ci: verify the published image can be pulled

.dockerignore

@@ -0,0 +1,3 @@
+.git
+.gitea
+codex-ssh-test.md

.gitea/workflows/test.yaml

@@ -1,34 +1,56 @@
-name: Test Runner
-on: [push]
+name: Build and Push Image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
 
 jobs:
-  test-check:
+  build:
     runs-on: ubuntu-latest
     container:
-      image: ubuntu:latest
+      image: docker:27-cli
 
     steps:
-      - name: Say Hello
-        run: echo "Testing connection..."
+      - name: Install Actions dependencies
+        run: apk add --no-cache git nodejs
 
-      - name: Install Net Tools
-        run: |
-          apt-get update
-          apt-get install -y iputils-ping
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Install Docker CLI
-        run: |
-          apt-get update && apt-get install -y docker.io
+      - name: Verify Docker-in-Docker
+        run: docker info
 
-      - name: Debug Network (Ping Test)
+      - name: Log in to Gitea Registry
         run: |
-          echo "正在嘗試 Ping docker (DinD service)..."
-          # 使用 service name "docker" 而不是 container_name "gitea_dind"
-          ping -c 3 docker
-      
-      - name: Test Docker Connection
+          echo "${{ secrets.REGISTRY_TOKEN }}" |
+            docker login git.karylab.com \
+              --username "karylab_agents" \
+              --password-stdin
+
+      - name: Build and test image
         run: |
-          echo "正在嘗試連線 Docker API..."
-          echo "DOCKER_HOST = $DOCKER_HOST"
-          docker ps
-          echo "成功！可以看到上面的容器列表了！"
+          IMAGE="git.karylab.com/karylab_agents/test-runner"
+          docker build --progress=plain \
+            --tag "${IMAGE}:${{ gitea.sha }}" \
+            --tag "${IMAGE}:latest" \
+            .
+          output="$(docker run --rm "${IMAGE}:${{ gitea.sha }}")"
+          echo "$output"
+          test "$output" = "Gitea Runner Docker build succeeded."
+
+      - name: Push image
+        run: |
+          IMAGE="git.karylab.com/karylab_agents/test-runner"
+          docker push "${IMAGE}:${{ gitea.sha }}"
+          docker push "${IMAGE}:latest"
+
+      - name: Pull and verify published image
+        run: |
+          IMAGE="git.karylab.com/karylab_agents/test-runner"
+          docker image rm "${IMAGE}:${{ gitea.sha }}" "${IMAGE}:latest"
+          docker pull "${IMAGE}:latest"
+          output="$(docker run --rm "${IMAGE}:latest")"
+          echo "$output"
+          test "$output" = "Gitea Runner Docker build succeeded."

Dockerfile

@@ -0,0 +1,15 @@
+FROM alpine:3.22.5 AS builder
+
+RUN apk add --no-cache build-base
+
+WORKDIR /src
+COPY hello.c .
+
+RUN mkdir -p /out \
+    && cc -O2 -Wall -Wextra -Werror -static hello.c -o /out/hello
+
+FROM scratch
+
+COPY --from=builder /out/hello /hello
+
+ENTRYPOINT ["/hello"]

codex-ssh-test.md

@@ -0,0 +1,10 @@
+# Codex SSH write test
+
+This file verifies that the Codex shell can:
+
+1. authenticate with the dedicated SSH key;
+2. clone this repository;
+3. create a commit; and
+4. push the commit to Gitea.
+
+Test date: 2026-07-29

hello.c

@@ -0,0 +1,7 @@
+#include <stdio.h>
+
+int main(void)
+{
+    puts("Gitea Runner Docker build succeeded.");
+    return 0;
+}