feat: reusable build-and-push and deploy-restart composite actions

- build-and-push: multi-arch Docker build via remote Buildx builder over SSH
- deploy-restart: kubectl rollout restart with kubeconfig validation
- README with usage examples and required secrets

build-and-push/action.yaml

@@ -0,0 +1,89 @@
+name: Build and Push Multi-Arch Image
+description: Log in to a container registry, set up a remote Docker Buildx builder over SSH, and build + push a multi-arch image.
+
+inputs:
+  registry_host:
+    description: Hostname of the container registry
+    required: true
+    default: git.ivanch.me
+  registry_username:
+    description: Username for the container registry
+    required: true
+    default: ivanch
+  registry_password:
+    description: Password / token for the container registry (pass via secrets)
+    required: true
+  image:
+    description: Full image reference (host/path/name) without tag — :latest is appended
+    required: true
+  platforms:
+    description: Comma-separated list of target platforms
+    required: false
+    default: linux/amd64,linux/arm64
+  build_context:
+    description: Docker build context path
+    required: false
+    default: .
+  build_dockerfile:
+    description: Path to the Dockerfile (relative to context)
+    required: false
+    default: Dockerfile
+  ssh_key:
+    description: SSH private key for the remote Docker builder host (pass via secrets)
+    required: true
+  docker_host:
+    description: Hostname of the remote Docker Buildx builder
+    required: false
+    default: docker-build.haven
+  docker_user:
+    description: SSH user for the remote Docker builder
+    required: false
+    default: root
+
+runs:
+  using: composite
+  steps:
+    - name: Log in to Container Registry
+      shell: bash
+      env:
+        REGISTRY_HOST: ${{ inputs.registry_host }}
+        REGISTRY_USERNAME: ${{ inputs.registry_username }}
+        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
+      run: |
+        echo "${REGISTRY_PASSWORD}" \
+          | docker login "${REGISTRY_HOST}" \
+              -u "${REGISTRY_USERNAME}" \
+              --password-stdin
+
+    - name: Set up SSH key for remote builder
+      shell: bash
+      env:
+        SSH_KEY: ${{ inputs.ssh_key }}
+        DOCKER_HOST: ${{ inputs.docker_host }}
+      run: |
+        mkdir -p ~/.ssh
+        echo "${SSH_KEY}" > ~/.ssh/id_ed25519
+        chmod 600 ~/.ssh/id_ed25519
+        ssh-keyscan "${DOCKER_HOST}" >> ~/.ssh/known_hosts
+
+    - name: Set up remote Docker Buildx builder
+      shell: bash
+      env:
+        DOCKER_HOST: ${{ inputs.docker_host }}
+        DOCKER_USER: ${{ inputs.docker_user }}
+      run: |
+        docker context create remote-builder \
+          --docker "host=ssh://${DOCKER_USER}@${DOCKER_HOST}"
+        docker context use remote-builder
+        docker buildx inspect --bootstrap
+
+    - name: Build and Push Multi-Arch Image
+      uses: docker/build-push-action@v6
+      with:
+        push: true
+        context: ${{ inputs.build_context }}
+        file: ${{ inputs.build_dockerfile }}
+        builder: remote-builder
+        platforms: ${{ inputs.platforms }}
+        tags: |
+          ${{ inputs.image }}:latest