Add Hiyv nginx image and release pipeline

.dockerignore

@@ -0,0 +1,3 @@
+.git
+.gitea
+README.md

.gitea/workflows/publish.yml

@@ -0,0 +1,66 @@
+name: Publish container image
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+env:
+  REGISTRY: git.mancheff.com
+  IMAGE_NAME: hiyv-demo/hiyv-nginx
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Derive image tags
+        id: tags
+        shell: bash
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Tag ${GITHUB_REF_NAME} is not a semantic version (vMAJOR.MINOR.PATCH)." >&2
+            exit 1
+          fi
+          major_minor="${version%.*}"
+          major="${version%%.*}"
+          image="${REGISTRY}/${IMAGE_NAME}"
+          {
+            echo "version=${version}"
+            echo "image=${image}"
+            echo "tags=${image}:${version},${image}:${major_minor},${image}:${major},${image}:${GITHUB_SHA},${image}:latest"
+          } >> "${GITHUB_OUTPUT}"
+
+      - name: Log in to the Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and publish
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          build-args: |
+            COMMIT_ID=${{ github.sha }}
+          tags: ${{ steps.tags.outputs.tags }}
+          labels: |
+            org.opencontainers.image.version=${{ steps.tags.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+          platforms: linux/amd64,linux/arm64

Dockerfile

@@ -0,0 +1,21 @@
+FROM nginx:1.28-alpine
+
+ARG COMMIT_ID=unknown
+
+LABEL org.opencontainers.image.title="Hiyv nginx" \
+      org.opencontainers.image.description="Hiyv-branded base nginx image" \
+      org.opencontainers.image.revision="${COMMIT_ID}" \
+      org.opencontainers.image.source="https://git.mancheff.com/hiyv-demo/hiyv-nginx"
+
+COPY nginx/default.conf /etc/nginx/conf.d/default.conf
+COPY web/ /usr/share/nginx/html/
+
+RUN sed "s|@@COMMIT_ID@@|${COMMIT_ID}|g" \
+      /usr/share/nginx/html/index.html.template \
+      > /usr/share/nginx/html/index.html \
+    && rm /usr/share/nginx/html/index.html.template
+
+EXPOSE 80
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -qO- http://127.0.0.1/healthz || exit 1

README.md

@@ -0,0 +1,44 @@
+# Hiyv nginx
+
+A small, Hiyv-branded nginx base image. The landing page displays the exact
+Git commit used to build the published container.
+
+## Run it
+
+```sh
+docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.0
+```
+
+Open <http://localhost:8080>. The health endpoint is available at
+<http://localhost:8080/healthz>.
+
+## Publish a version
+
+Publishing is driven by semantic-version Git tags:
+
+```sh
+git tag v1.0.0
+git push origin main v1.0.0
+```
+
+The Gitea Actions workflow publishes the following tags for `v1.2.3`:
+
+- `1.2.3`
+- `1.2`
+- `1`
+- the full Git commit SHA
+- `latest`
+
+The workflow publishes multi-platform images for `linux/amd64` and
+`linux/arm64` to `git.mancheff.com/hiyv-demo/hiyv-nginx`.
+
+The repository must define two Actions secrets: `REGISTRY_USERNAME` with the
+Gitea username and `REGISTRY_TOKEN` with a personal access token that has
+package write access. Gitea's automatic job token cannot currently publish OCI
+packages.
+
+## Build locally
+
+```sh
+docker build --build-arg COMMIT_ID="$(git rev-parse HEAD)" -t hiyv-nginx:local .
+```

nginx/default.conf

@@ -0,0 +1,18 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

web/index.html.template

@@ -0,0 +1,43 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Hiyv nginx</title>
+  <style>
+    :root { color-scheme: dark; }
+    * { box-sizing: border-box; }
+    html, body { min-height: 100%; }
+    body {
+      min-height: 100vh;
+      margin: 0;
+      display: grid;
+      place-items: center;
+      background: #000;
+      color: #fff;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+    }
+    main {
+      width: min(92vw, 1128px);
+      text-align: center;
+    }
+    img {
+      display: block;
+      width: 100%;
+      height: auto;
+    }
+    p {
+      margin: 2rem 0 0;
+      font-size: clamp(.8rem, 1.5vw, 1rem);
+      letter-spacing: .08em;
+      overflow-wrap: anywhere;
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <img src="hiyv-cover.jpg" alt="Hiyv — Elevating Enterprise Scale">
+    <p>COMMIT&nbsp; @@COMMIT_ID@@</p>
+  </main>
+</body>
+</html>