initial scaffold

.forgejo/workflows/build-hello-app.yml

@@ -0,0 +1,40 @@
+name: build-hello-app
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "apps/hello-app/src/**"
+
+jobs:
+  build-and-push:
+    runs-on: docker
+    # kaniko builds the image itself with no daemon and no special host
+    # privileges, so the runner host only ever needs a rootless Podman
+    # socket to launch this container — never docker.sock, never sudo.
+    container:
+      image: gcr.io/kaniko-project/executor:debug
+      options: --entrypoint ""
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Write registry auth
+        run: |
+          mkdir -p /kaniko/.docker
+          AUTH=$(printf '%s:%s' "${{ vars.FORGEJO_USER }}" "${{ secrets.FORGEJO_TOKEN }}" | base64 -w0)
+          printf '{"auths":{"git.boglabob.com":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+
+      - name: Inject build info
+        run: |
+          SHORT_SHA="${GITHUB_SHA::7}"
+          BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+          sed -i "s/__GIT_SHA__/$SHORT_SHA/; s/__BUILD_TIME__/$BUILD_TIME/" apps/hello-app/src/index.html
+
+      - name: Build and push
+        run: |
+          TAG="main-${GITHUB_SHA::7}-$(date +%s)"
+          /kaniko/executor \
+            --context="${{ github.workspace }}/apps/hello-app/src" \
+            --dockerfile="${{ github.workspace }}/apps/hello-app/src/Dockerfile" \
+            --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:$TAG" \
+            --destination="git.boglabob.com/${{ vars.FORGEJO_ORG }}/hello-app:latest"