nix-native builds

.gitea/workflows/build-image.yml

@@ -1,5 +1,9 @@
 # Build the Crucible image. PR-first (D7): PRs build only; push to main also
 # publishes registry.westgate.pw/sow/crucible:<git-sha>. Never a mutable tag.
+#
+# Daemonless: the host-mode runner has no container runtime, so the image is
+# built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
+# straight from the OCI tarball. No `docker build`/`docker login` involved.
 name: build-image
 
 on:
@@ -22,12 +26,8 @@ jobs:
         id: tag
         run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
 
-      - name: Build image
-        run: |
-          docker build \
-            --build-arg GIT_SHA=${{ steps.tag.outputs.sha }} \
-            -f docker/Dockerfile \
-            -t ${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }} .
+      - name: Build OCI image (daemonless)
+        run: nix build .#image
 
       # Publish only on main (post-merge). PRs verify the build but never push.
       - name: Publish image
@@ -36,8 +36,10 @@ jobs:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
-          echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
-          docker push ${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}
+          nix shell nixpkgs#skopeo -c skopeo copy \
+            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
+            docker-archive:result \
+            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"
 
       - name: Emit release fragment
         run: |
@@ -46,6 +48,6 @@ jobs:
           FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
           FRAG_URL="${REGISTRY}/${IMAGE}" \
           FRAG_RUN_ID=${{ gitea.run_id }} \
-          ./scripts/emit-release-fragment.sh
+          bash scripts/emit-release-fragment.sh
       - uses: actions/upload-artifact@v3
         with: { name: release-fragment, path: release-fragment.json }