          docker push gitea:3000/homelab/stack/mc:latest
 
   scan:
     runs-on: ubuntu-latest
@@ -79,40 +72,40 @@ jobs:
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
       - name: Scan notebooks
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: notebooks-scan.json
+          gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
 
       - name: Scan zotero
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: zotero-scan.json
+          gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
 
       - name: Scan docs
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: docs-scan.json
+          gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
 
       - name: Scan api
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: HIGH,CRITICAL
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "0"
+          --severity HIGH,CRITICAL --exit-code 0
-          format: json
+          --format json -o /dev/null
-          output: api-scan.json
+          gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
 
       - name: Upload scan results
         uses: https://github.com/actions/upload-artifact@v4

dev/scripts/backends/gitea.py

@@ -26,13 +26,7 @@ def _checkout_step() -> str:
 
 
 def _setup_buildx_step() -> str:
-    # Rootless Docker can't use docker-container driver (needs sysfs).
+    return ""  # Not needed — we use plain docker build/push
-    # Force the docker driver which uses the existing daemon directly.
-    return """\
-      - name: Set up Docker Buildx
-        uses: https://github.com/docker/setup-buildx-action@v3
-        with:
-          driver: docker"""
 
 
 def _setup_uv_step(uv_version: str) -> str:
@@ -55,20 +49,21 @@ def _build_push_step(
     no_cache: bool = False,
     load_only: bool = False,
 ) -> str:
+    """Plain docker build + push — avoids GitHub Action TLS/compat issues."""
     name = img["name"]
-    push = "false" if load_only else "true"
+    tags = [t.strip() for t in tags_expr.split(",") if t.strip()]
+    tag_flags = " ".join(f"-t {t}" for t in tags)
+    cache_flag = " --no-cache" if no_cache else ""
     lines = f"""\
       - name: Build {name}
-        uses: https://github.com/docker/build-push-action@v6
+        run: docker build{cache_flag} -f {img["dockerfile"]} {tag_flags} {img["context"]}"""
-        with:
+    if not load_only and tags:
-          context: {img["context"]}
+        push_cmds = "\n          ".join(f"docker push {t}" for t in tags)
-          file: {img["dockerfile"]}
+        lines += f"""
-          push: {push}
+
-          tags: {tags_expr}"""
+      - name: Push {name}
-    if load_only:
+        run: |
-        lines += "\n          load: true"
+          {push_cmds}"""
-    if no_cache:
-        lines += "\n          no-cache: true"
     return lines
 
 
@@ -83,13 +78,13 @@ def _trivy_step(
     ec = img.get("trivy_exit_code", 0)
     return f"""\
       - name: Scan {name}
-        uses: https://github.com/aquasecurity/trivy-action@master
+        run: >-
-        with:
+          docker run --rm
-          image-ref: {registry}/{owner_repo}/{name}:{tag}
+          -v /var/run/docker.sock:/var/run/docker.sock
-          severity: {sev}
+          ghcr.io/aquasecurity/trivy:latest image
-          exit-code: "{ec}"
+          --severity {sev} --exit-code {ec}
-          format: json
+          --format json -o /dev/null
-          output: {name}-scan.json"""
+          {registry}/{owner_repo}/{name}:{tag}"""
 
 
 def _upload_artifact_step(name: str, path: str) -> str:
@@ -113,14 +108,10 @@ def _download_artifact_step(name: str) -> str:
 
 
 def _docker_login_step(registry: str) -> str:
-    """Login using PAT secret — GITEA_TOKEN can't push to registry."""
+    """Login using PAT secret — plain docker login (avoids action compat issues)."""
     return f"""\
       - name: Log in to container registry
-        uses: https://github.com/docker/login-action@v3
+        run: echo "${{{{ secrets.REGISTRY_TOKEN }}}}" | docker login {registry} -u "${{{{ secrets.REGISTRY_USER }}}}" --password-stdin"""
-        with:
-          registry: {registry}
-          username: ${{{{ secrets.REGISTRY_USER }}}}
-          password: ${{{{ secrets.REGISTRY_TOKEN }}}}"""
 
 
 # ── Workflow generators ──────────────────────────────────────────
@@ -526,7 +517,8 @@ def emit(
     ci_cfg: dict,
 ) -> dict[str, str]:
     """Return {relative_path: content} for all Gitea Actions workflows."""
-    registry = platform["registry"]  # Use platform registry, not ghcr.io
+    # ci_registry is the internal HTTP endpoint used for push (avoids TLS)
+    registry = ci_cfg.get("ci_registry", platform["registry"])
     owner_repo = platform["repo"]
     runner = ci_cfg.get("runner_labels", ["ubuntu-latest"])[0]
     uv_version = ci_cfg.get("uv_version", "latest")

stack.toml

@@ -135,6 +135,7 @@ uv_version = "latest"
 runner_labels = ["ubuntu-latest"]
 registry_secret = "REGISTRY_TOKEN"
 uv_version = "latest"
+ci_registry = "gitea:3000"  # internal HTTP endpoint (avoids self-signed TLS)
 
 [lint]
 line_length = 88