2 Commits

Include renames

Author	SHA1	Message	Date
Bastian de BylandClaude Opus 5.5	be50798096	fix(ci-images): static build matrix for Gitea ... Gitea expands a job's matrix when the run is created, before plan has any outputs, so fromJSON(needs.plan.outputs.matrix) collapsed to a single empty "Build ${{ matrix.key }}" job and nothing was ever built. The matrix is now the fixed list of image keys; plan emits every image's spec with a build flag and each matrix job looks its own entry up, no-opping when it wasn't picked. Also document that both registry tokens need write:package -- the vault token was read-only, so the gitea_ci_build_local bootstrap failed its push. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-28 19:00:35 -04:00
Bastian de BylandClaude Opus 5	d0e76bd6cf	feat(gitea-actions): build the CI job images in Gitea CI ... The runner's job images were built by ansible into localhost/ only, so the nightly CI prune deleted them and every idle stretch ended with CI failing in under a second on `docker pull localhost/gitea-ci:latest` until someone re-ran the role and waited out a rebuild. The previous commit moved them to the Gitea registry; this moves the *build* off the deploy path entirely. - .gitea/workflows/ci-images.yml builds files/Containerfile.* and pushes to git.debyl.io/gitbot/. Per-image change detection, so an ESP-IDF pin bump does not rebuild the other two; weekly schedule for base-image updates; a workflow_dispatch selector. PRs build under a throwaway :pr-<n> tag and drop it -- the build lands in the live runner's store, and act_runner will not re-pull a tag it already has, so a PR using the real tag would hand every later job on this host an unmerged image. - The Containerfiles stop being ansible templates: their version vars are now --build-arg, read by the workflow out of the same defaults/main.yml the role interpolates, so CI and ansible build the same bytes from one set of pins. - LABEL io.debyl.ci-base moves into each Containerfile so neither builder can forget the prune exemption; the workflow re-checks it before pushing. - roles/gitea-actions pulls instead of building. gitea_ci_build_local=true restores the local build+push for seeding a cold registry or when CI is down -- the workflow that builds gitea-ci runs in gitea-ci. - Lint .gitea/ alongside ansible/, and document the flow in the role README. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-21 11:10:43 -04:00