From d91eb220be4eaa1a06f364cb4f204ac4c4cc7508 Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Thu, 18 Jun 2026 14:41:53 +0200
Subject: [PATCH] fix(ci): restore build-push-action to fix docker socket
 access in runner

---
 .gitea/workflows/deploy.yml | 57 +++++++++++++------------------------
 1 file changed, 20 insertions(+), 37 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 3ce493959..3e1f08816 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -36,8 +36,6 @@ jobs:
       short_sha:        ${{ steps.determine.outputs.short_sha }}
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -124,8 +122,6 @@ jobs:
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -176,8 +172,6 @@ jobs:
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -192,33 +186,28 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: bash scripts/registry-auth.sh
 
+      - name: 🐳 Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: 🔐 Registry Login
         run: echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
-      - name: 🏗️ Build and Push (Native Docker Buildkit)
-        env:
-          NEXT_PUBLIC_BASE_URL: ${{ needs.prepare.outputs.next_public_url }}
-          NEXT_PUBLIC_TARGET: ${{ needs.prepare.outputs.target }}
-          NEXT_PUBLIC_APP_VERSION: ${{ needs.prepare.outputs.image_tag }}
-          UMAMI_WEBSITE_ID: ${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
-          UMAMI_API_ENDPOINT: ${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
-          NPM_TOKEN: ${{ steps.auth.outputs.working_token }}
-          NPM_DOMAIN: ${{ steps.auth.outputs.working_domain }}
-          IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
-        run: |
-          echo "$NPM_TOKEN" > npm_token.txt
-          DOCKER_BUILDKIT=1 docker build \
-            --secret id=NPM_TOKEN,src=npm_token.txt \
-            --build-arg NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL" \
-            --build-arg NEXT_PUBLIC_TARGET="$NEXT_PUBLIC_TARGET" \
-            --build-arg NEXT_PUBLIC_APP_VERSION="$IMAGE_TAG" \
-            --build-arg UMAMI_WEBSITE_ID="$UMAMI_WEBSITE_ID" \
-            --build-arg UMAMI_API_ENDPOINT="$UMAMI_API_ENDPOINT" \
-            --build-arg NPM_TOKEN="$NPM_TOKEN" \
-            --build-arg NPM_DOMAIN="$NPM_DOMAIN" \
-            -t registry.infra.mintel.me/mintel/e-tib.com:"$IMAGE_TAG" \
-            .
-          docker push registry.infra.mintel.me/mintel/e-tib.com:"$IMAGE_TAG"
-          rm -f npm_token.txt
+      - name: 🏗️ Build and Push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          provenance: false
+          platforms: linux/amd64
+          build-args: |
+            NEXT_PUBLIC_BASE_URL=${{ needs.prepare.outputs.next_public_url }}
+            NEXT_PUBLIC_TARGET=${{ needs.prepare.outputs.target }}
+            NEXT_PUBLIC_APP_VERSION=${{ needs.prepare.outputs.image_tag }}
+            UMAMI_WEBSITE_ID=${{ secrets.UMAMI_WEBSITE_ID || vars.UMAMI_WEBSITE_ID }}
+            UMAMI_API_ENDPOINT=${{ secrets.UMAMI_API_ENDPOINT || vars.UMAMI_API_ENDPOINT || 'https://analytics.infra.mintel.me' }}
+            NPM_TOKEN=${{ steps.auth.outputs.working_token }}
+            NPM_DOMAIN=${{ steps.auth.outputs.working_domain }}
+          tags: registry.infra.mintel.me/mintel/e-tib.com:${{ needs.prepare.outputs.image_tag }}
+          secrets: |
+            "NPM_TOKEN=${{ steps.auth.outputs.working_token }}"
 
   # ──────────────────────────────────────────────────────────────────────────────
   # JOB 4: Deploy
@@ -229,8 +218,6 @@ jobs:
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     env:
       TARGET:               ${{ needs.prepare.outputs.target }}
       IMAGE_TAG:            ${{ needs.prepare.outputs.image_tag }}
@@ -374,8 +361,6 @@ jobs:
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -421,8 +406,6 @@ jobs:
     runs-on: docker
     container:
       image: catthehacker/ubuntu:act-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: 🔔 Gotify
         shell: bash