ci(images): install docker-buildx so --mount=type=cache works (DEV-617)

The signing-service Dockerfile uses the BuildKit `--mount=type=cache`
syntax, which the legacy Docker builder rejects. Debian trixie's
`docker-cli` package does not pull in a BuildKit builder, so even
`DOCKER_BUILDKIT=1` fails with "the --mount option requires BuildKit".

Install Debian trixie's `docker-buildx` package (registers the plugin
at /usr/libexec/docker/cli-plugins/docker-buildx) and switch the build
step to an explicit `docker buildx build --load` so BuildKit frontend
features work regardless of docker-cli aliasing. `--load` ensures the
result is in the local daemon for the subsequent `docker push`.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.forgejo/workflows/build-images.yml

@@ -22,9 +22,11 @@ jobs:
       REGISTRY: harbor.basicstack.de
       IMAGE_REPO: harbor.basicstack.de/basicstack/signing-service
       # The signing-service Dockerfile uses `RUN --mount=type=cache` which
-      # the legacy Docker builder rejects; enable BuildKit so the daemon
-      # routes the build through the Dockerfile frontend declared by
-      # `# syntax=docker/dockerfile:1.7`.
+      # the legacy Docker builder rejects; the Debian `docker-buildx`
+      # package registers the buildx CLI plugin at
+      # `/usr/libexec/docker/cli-plugins/docker-buildx`, and setting
+      # `DOCKER_BUILDKIT=1` routes `docker build` through BuildKit so the
+      # `# syntax=docker/dockerfile:1.7` frontend handles `--mount`.
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Install git + buildx client + ca-certs
@@ -33,12 +35,15 @@ jobs:
           apt-get update
           # Debian trixie: `docker.io` only installs the daemon; the CLI
           # (`/usr/bin/docker`) ships in `docker-cli`, which is a Recommends
-          # and therefore excluded by `--no-install-recommends`. Add it
-          # explicitly.
+          # and therefore excluded by `--no-install-recommends`. The
+          # buildx plugin ships separately in `docker-buildx` and is
+          # required because the signing-service Dockerfile uses
+          # `RUN --mount=type=cache` (BuildKit-only syntax).
           apt-get install -y --no-install-recommends \
-            git curl ca-certificates docker.io docker-cli
+            git curl ca-certificates docker.io docker-cli docker-buildx
           git --version
           docker --version
+          docker buildx version
 
       - name: Clone repository (sha256-aware)
         run: |
@@ -63,7 +68,13 @@ jobs:
         working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
-          docker build \
+          # Explicit `docker buildx build` so BuildKit frontend features
+          # (`# syntax=`, `--mount=type=cache`) work on any docker-cli
+          # version regardless of whether `docker build` is aliased to
+          # buildx. The default `docker` driver loads the result into the
+          # local daemon, so the subsequent `docker push` finds the tags.
+          docker buildx build \
+            --load \
             -f services/signing-service/Dockerfile \
             -t "${{ steps.tags.outputs.image_sha }}" \
             -t "${{ steps.tags.outputs.image_main }}" \