ci and compose update

README.md

@@ -46,10 +46,11 @@ recreated.
    OpenCode models.
 3. Create `secrets/gitea_token`, `secrets/webhook_secret`, and
    `secrets/opencode_server_password`. Use high-entropy values for both secret/password files.
-4. Build the image:
+4. Log in to the Gitea container registry with a personal access token, then pull the image:
 
    ```sh
-   docker compose build
+   docker login git.krtss.de
+   docker compose pull
    ```
 
 5. Authenticate the configured OpenCode providers before starting the persistent server:
@@ -75,6 +76,22 @@ deployment, run the one-off `auth login` command above and then `docker compose
 healthy and every configured model exists, supports tool calls, accepts its configured variant, and
 has a connected provider. The worker leaves jobs queued while the runtime is unavailable.
 
+### Image publishing
+
+Every push to `master` runs `.gitea/workflows/publish-image.yaml` and publishes the image as both
+`git.krtss.de/stanponomarev/agentci:latest` and
+`git.krtss.de/stanponomarev/agentci:<full-commit-sha>`. Configure these repository Actions secrets
+before the first run:
+
+| Secret | Value |
+| --- | --- |
+| `REGISTRY_USERNAME` | Username that owns the package or can write packages for the owner. |
+| `REGISTRY_TOKEN` | Personal access token with package write permission. |
+
+The automatic Gitea Actions token cannot publish packages. Compose uses `latest` by default; set
+`AGENTCI_IMAGE=git.krtss.de/stanponomarev/agentci:<full-commit-sha>` in `.env` to deploy an immutable
+revision.
+
 ## OpenCode
 
 Models use OpenCode's `provider/model` format. Planning, implementation, and research can use
@@ -84,10 +101,11 @@ configures the research subagent and defaults to `high`. `AGENTCI_EXPLORE_MODEL`
 `AGENTCI_EXPLORE_VARIANT` configure OpenCode's explore agent and default to
 `openai/gpt-5.6-luna` with `low`.
 
-`AGENTCI_OPENCODE_VERSION` controls the npm version or range installed into the image and defaults
-to `^1`. The build verifies that the resolved version is still OpenCode 1.x and prints it. Docker
-may reuse the cached installation layer until the configured version or build inputs change.
-Runtime auto-update is disabled so an image cannot cross into OpenCode 2.x after it is built.
+The `AGENTCI_OPENCODE_VERSION` Docker build argument controls the npm version or range installed into
+the image and defaults to `^1`. The build verifies that the resolved version is still OpenCode 1.x
+and prints it. Docker may reuse the cached installation layer until the configured version or build
+inputs change. Runtime auto-update is disabled so an image cannot cross into OpenCode 2.x after it
+is built.
 
 The trusted configuration is `opencode/opencode.json`. OpenCode's default global and built-in-agent
 permission policies remain in effect; Agent CI does not replace them with an allow-all policy.
@@ -172,7 +190,6 @@ uv run pyright
 uv run pytest
 uv run pytest --cov=agentci --cov-branch
 docker compose config
-docker compose build
 ```
 
 The coverage command is an opt-in diagnostic report; the regular test run remains the default and