chore(release): plugin.json version 0.6.1

Skip-Release: true

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "skills",
   "description": "Mathias's engineering skills library, plus the hooks and MCP servers that make it enforceable: TDD, clean code, debugging, specs, discovery, CI, and secret hygiene.",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "author": {
     "name": "Mathias",
     "url": "https://git.d-ma.be/mathias"

.mcp.json

@@ -1,16 +1,16 @@
 {
-  "_comment": "Tailnet-direct NodePorts, not the public d-ma.be hostnames. The public path goes out through Cloudflare and NPM to reach a k3s service on koala, which imposes rate limits and message-size caps on tool results and adds a full internet round trip - for a service on the same machine most sessions run on. Requires koala to allow these ports on the Tailscale interface; see mathias/skills#24.",
+  "_comment": "Tailscale Serve on koala, not the public d-ma.be hostnames. The public path exits to Cloudflare and NPM to reach a k3s service on the same machine most sessions run on, which imposes rate limits and message-size caps on tool results. Serve terminates TLS with a real Tailscale cert and proxies to the NodePort over loopback, so traffic reaches the service from koala itself and satisfies the default-deny-ingress NetworkPolicy with no cluster change. Clients need 'tailscale set --accept-dns=true' for the MagicDNS name to resolve; see mathias/skills#24.",
   "mcpServers": {
     "brain": {
       "type": "http",
-      "url": "http://koala:30330/mcp",
+      "url": "https://koala.tail30472e.ts.net:8443/mcp",
       "headers": {
         "Authorization": "Bearer ${BRAIN_MCP_TOKEN}"
       }
     },
     "infra": {
       "type": "http",
-      "url": "http://koala:30342/mcp"
+      "url": "https://koala.tail30472e.ts.net:8444/mcp"
     }
   }
-}
+}

skills/gitea-ci/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gitea-ci
-description: End-to-end Gitea CI/CD setup with self-hosted act_runner, quality gate pipeline, buildah image build, k3s deploy, and GitHub mirror. Covers act_runner-specific gotchas that are not documented anywhere.
+description: End-to-end Gitea CI/CD setup with self-hosted act_runner, quality gate pipeline, buildctl image build, k3s deploy, and GitHub mirror. Covers act_runner-specific gotchas that are not documented anywhere.
 ---
 
 # Gitea CI/CD Pipeline Setup
@@ -31,7 +31,7 @@ Before writing any YAML, collect the following. Use AskUserQuestion for anything
 | Container registry | Ask or check existing config | `localhost:5000` on koala, or external |
 | k3s namespace | k8s/ manifests or ask | Deploy target |
 | GitHub mirror repo | Ask | Target for the mirror job |
-| Image name | Ask or derive from repo name | Used in buildah + k3s steps |
+| Image name | Ask or derive from repo name | Used in buildctl + k3s steps |
 
 Check the project's `CLAUDE.md` for infra notes first — often this answers most questions without needing to ask.
 
@@ -135,33 +135,49 @@ jobs:
 
       - name: Build and push to local registry
         run: |
+          set -e
+          # buildctl, NOT buildah (infra#241). The runner is a pod with
+          # `capabilities: drop [ALL]` and `allowPrivilegeEscalation: false`,
+          # so rootless buildah cannot remap UID/GID for a fresh base-image
+          # pull and the pod has no OCI runtime -- every `RUN` step fails.
+          # buildctl is a thin client: it hands the build to the host's
+          # buildkitd over a socket, so the privileged work happens on the
+          # host and the pod's securityContext is not in the picture.
+          # The failure is LATENT -- warm base-image layers mask it, so a
+          # buildah step can look fine for weeks and then fail on a cold pull.
+          BUILDKIT_HOST="unix:///run/buildkit/buildkitd.sock"
           REGISTRY="localhost:5000"
           REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
-          buildah build \
+          TAR_FILE="$(mktemp)"
-            --label "org.opencontainers.image.revision=${{ github.sha }}" \
+          trap 'rm -f "$TAR_FILE"' EXIT
-            --label "org.opencontainers.image.source=${{ github.repositoryUrl }}" \
+
-            -t ${REF} \
+          buildctl --addr "$BUILDKIT_HOST" build \
-            -t ${REGISTRY}/${{ env.IMAGE }}:latest \
+            --frontend dockerfile.v0 \
-            .
+            --local context=. \
-          buildah push --tls-verify=false ${REF}
+            --local dockerfile=. \
-          buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
+            --opt label:org.opencontainers.image.revision="${{ github.sha }}" \
-          [[ -n "${{ steps.meta.outputs.version-tag }}" ]] && \
+            --opt label:org.opencontainers.image.source="${{ github.repositoryUrl }}" \
-            buildah push --tls-verify=false \
+            --output type=oci,dest="$TAR_FILE"
-              ${REF} \
+
-              ${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
+          # buildctl has no registry-push equivalent to `buildah push`; skopeo
+          # copies the OCI archive up, once per tag.
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://${REF}
+          skopeo copy --dest-tls-verify=false \
+            oci-archive:"$TAR_FILE" docker://${REGISTRY}/${{ env.IMAGE }}:latest
+          if [ -n "${{ steps.meta.outputs.version-tag }}" ]; then
+            skopeo copy --dest-tls-verify=false \
+              oci-archive:"$TAR_FILE" \
+              docker://${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }}
+          fi
           echo "✓ Image pushed to ${REF}"
 
-      - name: Smoke test
+      # No smoke test step. The one this skill used to recommend ran
-        run: |
+      # `sudo k3s ctr run` against the host's containerd -- that worked when
-          REGISTRY="localhost:5000"
+      # the runner was the Arch host, and is impossible now that it is a pod:
-          REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
+      # no sudo, no ctr, no containerd socket (`sudo: command not found`).
-          CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
+      # The deploy job's `Verify rollout` + `Confirm pod running new image`
-          sudo k3s ctr images pull --plain-http ${REF}
+      # below assert the same property against the real workload.
-          OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /<binary-name> 2>&1 || true)
-          sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
-          echo "$OUTPUT" | grep -q "<project-name>" \
-            && echo "✓ Smoke test passed" \
-            || echo "⚠ Smoke test inconclusive: $OUTPUT"
 
   # ── 3. Deploy to k3s ────────────────────────────────────────────────────────
   deploy: