ci(dexkeeper): self-contained inline Docker workflow (luxfi/node pattern)

The hanzoai/.github reusable docker-build.yml is unreachable cross-org from
luxfi/* (GitHub 'workflow was not found' at validation -> 0s fail; the real
reason dex's docker.yml never ran). Give dexkeeper its own inline workflow on
the lux-build ARC pool, mirroring luxfi/node's proven Docker workflow exactly
(PAT resolve -> docker/build-push-action with secret id=ghtok). Align
Dockerfile.dexkeeper to consume id=ghtok. Remove the dexkeeper matrix entry
from the (cross-org-broken) reusable docker.yml.

.github/workflows/docker-dexkeeper.yml

@@ -0,0 +1,97 @@
+name: Docker dexkeeper
+
+# Self-contained image build for ghcr.io/luxfi/dexkeeper on the lux-build ARC
+# pool. Deliberately INLINE (not the hanzoai/.github reusable workflow): luxfi/*
+# repos cannot resolve the cross-org reusable `docker-build.yml@main` (GitHub
+# "workflow was not found" at validation — the reason docker.yml fails at 0s).
+# This mirrors luxfi/node's proven inline Docker workflow exactly.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    tags: ['v*']
+    paths:
+      - 'cmd/dexkeeper/**'
+      - 'Dockerfile.dexkeeper'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/docker-dexkeeper.yml'
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
+jobs:
+  build-amd64:
+    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, amd64
+    # DOKS nodes, DinD sidecar) — same pool luxfi/node builds on.
+    runs-on: lux-build
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: |
+            network=host
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/luxfi/dexkeeper
+          flavor: |
+            latest=false
+          tags: |
+            type=ref,event=tag
+            type=sha,format=short,prefix=sha-
+
+      - name: Resolve cross-repo PAT for private luxfi/* deps
+        id: pat
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+        run: |
+          tok="$GH_TOKEN"
+          src="GH_TOKEN"
+          if [ -z "$tok" ]; then
+            tok="$UNIVERSE_PAT"
+            src="UNIVERSE_PAT"
+          fi
+          if [ -z "$tok" ]; then
+            echo "::error::Neither GH_TOKEN (org) nor UNIVERSE_PAT (repo) is set. Private luxfi/* deps cannot be resolved."
+            exit 1
+          fi
+          echo "Using secret: $src (length=${#tok})"
+          echo "::add-mask::$tok"
+          echo "token<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$tok" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Build & push dexkeeper (amd64)
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.dexkeeper
+          platforms: linux/amd64
+          push: true
+          # The Dockerfile resolves private luxfi/* modules via git url.insteadOf,
+          # taking the token from the BuildKit secret id=ghtok (node's convention).
+          secrets: |
+            ghtok=${{ steps.pat.outputs.token }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          cache-from: type=registry,ref=ghcr.io/luxfi/dexkeeper:buildcache-amd64
+          cache-to: type=registry,ref=ghcr.io/luxfi/dexkeeper:buildcache-amd64,mode=max

.github/workflows/docker.yml

@@ -20,8 +20,9 @@ jobs:
             dockerfile: Dockerfile
           - image: ghcr.io/luxfi/dex-gateway
             dockerfile: Dockerfile.gateway
-          - image: ghcr.io/luxfi/dexkeeper
-            dockerfile: Dockerfile.dexkeeper
+          # NOTE: ghcr.io/luxfi/dexkeeper builds via the self-contained
+          # docker-dexkeeper.yml (inline, lux-build pool) — this reusable-workflow
+          # path cannot resolve hanzoai/.github cross-org ("workflow was not found").
     uses: hanzoai/.github/.github/workflows/docker-build.yml@main
     with:
       image: ${{ matrix.image }}

Dockerfile.dexkeeper

@@ -17,13 +17,13 @@ ENV GOPRIVATE=github.com/luxfi/*,github.com/hanzoai/*
 
 WORKDIR /app
 COPY go.mod go.sum ./
-# Private cross-repo Go modules (luxfi/*): the reusable docker-build workflow
-# exposes the org PAT as a BuildKit secret id=gh_token. Mount it for the module
-# fetch only (never baked into a layer). ARG GITHUB_TOKEN remains a fallback for
-# local `--build-arg` builds; the secret takes precedence when present.
+# Private cross-repo Go modules (luxfi/*): the docker-dexkeeper workflow exposes
+# the org PAT as a BuildKit secret id=ghtok (luxfi/node's convention). Mount it
+# for the module fetch only (never baked into a layer). ARG GITHUB_TOKEN remains
+# a fallback for local `--build-arg` builds; the secret takes precedence.
 ARG GITHUB_TOKEN
-RUN --mount=type=secret,id=gh_token \
-    TOKEN="$(cat /run/secrets/gh_token 2>/dev/null || echo "${GITHUB_TOKEN}")" && \
+RUN --mount=type=secret,id=ghtok \
+    TOKEN="$(cat /run/secrets/ghtok 2>/dev/null || echo "${GITHUB_TOKEN}")" && \
     if [ -n "$TOKEN" ]; then \
       git config --global url."https://${TOKEN}@github.com/".insteadOf "https://github.com/"; \
     fi && \