fix(gitea-actions): serve CI images from the Gitea registry

The CI job images only existed under localhost/ in the gitea-runner store,
and the nightly CI prune deletes any image older than 48h that no container
holds. After every idle stretch CI failed in 0-1s pulling
localhost/gitea-ci:latest until the role was re-run and the images rebuilt.

- Build under git.debyl.io/gitbot/..., push after every run, and pull from the
  registry instead of rebuilding when the Containerfile is unchanged.
- Log gitea-runner in via ~/.docker/config.json, which both act_runner (job
  image pulls) and podman read.
- Label the base images io.debyl.ci-base and skip that label in the CI prune;
  its `until` counts from build time, so a re-pulled image would otherwise be
  deleted again the next night.

Workflows pinning `container: image: localhost/gitea-ci-*` must move to the
registry paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/gitea-actions/tasks/images.yml

@@ -1,4 +1,8 @@
 ---
+# CI job images: stage each Containerfile, restore the image from the Gitea
+# registry if the nightly prune removed it, rebuild only when the Containerfile
+# changed, then push so the registry always holds what the runner uses.
+# See gitea_ci_images in defaults/main.yml.
 - name: create CI image build directory
   become: true
   become_user: "{{ gitea_runner_user }}"
@@ -8,71 +12,74 @@
     mode: "0755"
   tags: gitea-actions
 
-- name: stage default CI Containerfile
+- name: create gitea-runner registry auth directory
+  become: true
+  become_user: "{{ gitea_runner_user }}"
+  ansible.builtin.file:
+    path: "{{ gitea_ci_registry_authfile | dirname }}"
+    state: directory
+    mode: "0700"
+  tags: gitea-actions
+
+- name: log gitea-runner in to the Gitea container registry
+  become: true
+  become_user: "{{ gitea_runner_user }}"
+  containers.podman.podman_login:
+    registry: "{{ gitea_ci_registry }}"
+    username: "{{ gitea_registry_username }}"
+    password: "{{ gitea_registry_token }}"
+    authfile: "{{ gitea_ci_registry_authfile }}"
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+  no_log: true
+  tags: gitea-actions
+
+- name: stage CI Containerfiles
   become: true
   become_user: "{{ gitea_runner_user }}"
   ansible.builtin.template:
-    src: Containerfile.ci
-    dest: "{{ gitea_runner_home }}/ci-images/Containerfile.ci"
+    src: "{{ item.template }}"
+    dest: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
     mode: "0644"
-  register: ci_containerfile
+  loop: "{{ gitea_ci_images }}"
+  loop_control:
+    label: "{{ item.containerfile }}"
+  register: ci_containerfiles
   tags: gitea-actions
 
-- name: stage ESP-IDF CI Containerfile
-  become: true
-  become_user: "{{ gitea_runner_user }}"
-  ansible.builtin.template:
-    src: Containerfile.espidf.j2
-    dest: "{{ gitea_runner_home }}/ci-images/Containerfile.espidf"
-    mode: "0644"
-  register: espidf_containerfile
-  tags: gitea-actions
-
-- name: build default CI image ({{ gitea_ci_image }})
+# A missing image here is normal (first push, or a new tag): the build below
+# creates it. Anything already present locally is left untouched.
+- name: restore CI images from the registry
   become: true
   become_user: "{{ gitea_runner_user }}"
   containers.podman.podman_image:
-    name: "{{ gitea_ci_image }}"
-    path: "{{ gitea_runner_home }}/ci-images"
-    build:
-      file: "{{ gitea_runner_home }}/ci-images/Containerfile.ci"
-    force: "{{ ci_containerfile is changed }}"
+    name: "{{ item.image }}"
+    auth_file: "{{ gitea_ci_registry_authfile }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+  loop: "{{ gitea_ci_images }}"
+  loop_control:
+    label: "{{ item.image }}"
+  when: not (ci_containerfiles.results | selectattr('item.image', 'equalto', item.image) | first).changed
+  failed_when: false
   tags: gitea-actions
 
-- name: stage PlatformIO CI Containerfile
-  become: true
-  become_user: "{{ gitea_runner_user }}"
-  ansible.builtin.template:
-    src: Containerfile.platformio.j2
-    dest: "{{ gitea_runner_home }}/ci-images/Containerfile.platformio"
-    mode: "0644"
-  register: platformio_containerfile
-  tags: gitea-actions
-
-- name: build ESP-IDF CI image ({{ gitea_ci_espidf_image }})
+- name: build and push CI images
   become: true
   become_user: "{{ gitea_runner_user }}"
   containers.podman.podman_image:
-    name: "{{ gitea_ci_espidf_image }}"
+    name: "{{ item.image }}"
     path: "{{ gitea_runner_home }}/ci-images"
     build:
-      file: "{{ gitea_runner_home }}/ci-images/Containerfile.espidf"
-    force: "{{ espidf_containerfile is changed }}"
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-  tags: gitea-actions
-
-- name: build PlatformIO CI image ({{ gitea_ci_platformio_image }})
-  become: true
-  become_user: "{{ gitea_runner_user }}"
-  containers.podman.podman_image:
-    name: "{{ gitea_ci_platformio_image }}"
-    path: "{{ gitea_runner_home }}/ci-images"
-    build:
-      file: "{{ gitea_runner_home }}/ci-images/Containerfile.platformio"
-    force: "{{ platformio_containerfile is changed }}"
+      file: "{{ gitea_runner_home }}/ci-images/{{ item.containerfile }}"
+      # Exempts the image from the nightly CI prune (gitea_ci_keep_label).
+      extra_args: "--label {{ gitea_ci_keep_label }}=true"
+    force: "{{ (ci_containerfiles.results | selectattr('item.image', 'equalto', item.image) | first).changed }}"
+    push: true
+    auth_file: "{{ gitea_ci_registry_authfile }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
+  loop: "{{ gitea_ci_images }}"
+  loop_control:
+    label: "{{ item.image }}"
   tags: gitea-actions