Replaces docker-ce-cli (requiring external Docker apt repo) with
docker.io from Ubuntu 24.04 main, which is sufficient for docker login
and working alongside buildx.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Single combined layer was ~280MB and consistently failed to push with
499 (nginx closing connection). Split into three layers (~70-100MB each)
so each is pushed independently and stays within the timeout.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docker/login-action requires the docker CLI binary in the job container.
The daemon is provided by the host socket mount; only the CLI is needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Labels are defined in act-runner-config.yml which is the authoritative
source. The env var is only used on first registration and was being
ignored after .runner was created.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The label now explicitly declares the dependency versions it provides
rather than using the opaque ubuntu-latest alias. All runs-on fields
in ci.yml updated to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move ubuntu-latest → runner-base:py3.12-node22 mapping into
act-runner-config.yml so it is respected at runtime. The
GITEA_RUNNER_LABELS env var is only honoured on first registration
and was being ignored after the runner's .runner file was created.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- infra/Dockerfile.runner-base: new Ubuntu 24.04 image with Python 3.12
and Node 22 LTS pre-installed, tagged py3.12-node22. Eliminates the
~3-4 min deadsnakes PPA install that ran on every test job.
- infra/runner-compose.yml: update ubuntu-latest label to use
runner-base:py3.12-node22 instead of node:20-bullseye.
- .forgejo/workflows/ci.yml: remove Python 3.12 install steps (now in
base image), add actions/cache for pip keyed on pyproject.toml hash,
bump node-version 20 → 22.
- Dockerfile: bump frontend build stage node:20-alpine → node:22-alpine.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Since Forgejo and the app share a swarm, the runner can:
- Connect to Forgejo at http://forgejo:3000 (internal, no Traefik)
- Call docker service update directly via mounted socket
- Avoid SSH entirely — secrets drop from 6 to 3
infra/runner-swarm.yml: runner added to Forgejo stack, pinned to manager
node (required for service API access), uses Docker Swarm Config object
for act_runner config injection
infra/act-runner-config.yml: runner config (bridge network for jobs,
docker socket whitelisted)
build.yml: deploy step replaced with docker service update --with-registry-auth
--detach=false (waits for rollout, shows progress in Actions log)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- build.yml: clarify that runner needs Docker socket; SSH deploy uses
DEPLOY_PATH secret so app host path is configurable; --no-deps so
db/ollama containers are left untouched during deploy
- infra/runner-swarm.yml: act_runner as a Docker service on the Forgejo
host — mounts host socket for buildx, writes act_runner config via
one-shot init container, connects to fabled_backend network
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bvandeusen
Bryan Van Deusen