ci and compose update

tests/test_opencode_deployment.py

@@ -126,11 +126,10 @@ def test_compose_services_have_expected_runtime_contract() -> None:
         "4096",
     ]
 
-    build = _section(agentci, "build")
-    assert _mapping(build, "args", indent=6)["AGENTCI_OPENCODE_VERSION"] == (
-        "${AGENTCI_OPENCODE_VERSION:-^1}"
-    )
-    assert all("no_cache" not in line for line in build)
+    image = "${AGENTCI_IMAGE:-git.krtss.de/stanponomarev/agentci:latest}"
+    assert _scalar(agentci, "image") == image
+    assert _scalar(opencode, "image") == image
+    assert all(line.strip() != "build:" for line in [*agentci, *opencode])
 
     dependency = _section(_section(agentci, "depends_on"), "opencode", indent=6)
     assert _mapping(["      dependency:", *dependency], "dependency", indent=6) == {
@@ -157,6 +156,20 @@ def test_compose_has_no_sandbox_security_exceptions() -> None:
         assert forbidden not in compose
 
 
+def test_gitea_workflow_publishes_master_images() -> None:
+    lines = (ROOT / ".gitea" / "workflows" / "publish-image.yaml").read_text().splitlines()
+    push = _section(_section(lines, "on", indent=0), "push", indent=2)
+
+    assert _sequence(push, "branches", indent=4) == ["master"]
+    assert _mapping(lines, "env", indent=0)["IMAGE_NAME"] == (
+        "git.krtss.de/stanponomarev/agentci"
+    )
+    assert "            ${{ env.IMAGE_NAME }}:latest" in lines
+    assert "            ${{ env.IMAGE_NAME }}:${{ gitea.sha }}" in lines
+    assert "          username: ${{ secrets.REGISTRY_USERNAME }}" in lines
+    assert "          password: ${{ secrets.REGISTRY_TOKEN }}" in lines
+
+
 def test_container_pins_opencode_major_version_contract() -> None:
     lines = [line.strip() for line in (ROOT / "Dockerfile").read_text().splitlines()]
     build_arguments = {line.removeprefix("ARG ") for line in lines if line.startswith("ARG ")}