ci: build and push multi-arch images

README.md

@@ -1,5 +1,7 @@
 # porthole
 
+[![Build Status](/repos/will/porthole/badge.svg?branch=main)](/repos/will/porthole/actions)
+
 Porthole: timeline media library (Next.js web + worker), backed by Postgres/Redis/MinIO.
 
 ## How to try it
@@ -84,6 +86,21 @@ spec:
 
 This repo is a Bun monorepo, but container builds use Docker Buildx.
 
+### CI/CD (Automated)
+
+The repository includes a Gitea Actions workflow (`.gitea/workflows/build-images.yml`) that automatically:
+- Runs `bun run typecheck` on every push and PR
+- Runs `bash run_tests.sh` (Go tests) to keep the repo green
+- Builds and pushes multi-arch images (`linux/amd64`, `linux/arm64`) for `apps/web` and `apps/worker`
+- Pushes to `gitea-gitea-http.taildb3494.ts.net/will/porthole-web` and `.../porthole-worker`
+
+Images are tagged with:
+- Branch name (e.g., `main`, `feature/my-branch`)
+- Git SHA (short format)
+- Semantic version (when tags like `v1.2.3` are pushed)
+
+### Manual Build
+
 - Assumptions:
   - You have an **in-cluster registry** reachable over **insecure HTTP** (example: `registry.lan:5000`).
   - Your Docker daemon is configured to allow that registry as an insecure registry.