fix cd

.gitea/workflows/build.yaml

@@ -0,0 +1,45 @@
+# Build and publish here; k8s-helper deploys ./deploy/k8s after the webhook.
+name: build
+
+on:
+  push:
+    branches: [main]
+
+env:
+  IMAGE: fancydns/fancy-dns
+
+jobs:
+  build-push:
+    runs-on: amd64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: |
+          docker build --build-arg VERSION=${{ gitea.sha }} \
+            -t $IMAGE:${{ gitea.sha }} -t $IMAGE:latest .
+
+      - name: Push image
+        run: |
+          docker push $IMAGE:${{ gitea.sha }}
+          docker push $IMAGE:latest
+
+      - name: Reconcile after image is published
+        env:
+          GITOPS_WEBHOOK_SECRET: ${{ secrets.GITOPS_WEBHOOK_SECRET }}
+        run: |
+          if [ -z "$GITOPS_WEBHOOK_SECRET" ]; then
+            echo "GITOPS_WEBHOOK_SECRET must match the k8s-helper Gitea webhook secret" >&2
+            exit 1
+          fi
+          payload="$(mktemp)"
+          trap 'rm -f "$payload"' EXIT
+          printf '{"ref":"%s","after":"%s","repository":{"clone_url":"https://git.k6n.net/mats/fancy-dns.git","ssh_url":"git@git.k6n.net:mats/fancy-dns.git"}}' \
+            "$GITHUB_REF" "$GITHUB_SHA" > "$payload"
+          signature="$(openssl dgst -sha256 -hmac "$GITOPS_WEBHOOK_SECRET" "$payload" | awk '{print $NF}')"
+          curl --fail --silent --show-error \
+            -X POST \
+            -H "Content-Type: application/json" \
+            -H "X-Gitea-Signature: $signature" \
+            --data-binary "@$payload" \
+            https://ui.k6n.net/api/gitops/webhooks/gitea