From b715a5dffbf906b0ff3edbad7b611771792f6211 Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Thu, 18 Jun 2026 12:42:25 -0500
Subject: [PATCH] fix(ci): enable DOCKER_BUILDKIT and fix SHA extraction in
 deploy

--secret requires BuildKit; DOCKER_BUILDKIT=1 enables it on the legacy
Docker client. Also add GITHUB_SHA fallback and git rev-parse last-resort
so the image tag is never empty.
---
 .gitea/workflows/deploy-gke.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/deploy-gke.yaml b/.gitea/workflows/deploy-gke.yaml
index 7eb1b03..fca0d71 100644
--- a/.gitea/workflows/deploy-gke.yaml
+++ b/.gitea/workflows/deploy-gke.yaml
@@ -56,7 +56,14 @@ jobs:
       - name: Determine image tag and slot
         id: vars
         run: |
-          SHA="${GITEA_SHA:0:8}"
+          # GITEA_SHA is set by the Gitea runner; fall back to GITHUB_SHA for
+          # compatibility with older Forgejo/Gitea versions.
+          RAW_SHA="${GITEA_SHA:-${GITHUB_SHA:-}}"
+          SHA="${RAW_SHA:0:8}"
+          if [ -z "$SHA" ]; then
+            # Last resort: read from git directly
+            SHA=$(git rev-parse --short=8 HEAD 2>/dev/null || echo "unknown")
+          fi
           IMAGE="us-central1-docker.pkg.dev/neuron-785695/neuron-api/neuron-soul:${SHA}"
           echo "sha=${SHA}" >> "$GITEA_OUTPUT"
           echo "image=${IMAGE}" >> "$GITEA_OUTPUT"
@@ -100,6 +107,7 @@ jobs:
       - name: Build and push Docker image
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          DOCKER_BUILDKIT: "1"
         run: |
           IMAGE="${{ steps.vars.outputs.image }}"
           SHA="${{ steps.vars.outputs.sha }}"