feat: reusable build-and-push and deploy-restart composite actions

- build-and-push: multi-arch Docker build via remote Buildx builder over SSH
- deploy-restart: kubectl rollout restart with kubeconfig validation
- README with usage examples and required secrets

README.md

@@ -0,0 +1,81 @@
+# pipeline-actions
+
+Reusable composite actions for Gitea Actions CI/CD pipelines in the homelab.
+
+## Actions
+
+### `build-and-push`
+
+Builds and pushes a multi-architecture Docker image using a remote Buildx builder over SSH.
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-amd64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ivanch/pipeline-actions/build-and-push@main
+        with:
+          image: git.ivanch.me/ivanch/my-app
+          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
+          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}
+          # optional — these have sensible defaults:
+          # registry_host: git.ivanch.me
+          # registry_username: ivanch
+          # platforms: linux/amd64,linux/arm64
+          # build_context: .
+          # build_dockerfile: Dockerfile
+          # docker_host: docker-build.haven
+          # docker_user: root
+```
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `image` | ✅ | — | Full image reference without tag (`:latest` is appended) |
+| `registry_password` | ✅ | — | Registry password/token (use secrets) |
+| `ssh_key` | ✅ | — | SSH private key for the remote builder (use secrets) |
+| `registry_host` | ❌ | `git.ivanch.me` | Container registry hostname |
+| `registry_username` | ❌ | `ivanch` | Registry username |
+| `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms |
+| `build_context` | ❌ | `.` | Docker build context |
+| `build_dockerfile` | ❌ | `Dockerfile` | Dockerfile path |
+| `docker_host` | ❌ | `docker-build.haven` | Remote builder hostname |
+| `docker_user` | ❌ | `root` | SSH user for remote builder |
+
+---
+
+### `deploy-restart`
+
+Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a Kubernetes Deployment.
+
+```yaml
+jobs:
+  deploy:
+    runs-on: ubuntu-amd64
+    needs: build
+    steps:
+      - uses: ivanch/pipeline-actions/deploy-restart@main
+        with:
+          kube_config: ${{ secrets.KUBE_CONFIG }}
+          deployment_name: my-app
+          # optional:
+          # namespace: default
+          # kube_version: stable
+```
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `kube_config` | ✅ | — | Full kubeconfig YAML (use secrets) |
+| `deployment_name` | ✅ | — | Deployment name to restart |
+| `namespace` | ❌ | `default` | Kubernetes namespace |
+| `kube_version` | ❌ | `stable` | kubectl version (`stable` or e.g. `v1.31.0`) |
+
+## Required Secrets
+
+Consumer repositories need these secrets configured in Gitea:
+
+| Secret | Used by | Purpose |
+|---|---|---|
+| `REGISTRY_PASSWORD` | `build-and-push` | Container registry password/token |
+| `SSH_KEY_DOCKERBUILD` | `build-and-push` | SSH private key for `docker-build.haven` |
+| `KUBE_CONFIG` | `deploy-restart` | Full kubeconfig YAML for cluster access |