From ae7e3dc47cee5cee5c8f3d7fa70c5bfc51b34153 Mon Sep 17 00:00:00 2001
From: Gabriel Brown <gbrown@ksensetech.com>
Date: Thu, 13 Aug 2026 10:34:43 -0400
Subject: [PATCH] Build and push in one step so buildx container-driver runners
 work

---
 .gitea/workflows/build.yml | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 8d5d62a..464cb39 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -25,15 +25,13 @@ jobs:
       - uses: actions/checkout@v4
       - name: Log in to container registry
         run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      # Fully-qualified tags from the start: unqualified names like
-      # `agentchat:latest` break on podman-backed runners, which resolve them
-      # to docker.io/library/* instead of the local build.
-      - name: Build image
-        run: docker build -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
-      - name: Push image
-        run: |
-          docker push git.gbrown.org/gib/agentchat:${{ gitea.sha }}
-          docker push git.gbrown.org/gib/agentchat:latest
+      # One build-and-push step, fully-qualified tags, --push from the builder.
+      # This is the only form that works across all the runners: unqualified
+      # names resolve to docker.io/library/* on podman-backed daemons, and
+      # buildx docker-container drivers keep plain builds in the build cache
+      # where a separate push step can't see them.
+      - name: Build and push image
+        run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
 
       # Watchtower on the VPS updates labelled containers nightly at 04:30; this
       # asks it to do so immediately. Non-fatal: the sweep still catches it.