ci: build and push custom Logto image in CI pipeline

- Add "Build and push Logto image" step to docker job
- Remove build: directive from logto service in docker-compose
- docker-compose now only pulls pre-built images, no local builds

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -83,7 +83,7 @@ jobs:
       - name: Set up QEMU for cross-platform builds
         run: docker run --rm --privileged gitea.siegeln.net/cameleer/binfmt:1 --install all
 
-      - name: Build and push
+      - name: Build and push SaaS image
         run: |
           docker buildx create --use --name cibuilder
           TAGS="-t gitea.siegeln.net/cameleer/cameleer-saas:${{ github.sha }}"
@@ -99,3 +99,20 @@ jobs:
             --push .
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build and push Logto image
+        run: |
+          TAGS="-t gitea.siegeln.net/cameleer/cameleer-logto:${{ github.sha }}"
+          for TAG in $IMAGE_TAGS; do
+            TAGS="$TAGS -t gitea.siegeln.net/cameleer/cameleer-logto:$TAG"
+          done
+          docker buildx build --platform linux/amd64 \
+            --build-arg REGISTRY_TOKEN="$REGISTRY_TOKEN" \
+            -f docker/logto.Dockerfile \
+            $TAGS \
+            --cache-from type=registry,ref=gitea.siegeln.net/cameleer/cameleer-logto:buildcache \
+            --cache-to type=registry,ref=gitea.siegeln.net/cameleer/cameleer-logto:buildcache,mode=max \
+            --provenance=false \
+            --push .
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

docker-compose.yml

@@ -59,9 +59,6 @@ services:
 
   logto:
     image: ${LOGTO_IMAGE:-gitea.siegeln.net/cameleer/cameleer-logto}:${VERSION:-latest}
-    build:
-      context: .
-      dockerfile: docker/logto.Dockerfile
     restart: unless-stopped
     depends_on:
       postgres: