adding docker-build job

README.md

@@ -49,6 +49,47 @@ jobs:
 
 ---
 
+### `docker-build`
+
+Builds a multi-architecture Docker image on the same remote Buildx builder as `build-and-push`, but **does not push** it. Useful for validating a Dockerfile (e.g. on PRs / non-main branches).
+
+```yaml
+jobs:
+  build:
+    name: Build Image (no push)
+    runs-on: runner-slim-amd64
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://git.ivanch.me/ivanch/pipeline-actions/docker-build@main
+        with:
+          ssh_key: ${{ secrets.SSH_KEY_DOCKERBUILD }}
+          # optional:
+          # registry_password: ${{ secrets.REGISTRY_PASSWORD }}  # only for private base images
+          # image: git.ivanch.me/ivanch/my-app
+          # image_tag: latest
+          # platforms: linux/amd64,linux/arm64
+          # build_context: .
+          # build_dockerfile: Dockerfile
+          # build_args: ""
+```
+
+| Input | Required | Default | Description |
+|---|---|---|---|
+| `ssh_key` | ✅ | — | SSH private key for the remote builder (use secrets) |
+| `registry_password` | ❌ | _(empty)_ | When set, logs into the registry first (needed only for private base images) |
+| `registry_host` | ❌ | `git.ivanch.me` | Container registry hostname |
+| `registry_username` | ❌ | `ivanch` | Registry username |
+| `image` | ❌ | _(empty)_ | Image reference without tag; only used to tag the build result |
+| `image_tag` | ❌ | `latest` | Tag(s) applied when `image` is set (comma-separated) |
+| `platforms` | ❌ | `linux/amd64,linux/arm64` | Target build platforms |
+| `build_context` | ❌ | `.` | Docker build context path |
+| `build_dockerfile` | ❌ | `Dockerfile` | Dockerfile path relative to context |
+| `build_args` | ❌ | _(empty)_ | Build arguments, one `KEY=VALUE` per line |
+| `docker_host` | ❌ | `docker-build.haven` | Remote builder hostname |
+| `docker_user` | ❌ | `root` | SSH user for remote builder |
+
+---
+
 ### `deploy-restart`
 
 Validates a kubeconfig, installs kubectl, and performs a `rollout restart` of a Kubernetes Deployment.
@@ -158,7 +199,7 @@ Consumer repositories need these secrets configured in Gitea:
 | Secret | Used by | Purpose |
 |---|---|---|
 | `REGISTRY_PASSWORD` | `build-and-push` | Container registry password/token |
-| `SSH_KEY_DOCKERBUILD` | `build-and-push` | SSH private key for `docker-build.haven` |
+| `SSH_KEY_DOCKERBUILD` | `build-and-push, docker-build` | SSH private key for `docker-build.haven` |
 | `KUBE_CONFIG` | `deploy-restart, kubectl-apply` | Full kubeconfig YAML for cluster access |
 | `DEPLOY_HOST` | `ssh-deploy` | Remote server hostname or IP |
 | `DEPLOY_USERNAME` | `ssh-deploy` | SSH username for the remote server |