let's try CI images again

.forgejo/workflows/images.yaml

@@ -0,0 +1,31 @@
+on:
+  push:
+    paths:
+      - 'pkgs/images/**'
+      - '.forgejo/workflows/**'
+      - 'flake.lock'
+jobs:
+  check:
+    runs-on: nix-upstream-latest
+    steps:
+      - run: echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+      - run: nix-env -i curl nodejs skopeo # bootstrap
+      - uses: actions/checkout@v4
+      - run: |-
+          cat > tags.txt <<EOF
+            nix-with-node:nix
+          EOF
+          mkdir -p /etc/containers
+          cat > /etc/containers/policy.json <<EOF
+            {
+              "default": [{"type": "insecureAcceptAnything"}],
+              "transports": {"docker-daemon": {"": [{"type":"insecureAcceptAnything"}]}}
+            }
+          EOF
+      - run: |-
+          for line in $(cat tags.txt); do
+            IFS=: read -r pkg tag <<< $line
+            cp $(nix build .#$pkg --print-out-paths) /tmp/image.tar.gz
+            gunzip /tmp/image.tar.gz
+            skopeo copy --dest-creds="${{ secrets.FJ_USER }}:${{ secrets.FJ_PASS }}" docker-archive:///tmp/image.tar build .#$pkg --print-out-paths) docker://git.10110110.xyz/ci/$tag:latest
+          done