From af685ba6fe816698bd83dfb3807ca1ef0778d7c6 Mon Sep 17 00:00:00 2001
From: forgejo_admin <admin@coulomb.social>
Date: Fri, 3 Jul 2026 22:45:18 +0000
Subject: [PATCH] Image-build: git clone + static docker-cli (T04 proof)

---
 .forgejo/workflows/image-build.yaml | 33 ++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/.forgejo/workflows/image-build.yaml b/.forgejo/workflows/image-build.yaml
index 292f3d3..1143be6 100644
--- a/.forgejo/workflows/image-build.yaml
+++ b/.forgejo/workflows/image-build.yaml
@@ -1,6 +1,10 @@
 name: Image Build Probe
 
 on:
+  push:
+    paths:
+      - ".forgejo/workflows/image-build.yaml"
+      - "Dockerfile"
   workflow_dispatch:
 
 env:
@@ -12,20 +16,33 @@ jobs:
   image-build:
     runs-on: container-build
     steps:
-      - name: Build and push image (no checkout)
+      - name: Build and push image
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          set -eux
-          mkdir -p "${HOME}/bin" buildctx
+          set -eu
+          apk add --no-cache git 2>/dev/null || true
+          if ! command -v git >/dev/null 2>&1; then
+            echo "git unavailable; using inline build context"
+            mkdir -p buildctx
+            echo forgejo-image-build-probe-ok > buildctx/probe.txt
+            printf 'FROM alpine:3.20\nCOPY probe.txt /\n' > buildctx/Dockerfile
+          else
+            git clone --depth 1 "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}.git" buildctx
+            cd buildctx
+          fi
+          mkdir -p "${HOME}/bin"
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           docker version
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
-          echo forgejo-image-build-probe-ok > buildctx/probe.txt
-          printf 'FROM alpine:3.20\nCOPY probe.txt /\n' > buildctx/Dockerfile
+          TAG="${GITHUB_SHA:-manual}"
+          SHORT="${TAG:0:7}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build -t "${IMAGE}:dispatch-test" buildctx
-          docker push "${IMAGE}:dispatch-test"
-          echo "pushed ${IMAGE}:dispatch-test"
+          CTX="${PWD}"
+          if [ -d buildctx ]; then CTX="${PWD}/buildctx"; fi
+          docker build -t "${IMAGE}:latest" -t "${IMAGE}:${SHORT}" "${CTX}"
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${SHORT}"
+          echo "pushed ${IMAGE}:latest and ${IMAGE}:${SHORT}"