ci: multi-stage Dockerfile + fix workflow to match runner pattern

- Add tester/builder/runner stages to Dockerfile
- Use docker/build-push-action@v6 (matches other repos)
- Run tests via Docker tester stage (no setup-node needed)
- Fix secret names: REGISTRY_USERNAME / REGISTRY_TOKEN
- Runner target: keep yt-dlp + Chromium, copy only build artifacts

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitea/workflows/build.yml

@@ -5,40 +5,42 @@ on:
     branches:
       - master
 
+env:
+  REGISTRY: git.sal.giize.com
+  IMAGE_NAME: mozempk/insta-recipe
+
 jobs:
   test-and-build:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run unit tests
-        run: npm test
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Run unit tests
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: tester
+          push: false
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: git.sal.giize.com
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: git.sal.giize.com/mozempk/insta-recipe:latest
-          cache-from: type=registry,ref=git.sal.giize.com/mozempk/insta-recipe:buildcache
-          cache-to: type=registry,ref=git.sal.giize.com/mozempk/insta-recipe:buildcache,mode=max
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+          platforms: linux/amd64

Dockerfile

@@ -1,4 +1,21 @@
-FROM node:24-alpine
+# ── stage: tester ────────────────────────────────────────────────────────────
+FROM node:24-alpine AS tester
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm test
+
+# ── stage: builder ───────────────────────────────────────────────────────────
+FROM node:24-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+# ── stage: runner ────────────────────────────────────────────────────────────
+FROM node:24-alpine AS runner
 WORKDIR /app
 
 # Install yt-dlp (primary Instagram extractor) and Playwright system dependencies (fallback)
@@ -12,10 +29,8 @@ RUN apk add --no-cache \
     pip3 install --break-system-packages yt-dlp
 
 COPY package*.json ./
-RUN npm ci
-
-COPY . .
-RUN npm run build
+RUN npm ci --omit=dev
+COPY --from=builder /app/build ./build
 
 EXPOSE 3000
 ENV NODE_ENV=production