Add build workflow

Builds and pushes the pass-cli image to code.aneur.in on every push to
main, based on zampler/zampler's build.yml pattern (registry login,
promote current latest to previous, build and push). Dropped everything
specific to that repo's own build (frontend/npm, Go cross-compilation,
multi-arch buildx) since this repo just builds one Dockerfile for one
architecture.

Uses its own BUILD_API_TOKEN secret, unrelated to Proton Pass -- build
workflows in this org are configured per-repo and don't go through
pass-cli, which is only for 'real world' deploy-time credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,45 @@
+# Builds and pushes the pass-cli image to code.aneur.in's registry.
+#
+# Single architecture (amd64) -- the Dockerfile pins a specific
+# pass-cli-linux-x86_64 binary, not a TARGETARCH-aware multi-arch build.
+#
+# Secrets:
+#   BUILD_API_TOKEN  registry push token for code.aneur.in (write:package)
+
+name: Build
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    container:
+      image: docker:cli
+    env:
+      IMAGE: code.aneur.in/${{ gitea.repository }}
+    steps:
+      - name: Install toolchain deps
+        run: apk add --no-cache nodejs docker-cli-buildx
+
+      - uses: actions/checkout@v4
+
+      - name: Log in to the container registry
+        env:
+          BUILD_API_TOKEN: ${{ secrets.BUILD_API_TOKEN }}
+        run: echo "$BUILD_API_TOKEN" | docker login code.aneur.in -u "${{ gitea.actor }}" --password-stdin
+
+      - name: Promote current "latest" to "previous"
+        run: |
+          if docker buildx imagetools inspect "$IMAGE:latest" >/dev/null 2>&1; then
+            docker buildx imagetools create -t "$IMAGE:previous" "$IMAGE:latest"
+          else
+            echo "No existing :latest to promote; skipping."
+          fi
+
+      - name: Build and push "latest"
+        run: |
+          docker build -t "$IMAGE:latest" .
+          docker push "$IMAGE:latest"

Dockerfile

@@ -0,0 +1,32 @@
+# pass-cli, glibc-linked, for hosts/CI where only an Alpine (musl) base is
+# otherwise available. pass-cli's Linux binary needs real glibc symbols
+# (fcntl64, __res_init, ...) that Alpine's gcompat/libc6-compat don't shim,
+# so it can't run in e.g. the docker:cli image directly.
+#
+# No ENTRYPOINT -- just CMD ["pass-cli"]. `docker run this-image` runs bare
+# pass-cli; `docker run this-image <args>` replaces CMD entirely, so a
+# caller running their own script against pass-cli (login, fetch a note,
+# parse it, etc.) just does `docker run this-image sh /path/to/script.sh`
+# with no --entrypoint override needed. The cost: `docker run this-image
+# --version` doesn't work as shorthand -- write `docker run this-image
+# pass-cli --version` instead.
+
+FROM debian:bookworm-slim
+
+ARG PASS_CLI_VERSION=2.3.3
+ARG PASS_CLI_SHA256=b5b49a8b3fd0af8830c0c1979f28ea0c90ccece73f59023a8bca8245d4b68da9
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl \
+    && curl -fsSL -o /usr/local/bin/pass-cli \
+         "https://proton.me/download/pass-cli/${PASS_CLI_VERSION}/pass-cli-linux-x86_64" \
+    && echo "${PASS_CLI_SHA256}  /usr/local/bin/pass-cli" | sha256sum -c - \
+    && chmod +x /usr/local/bin/pass-cli \
+    && apt-get purge -y curl \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/*
+
+# No kernel keyring in a container -- store the session on disk instead.
+ENV PROTON_PASS_KEY_PROVIDER=fs
+
+CMD ["pass-cli"]

README.md

@@ -1 +1,56 @@
 # pass-cli Docker image
+
+A prebuilt, glibc-based container image for [Proton Pass
+CLI](https://protonpass.github.io/pass-cli/) (`pass-cli`).
+
+## Why this exists
+
+`pass-cli`'s official Linux binary is dynamically linked against glibc. It
+does not run under Alpine/musl, even with `gcompat` or `libc6-compat`
+installed — some of the symbols it needs (`fcntl64`, `__res_init`, ...) are
+glibc-specific and aren't shimmed. There's no official musl build and no
+official pass-cli image, so CI jobs that otherwise run in an Alpine-based
+container (like `docker:cli`) can't just `apk add pass-cli` or run the
+binary directly.
+
+This image is a small `debian:bookworm-slim` base with a pinned,
+checksum-verified `pass-cli` binary installed, published so that kind of job
+can pull it and run `pass-cli` (or a script that calls it) without needing
+its own glibc environment.
+
+## Usage
+
+There's no `ENTRYPOINT` -- just `CMD ["pass-cli"]`. Run bare:
+
+```sh
+docker run --rm code.aneur.in/cloud/pass-cli:<tag>
+```
+
+To run your own script against `pass-cli` instead (login, fetch an item,
+parse the result, etc.), mount it in and pass it as the command -- it
+replaces `CMD` entirely, no `--entrypoint` override needed:
+
+```sh
+docker run --rm \
+  -e PROTON_PASS_PERSONAL_ACCESS_TOKEN \
+  -v "$PWD/my-script.sh:/script.sh:ro" \
+  code.aneur.in/cloud/pass-cli:<tag> \
+  sh /script.sh
+```
+
+For one-off interactive use, prefix `pass-cli` explicitly, since args
+replace `CMD` rather than appending to it:
+
+```sh
+docker run --rm code.aneur.in/cloud/pass-cli:<tag> pass-cli --version
+```
+
+`PROTON_PASS_KEY_PROVIDER` is set to `fs` in the image by default, since a
+container has no kernel keyring for `pass-cli`'s usual session storage.
+
+## Updating the pinned version
+
+`PASS_CLI_VERSION` and `PASS_CLI_SHA256` are build args at the top of the
+`Dockerfile`. Bump both together — get the new version's hash from
+`https://proton.me/download/pass-cli/versions.json`, or download the binary
+and check it yourself with `sha256sum`.