Images: --provenance=false on buildx pushes; workflow passes the token via env, registry in one place, git version sort, temp builder config; build-images.sh shares the Gradle lock check

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/build-images.sh

@@ -15,10 +15,11 @@
 set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$repo_root"
+# shellcheck source=../tools/gradle-lock.sh
+. "$repo_root/tools/gradle-lock.sh"
 
 [[ -z "$(git status --porcelain)" ]] || { echo "build-images.sh: the working tree is dirty; commit or stash first." >&2; exit 1; }
-lock=/tmp/kvitt-gradle.lock
-if [[ -d "$lock" ]] && pid="$(cat "$lock/pid" 2>/dev/null)" && [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
+if pid="$(gradle_lock_holder)"; then
   echo "build-images.sh: a Gradle build is running (pid $pid); try again when it is done." >&2
   exit 1
 fi
@@ -27,10 +28,11 @@ tag="${1:-$(git rev-parse --short HEAD)}"
 [[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || { echo "build-images.sh: not a valid tag: $tag" >&2; exit 2; }
 
 reg_file="$repo_root/infra/secrets/registry.env"
-registry="gitea.lan/jacobh2"; user=""; token=""; push=0
+default_registry="gitea.lan/jacobh2"   # SPEC §10.3, D-104
+registry="$default_registry"; user=""; token=""; push=0
 if [[ -f "$reg_file" ]]; then
   value() { sed -n "s/^$1=//p" "$reg_file" | tail -n 1; }
-  registry="$(value KVITT_REGISTRY)"; registry="${registry:-gitea.lan/jacobh2}"
+  registry="$(value KVITT_REGISTRY)"; registry="${registry:-$default_registry}"
   user="$(value KVITT_REGISTRY_USER)"; token="$(value KVITT_REGISTRY_TOKEN)"
   push=1
 fi
@@ -58,9 +60,11 @@ if [[ $engine == docker && $push == 1 ]]; then
   # A buildx builder that may push to the plain-HTTP registry (same rule as the Gitea workflow).
   if ! docker buildx inspect kvitt-http-builder >/dev/null 2>&1; then
     cfg="$(mktemp)"
+    trap 'rm -f "$cfg"' EXIT
     printf '[registry."%s"]\n  http = true\n' "$registry_host" > "$cfg"
     docker buildx create --name kvitt-http-builder --config "$cfg" >/dev/null
     rm -f "$cfg"
+    trap - EXIT
   fi
 fi
 
@@ -75,7 +79,9 @@ for spec in "${images[@]}"; do
       podman push --tls-verify=false "$ref:latest"
     fi
   elif [[ $push == 1 ]]; then
-    docker buildx build --builder kvitt-http-builder --platform linux/arm64 -f "$dockerfile" \
+    # --provenance=false: push a plain image manifest, as Podman does, rather than an index with an attestation
+    # entry (same choice as the Gitea workflow).
+    docker buildx build --builder kvitt-http-builder --platform linux/arm64 --provenance=false -f "$dockerfile" \
       -t "$ref:$tag" -t "$ref:latest" --push "$context"
   else
     docker buildx build --platform linux/arm64 -f "$dockerfile" -t "$ref:$tag" -t "$ref:latest" --load "$context"