Add a Docker-based build image and wire it into CI for the watch app

.gitea/workflows/build.yml

@@ -1,7 +1,11 @@
 name: build
 
-# Build a versioned Linux CLI release tarball (see `make package`) on
-# every push/PR, plus on-demand via the Gitea "Run workflow" button.
+# Build a versioned Linux CLI release tarball (see `make package`) and the
+# Pebble watchapp (see `make watchapp`) on every push/PR, plus on-demand
+# via the Gitea "Run workflow" button. Runs inside build-image (see
+# ../../build-image/Dockerfile, built/pushed via ../../build-image.sh and
+# ../../upload-image.sh), which bundles the Pebble SDK alongside the C
+# toolchain.
 on:
   push:
   pull_request:
@@ -17,12 +21,18 @@ jobs:
     # Must match a label your act_runner is registered with.
     runs-on: ubuntu-latest
 
+    container:
+      image: cr.ladkau.de/deck-in-a-dash/builder:latest
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
     steps:
       - uses: actions/checkout@v4
         with:
-          # `make package`'s version comes from `git describe --tags` (see
-          # the Makefile's `package` target) - needs full history/tags,
-          # not actions/checkout's default shallow single-commit clone.
+          # `make package`/`make watchapp`'s version comes from `git
+          # describe --tags` - needs full history/tags, not
+          # actions/checkout's default shallow single-commit clone.
           fetch-depth: 0
 
       - name: Preflight
@@ -30,12 +40,14 @@ jobs:
           set -euo pipefail
           command -v cc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: no C compiler (cc) in PATH" >&2; exit 1; }
           command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
+          command -v pebble >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: pebble not in PATH" >&2; exit 1; }
 
       - name: Build and test
         run: |
           set -euo pipefail
           make test
           make package
+          make watchapp
 
       - name: Upload build artifact
         # v4 uses the newer @actions/artifact backend, which this Gitea
@@ -45,14 +57,21 @@ jobs:
           name: deck-in-a-dash
           path: dist/deck-in-a-dash-*-linux-*.tar.gz
 
+      - name: Upload watchapp artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: deck-in-a-dash-watchapp
+          path: dist/deck-in-a-dash-*.pbw
+
       - name: Publish to dl.ladkau.de
-        # Uploads the tarball over SFTP instead of using
+        # Uploads the tarball and .pbw over SFTP instead of using
         # actions/upload-artifact (whose zip wrapping can't be disabled).
         # Only runs on push so PR builds don't publish.
         if: gitea.event_name == 'push'
         run: |
           set -euo pipefail
-          FILE="$(ls dist/deck-in-a-dash-*-linux-*.tar.gz)"
+          TARBALL="$(ls dist/deck-in-a-dash-*-linux-*.tar.gz)"
+          PBW="$(ls dist/deck-in-a-dash-*.pbw)"
           mkdir -p ~/.ssh
           echo "${{ secrets.DL_SFTP_KEY }}" > ~/.ssh/dl_sftp_key
           chmod 600 ~/.ssh/dl_sftp_key
@@ -60,5 +79,6 @@ jobs:
             -o StrictHostKeyChecking=accept-new \
             uploader@dl.ladkau.de <<EOF
           -mkdir files/deck-in-a-dash
-          put $FILE files/deck-in-a-dash/$(basename "$FILE")
+          put $TARBALL files/deck-in-a-dash/$(basename "$TARBALL")
+          put $PBW files/deck-in-a-dash/$(basename "$PBW")
           EOF