Add scratch Docker image and Gitea publishing workflow

Dockerfile

@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+
+FROM rust:1-slim AS builder
+
+ARG RUST_TARGET=x86_64-unknown-linux-musl
+
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
+        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add "${RUST_TARGET}"
+
+WORKDIR /app
+COPY Cargo.toml Cargo.lock ./
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    mkdir -p src \
+ && printf 'fn main() {}' > src/main.rs \
+ && cargo fetch --locked --target "${RUST_TARGET}"
+
+COPY src ./src
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --locked --target "${RUST_TARGET}" \
+ && mkdir -p /out \
+ && cp "/app/target/${RUST_TARGET}/release/hermes" /out/hermes
+
+FROM scratch AS runtime
+
+COPY --from=builder /out/hermes /usr/local/bin/hermes
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+ENV HERMES_CONFIG_PATH=/etc/hermes/hermes.yaml
+WORKDIR /etc/hermes
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/hermes"]