test(ci): add self-test workflow for build-and-push action

Builds a tiny inline alpine image through build-and-push against the
remote buildx builder and asserts the pushed manifest is multi-arch.
Pushes to a throwaway :citest tag so it never touches real images.
Triggered on workflow_dispatch and on changes to the action.

.gitea/workflows/test-build.yaml

@@ -0,0 +1,59 @@
+name: Test build-and-push (self-test)
+
+# Validates the build-and-push composite action end-to-end against the remote
+# docker-build.haven buildx builder, using a tiny throwaway image. Runs on
+# manual dispatch and whenever the action itself changes.
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - main
+    paths:
+      - build-and-push/**
+      - .gitea/workflows/test-build.yaml
+
+env:
+  # Throwaway image ref — kept separate from any real project image so this
+  # self-test can never clobber a production tag.
+  IMAGE: git.ivanch.me/ivanch/pipeline-actions-selftest
+
+jobs:
+  test-build:
+    name: Build tiny multi-arch image
+    runs-on: ubuntu-amd64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Generate a minimal Dockerfile
+        shell: bash
+        run: |
+          mkdir -p _selftest
+          cat > _selftest/Dockerfile <<'EOF'
+          FROM alpine:3.20
+          RUN echo "pipeline-actions self-test build OK"
+          CMD ["true"]
+          EOF
+
+      - name: Build and push via composite action
+        uses: https://git.ivanch.me/ivanch/pipeline-actions/build-and-push@main
+        with:
+          image: ${{ env.IMAGE }}
+          image_tag: citest
+          build_context: _selftest
+          build_dockerfile: Dockerfile
+          registry_password: ${{ secrets.REGISTRY_PASSWORD }}
+          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}
+
+      - name: Verify pushed image is pullable and multi-arch
+        shell: bash
+        env:
+          IMAGE: ${{ env.IMAGE }}
+        run: |
+          echo "== inspecting ${IMAGE}:citest manifest =="
+          docker buildx imagetools inspect "${IMAGE}:citest"
+          # Assert both target arches are present in the manifest list.
+          MANIFEST="$(docker buildx imagetools inspect "${IMAGE}:citest")"
+          echo "${MANIFEST}" | grep -q "linux/amd64" || { echo "missing linux/amd64"; exit 1; }
+          echo "${MANIFEST}" | grep -q "linux/arm64" || { echo "missing linux/arm64"; exit 1; }
+          echo "self-test PASSED: multi-arch image built and pushed"