feat: add container deploy path (Containerfile, self-provisioning entrypoint, Forgejo registry push)

flake.nix

@@ -156,6 +156,38 @@
           };
         };
 
+        # Builds the Containerfile image (same non-rns build the release
+        # binary is, see its header comment) and pushes it to this repo's
+        # Forgejo container registry, tagged by short commit hash and
+        # `latest`. Needs FORGEJO_TOKEN (a token with write:package scope)
+        # in the environment; run from a checkout so `git rev-parse` and
+        # the Containerfile build context resolve to the right place.
+        apps.release-container = flake-utils.lib.mkApp {
+          drv = pkgs.writeShellApplication {
+            name = "bunshin-release-container";
+            runtimeInputs = [ pkgs.podman pkgs.git ];
+            text = ''
+              if [ -f .env ]; then
+                set -a
+                # shellcheck disable=SC1091
+                . ./.env
+                set +a
+              fi
+              : "''${FORGEJO_TOKEN:?set FORGEJO_TOKEN (env or .env) to a Forgejo token with write:package scope}"
+
+              rev=$(git rev-parse --short HEAD)
+              registry="code.randogoth.com/randogoth/bunshin"
+
+              echo "''${FORGEJO_TOKEN}" | podman login code.randogoth.com -u randogoth --password-stdin
+              podman build -f Containerfile -t "$registry:$rev" -t "$registry:latest" .
+              podman push "$registry:$rev"
+              podman push "$registry:latest"
+
+              echo "pushed: https://code.randogoth.com/randogoth/-/packages/container/bunshin"
+            '';
+          };
+        };
+
         devShells.default = pkgs.mkShell {
           packages = with pkgs; [ cargo rustc rustfmt clippy pkg-config gcc sqlite cmake ninja ];
           env = rnsSourceEnv;