feat: ci-python CI-Basis-Image + Build-Workflow

Vorgebackenes Python-CI-Image (debian:bookworm-slim + uv, gepinnte CPython 3.12.13, ruff 0.16.1, pytest 9.1.1) fuer Gitea Actions. Basis + uv per Digest gepinnt, Versionen zentral im Dockerfile-Kopf. Build-Workflow pusht :latest + :<sha> in die Gitea-Registry (sko/ci-python), woechentlicher Rebuild. Lokal verifiziert: Build gruen, 397 MB, uv sync --frozen + Exporter-Imports OK. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-08-04 11:21:17 +02:00
commit 91d216cae4
4 changed files with 164 additions and 0 deletions
@@ -0,0 +1,48 @@
+name: Build ci-python image
+
+# Baut das ci-python-Image und pusht es in die Gitea-Container-Registry.
+# Tags: :latest (mitlaufend) + :<sha> (unveränderlich, zum Pinnen in Workflows).
+#
+# Voraussetzungen im Runner:
+#   - Docker verfügbar (Socket oder DinD) — Image-Bau braucht einen Docker-Daemon.
+#   - Secrets: REGISTRY_USER (Gitea-User) + REGISTRY_TOKEN (PAT, Scope package:write).
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'python/Dockerfile'
+      - '.gitea/workflows/build-ci-python.yml'
+  schedule:
+    - cron: '0 3 * * 1'   # wöchentlicher Rebuild für Basis-Sicherheitsupdates
+  workflow_dispatch:
+
+env:
+  REGISTRY: gitea.inmedias.it
+  IMAGE: sko/ci-python
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build & push
+        uses: docker/build-push-action@v6
+        with:
+          context: python
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE }}:buildcache,mode=max