ci: add container image build and push to harbor

.gitea/workflows/ci.yml

@@ -251,3 +251,47 @@ jobs:
           else
             echo "::warning::SBOM validation failed"
           fi
+
+  build-push:
+    name: Build & Push Image
+    runs-on: ubuntu-latest
+    needs: [test, security-tests]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    container:
+      image: quay.io/podman/stable:latest
+
+    steps:
+      - name: Checkout
+        run: |
+          dnf install -yq git >/dev/null 2>&1
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+
+      - name: Build image
+        run: |
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          podman build -t flaskpaste:latest -t flaskpaste:sha-${SHORT_SHA} .
+          podman images | grep flaskpaste
+
+      - name: Push to Harbor
+        env:
+          HARBOR_USER: ${{ secrets.HARBOR_USER }}
+          HARBOR_PASS: ${{ secrets.HARBOR_PASS }}
+          HARBOR_REGISTRY: harbor.mymx.me
+        run: |
+          if [ -z "$HARBOR_USER" ] || [ -z "$HARBOR_PASS" ]; then
+            echo "::warning::Harbor credentials not configured - skipping push"
+            echo "Configure HARBOR_USER and HARBOR_PASS secrets to enable push"
+            exit 0
+          fi
+
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+
+          podman login "${HARBOR_REGISTRY}" \
+            -u "$HARBOR_USER" -p "$HARBOR_PASS" --tls-verify=false
+
+          for tag in latest sha-${SHORT_SHA}; do
+            podman tag flaskpaste:latest "${HARBOR_REGISTRY}/library/flaskpaste:${tag}"
+            podman push "${HARBOR_REGISTRY}/library/flaskpaste:${tag}" --tls-verify=false
+            echo "Pushed: ${HARBOR_REGISTRY}/library/flaskpaste:${tag}"
+          done