From b9727afeab685d8196671b11cfaa0af659cd6157 Mon Sep 17 00:00:00 2001
From: Nathanial Lubitz <nate.lubitz@gmail.com>
Date: Mon, 29 Jun 2026 17:44:29 +1000
Subject: [PATCH] more updates

---
 .gitea/workflows/publish.yml        |  3 ++
 internal/generator/gitea_actions.go | 56 +++++++++++++++++++----------
 2 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index af4e4f4..1898295 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -25,6 +25,9 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build and push kforge action image
         uses: docker/build-push-action@v5
         with:
diff --git a/internal/generator/gitea_actions.go b/internal/generator/gitea_actions.go
index d266c85..2863691 100644
--- a/internal/generator/gitea_actions.go
+++ b/internal/generator/gitea_actions.go
@@ -89,6 +89,10 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 		})
 	}
 
+	writeStep(b, "Set up Docker Buildx", map[string]any{
+		"uses": "docker/setup-buildx-action@v3",
+	})
+
 	fullRepo := cfg.Registry.URL + "/" + cfg.Meta.Tenant + "/" + cfg.Meta.Name
 	buildWith := map[string]any{
 		"context":    ".",
@@ -241,8 +245,10 @@ func GeneratePreviewActions(cfg *config.KforgeConfig) (string, error) {
 	fmt.Fprintf(&b, "# Generated by kforge — do not edit manually.\n")
 	fmt.Fprintf(&b, "# Re-generate: kforge gitea-preview > .gitea/workflows/preview.yml\n")
 	fmt.Fprintf(&b, "#\n")
-	fmt.Fprintf(&b, "# Required secrets (same as deploy workflow):\n")
-	fmt.Fprintf(&b, "#   DOCKER_USERNAME, DOCKER_PASSWORD\n")
+	fmt.Fprintf(&b, "# Required secrets:\n")
+	if !cfg.Registry.Insecure {
+		fmt.Fprintf(&b, "#   DOCKER_USERNAME, DOCKER_PASSWORD  (registry auth)\n")
+	}
 	fmt.Fprintf(&b, "#   KFORGE_NODE_IP, KUBE_HOST, KUBE_TOKEN, KUBE_CERTIFICATE\n")
 	fmt.Fprintf(&b, "\n")
 	fmt.Fprintf(&b, "name: Preview Environment\n")
@@ -261,28 +267,42 @@ func GeneratePreviewActions(cfg *config.KforgeConfig) (string, error) {
 		"with": map[string]any{"fetch-depth": 0},
 	})
 
-	writeStep(&b, "Login to registry", map[string]any{
+	if !cfg.Registry.Insecure {
+		writeStep(&b, "Login to registry", map[string]any{
+			"if":   "${{ github.event.action != 'closed' }}",
+			"uses": "docker/login-action@v2",
+			"with": map[string]any{
+				"registry": cfg.Registry.URL,
+				"username": "${{ secrets.DOCKER_USERNAME }}",
+				"password": "${{ secrets.DOCKER_PASSWORD }}",
+			},
+		})
+	}
+
+	writeStep(&b, "Set up Docker Buildx", map[string]any{
 		"if":   "${{ github.event.action != 'closed' }}",
-		"uses": "docker/login-action@v2",
-		"with": map[string]any{
-			"registry": cfg.Registry.URL,
-			"username": "${{ secrets.DOCKER_USERNAME }}",
-			"password": "${{ secrets.DOCKER_PASSWORD }}",
-		},
+		"uses": "docker/setup-buildx-action@v3",
 	})
 
+	previewBuildWith := map[string]any{
+		"context":    ".",
+		"platforms":  "linux/amd64",
+		"file":       cfg.Defaults.Dockerfile,
+		"push":       true,
+		"tags":       fmt.Sprintf("%s:pr-${{ github.event.number }}", fullRepo),
+		"provenance": false,
+		"sbom":       false,
+	}
+	if cfg.Registry.Insecure {
+		previewBuildWith["buildkitd-config-inline"] = fmt.Sprintf(
+			"[registry.%q]\n  http = true\n  insecure = true",
+			cfg.Registry.URL,
+		)
+	}
 	writeStep(&b, "Build and push preview image", map[string]any{
 		"if":   "${{ github.event.action != 'closed' }}",
 		"uses": "docker/build-push-action@v5",
-		"with": map[string]any{
-			"context":    ".",
-			"platforms":  "linux/amd64",
-			"file":       cfg.Defaults.Dockerfile,
-			"push":       true,
-			"tags":       fmt.Sprintf("%s:pr-${{ github.event.number }}", fullRepo),
-			"provenance": false,
-			"sbom":       false,
-		},
+		"with": previewBuildWith,
 	})
 
 	if cfg.ActionRef != "" {