chore(README): Add a section about the container image and gitea container registry.

See:
- https://github.com/go-gitea/gitea/issues/23642
- https://github.com/go-gitea/gitea/issues/29398

.github/workflows/docker.yml

@@ -2,43 +2,54 @@ name: Docker
 
 on:
   push:
+    branches:
+    - "handmade"
   pull_request:
     branches:
     - "handmade"
+  release:
+    types:
+    - published
 
 jobs:
     publish:
         runs-on: ubuntu-latest
-        # NOTE: Running on pull requests for now, but without pushing.
-        # if: github.event_name != 'pull_request'
+        permissions:
+            contents: read
         steps:
             - name: Checkout
               uses: actions/checkout@v4
               with:
                   submodules: "recursive"
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
+            - name: Resolve registry host
+              id: registry
+              run: echo "host=${GITHUB_SERVER_URL#*://}" >> "$GITHUB_OUTPUT"
             - name: Docker meta
               id: meta
               uses: docker/metadata-action@v5
               with:
-                  images: handmadecities/handmade-revolt-web-client
+                  images: ${{ steps.registry.outputs.host }}/${{ github.repository_owner }}/handmade-revolt-web-client
+                  tags: |
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=raw,value=latest
               env:
                   DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
-            - name: Login to DockerHub
-              uses: docker/login-action@v1
-              # if: github.event_name != 'pull_request'
+            - name: Login to registry
+              uses: docker/login-action@v3
+              if: github.event_name == 'release'
               with:
-                  username: ${{ secrets.DOCKERHUB_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+                  registry: ${{ steps.registry.outputs.host }}
+                  username: ${{ secrets.PACKAGE_PUBLISH_USERNAME }}
+                  password: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
             - name: Build and publish
               uses: docker/build-push-action@v6
               with:
                   context: .
-                  push: true # ${{ github.event_name != 'pull_request' }}
-                  platforms: linux/amd64,linux/arm64
+                  push: ${{ github.event_name == 'release' }}
+                  platforms: linux/amd64
                   tags: ${{ steps.meta.outputs.tags }}
                   annotations: ${{ steps.meta.outputs.annotations }}
                   labels: ${{ steps.meta.outputs.labels }}

README.md

@@ -1,7 +1,7 @@
 # Handmade Revolt
 Fork of Revolt (now Stoat chat) maintained by the handmade cities community.
 
-## Deploying a new release
+## Deploying a new release (TODO: Adjust this for handmadecities)
 
 Ensure `.env.local` points to `https://app.revolt.chat/api`.
 
@@ -22,6 +22,29 @@ ssh $REMOTE
 tmux a -t 4
 ```
 
+## Container image
+
+Releases publish a linux/amd64 image to the Gitea package registry at
+`git.handmadecities.com/HMC/handmade-revolt-web-client` (tags: `<version>`,
+`<major>.<minor>`, and `latest`).
+
+The registry requires authentication even for pulls (anonymous pull is not
+supported by Gitea). On a host that needs to pull the image, log in once with a
+**read-only** token (a token scoped to `read:package`); the credentials are
+saved to `~/.docker/config.json` (or `/root/.docker/config.json`) and persist across reboots:
+
+```bash
+echo '<PACKAGE_PULL_TOKEN>' | docker login git.handmadecities.com -u <pull-username> --password-stdin
+
+docker pull git.handmadecities.com/HMC/handmade-revolt-web-client:latest
+```
+
+Notes:
+
+-   `~/.docker/config.json` is per-user so you'll need to log in separately from all users that will need to pull images.
+-   Credentials are stored base64-encoded, not encrypted; keep the file at `chmod 600` and use a `read:package`-only token so a leak can't push.
+-   Rotate by running `docker login` again, or `docker logout git.handmadecities.com` to remove the stored credential.
+
 # Revite
 
 ## Description