fix: drop local registry, extract OCI tar and push via ocidir scheme

.gitea/workflows/docker.yml

@@ -45,24 +45,14 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
-
-      # Start a local registry so BuildKit can push multi-platform images
-      # without hitting Gitea's broken Bearer token endpoint. regctl then
-      # copies from 127.0.0.1:5000 to Gitea using basic auth.
-      - name: Start local registry
-        run: |
-          docker rm -f local-registry 2>/dev/null || true
-          docker run -d -p 5000:5000 --name local-registry registry:2
 
       - name: Build standard image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
-          push: true
-          tags: 127.0.0.1:5000/lmr:standard
+          push: false
+          outputs: type=oci,dest=/tmp/lmr-standard.tar
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           provenance: false
@@ -72,8 +62,8 @@ jobs:
         with:
           context: .
           file: Dockerfile.bundled
-          push: true
-          tags: 127.0.0.1:5000/lmr:bundled
+          push: false
+          outputs: type=oci,dest=/tmp/lmr-bundled.tar
           labels: ${{ steps.meta-bundled.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           provenance: false
@@ -84,6 +74,7 @@ jobs:
           curl -sL "https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64" \
             -o /usr/local/bin/regctl
           chmod +x /usr/local/bin/regctl
+          regctl version
 
       - name: Configure registry auth
         if: github.event_name != 'pull_request'
@@ -97,7 +88,6 @@ jobs:
           reg = os.environ["REGISTRY"]
           cfg = {
             "hosts": {
-              "127.0.0.1:5000": {"tls": "disabled"},
               reg: {
                 "user": os.environ["REGISTRY_USER"],
                 "pass": os.environ["REGISTRY_PASSWORD"],
@@ -117,9 +107,11 @@ jobs:
         env:
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
+          mkdir -p /tmp/lmr-std-oci
+          tar -xf /tmp/lmr-standard.tar -C /tmp/lmr-std-oci
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            regctl image copy "127.0.0.1:5000/lmr:standard" "$tag"
+            regctl image copy "ocidir:/tmp/lmr-std-oci" "$tag"
           done
 
       - name: Push bundled image
@@ -127,7 +119,9 @@ jobs:
         env:
           TAGS: ${{ steps.meta-bundled.outputs.tags }}
         run: |
+          mkdir -p /tmp/lmr-bnd-oci
+          tar -xf /tmp/lmr-bundled.tar -C /tmp/lmr-bnd-oci
           echo "$TAGS" | while IFS= read -r tag; do
             [ -z "$tag" ] && continue
-            regctl image copy "127.0.0.1:5000/lmr:bundled" "$tag"
+            regctl image copy "ocidir:/tmp/lmr-bnd-oci" "$tag"
           done