From 1e86ccd2366468ae2c915647622c3532f7e0f3f2 Mon Sep 17 00:00:00 2001
From: d3vyce <nicolas.sudres@proton.me>
Date: Mon, 10 Aug 2026 14:17:38 -0400
Subject: [PATCH] fix: build ci job

---
 .gitea/workflows/build_blog_image.yml | 45 ++++++++++++++-------------
 Dockerfile                            |  8 ++---
 2 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/.gitea/workflows/build_blog_image.yml b/.gitea/workflows/build_blog_image.yml
index 6dae685..d02332c 100644
--- a/.gitea/workflows/build_blog_image.yml
+++ b/.gitea/workflows/build_blog_image.yml
@@ -6,35 +6,38 @@ on:
       - main
 
 jobs:
-  build docker:
-    runs-on: linux_amd
+  # No space in the job id: it is interpolated verbatim into the podman network
+  # name, and podman rejects [a-zA-Z0-9][a-zA-Z0-9_.-]* violations that docker let through.
+  build-docker:
+    runs-on: ubuntu-latest
+    env:
+      IMAGE: git.d3vyce.fr/${{ github.repository }}:latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        # actions/checkout#1830
         # with:
         #   lfs: 'true'
       - name: Checkout LFS
         run: |
           function EscapeForwardSlash() { echo "$1" | sed 's/\//\\\//g'; }
           readonly ReplaceStr="EscapeForwardSlash ${{ gitea.repository }}.git/info/lfs/objects/batch"; sed -i "s/\(\[http\)\( \".*\)\"\]/\1\2`$ReplaceStr`\"]/" .git/config
-          git config --local lfs.transfer.maxretries 1
           /usr/bin/git lfs fetch    origin refs/remotes/origin/${{ gitea.ref_name }}
           /usr/bin/git lfs checkout
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to Docker registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.d3vyce.fr
-          username: ${{ github.actor }}
-          password: ${{ secrets.GIT_TOKEN }}
+      - name: Verify LFS objects resolved
+        run: |
+          # A failed fetch leaves pointer files behind and hugo only dies later on
+          # .Resize with "image: unknown format". Fail here, where the cause is legible.
+          if git lfs ls-files | awk '$2 == "-"' | grep -q .; then
+            echo "::error::LFS objects missing - these are still pointer files:"
+            git lfs ls-files | awk '$2 == "-" { print "  " $3 }'
+            exit 1
+          fi
+      - name: Install buildah
+        run: |
+          apt-get update && apt-get install -y  buildah
       - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: git.d3vyce.fr/${{ github.repository }}:latest
+        run: |
+          buildah login -u "${{ github.actor }}" -p "${{ secrets.GIT_TOKEN }}" git.d3vyce.fr
+          buildah --storage-driver vfs build --isolation chroot -t "$IMAGE" -f ./Dockerfile .
+          buildah --storage-driver vfs push "$IMAGE"
diff --git a/Dockerfile b/Dockerfile
index 222da18..235c8ab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,15 @@
 # Build Stage
-FROM hugomods/hugo:0.161.1 AS build
-
-ARG BLOWFISH_VERSION
+FROM docker.io/hugomods/hugo:0.164.0 AS build
 
 WORKDIR /opt/blog
 COPY . /opt/blog/
 
 RUN git submodule update --init --recursive && \
-    git -C themes/blowfish/ checkout v2.103.0
+    git -C themes/blowfish/ checkout v2.105.0
 RUN hugo
 
 # Publish Stage
-FROM nginx:1.31-alpine
+FROM docker.io/nginx:1.31-alpine
 
 WORKDIR /usr/share/nginx/html
 COPY --from=build /opt/blog/public /usr/share/nginx/html/