8 Commits

Include renames

Author	SHA1	Message	Date
mathias	21e7d6c74b	fix(ci): smoke test hung 14min — buildah run doesn't die under plain timeout ... Bare `/tapir` runs the long-running server, same as the old ctr-based smoke test. ctr's --rm reliably force-killed it; a plain `timeout N buildah run` does not — it only signals the wrapper, and the container process can survive that and keep the log pipe open, hanging the whole job (observed live: run 155, 14min before failure). Backgrounds the run and tears it down with `buildah rm -f`, which forcibly kills regardless of wrapper state, and captures output via a file instead of a blocking pipe. Refs infra#132.	2026-07-26 06:17:18 +00:00
mathias	8814ba6673	ci(smoke): use buildah run instead of sudo k3s ctr for smoke test ... Same fix as cobalt-dingo — removes the sudo/host-containerd dependency so this still works once the act_runner is containerized (infra#132). Refs infra#132.	2026-07-26 05:57:37 +00:00
mathias	4b557a4325	ci(deploy): add Flux GitOps deploy job, mirroring cobalt-dingo's pattern ... Fixes silent stale-deploy gap: CI built+pushed images but nothing bumped k3s/apps/tapir/deployment.yaml, so merged features sat CI-green with zero production effect (infra#111, infra#168). Flux native image-automation can't scan localhost:5000 from inside k3s pods, so this patches the infra repo directly via the existing INFRA_DEPLOY_KEY org secret (same key cobalt-dingo and brain-gardener already use) on every push to main. Refs infra#111.	2026-07-25 21:21:02 +00:00
mathias	eb24a24b9c	chore(ci): remove mirror job (SSH key rotation pending) ... Mirror to github.com was failing with 'unsupported in libcrypto' on every run (OpenSSL 3.6 / OpenSSH 10 dropped support for the existing key format). Removed rather than leave it polluting the CI signal. Re-add when the deploy key is rotated to ed25519.	2026-06-03 22:21:22 +02:00
mathias	c33cba3555	fix(docker): bump build image to golang:1.26 to match go.mod 1.26.1 ... go.mod requires >=1.26.1 but the Dockerfile pinned golang:1.25 -> 'go.mod requires go >= 1.26.1 (running go 1.25.11)'. Also revert the ci.yml XDG hack: the real rootless-buildah fix is a user ~/.config/containers/storage.conf (vfs + writable runroot), which fixes plain buildah for every repo without workflow changes.	2026-06-03 08:44:41 +02:00
mathias	86f8929c15	fix(ci): give rootless buildah a writable XDG_RUNTIME_DIR in build job ... The act_runner is a systemd service with no login session → XDG_RUNTIME_DIR unset → rootless buildah uses root-owned /run/containers and fails 'mkdir /run/containers: permission denied'. Set XDG_RUNTIME_DIR to a per-job mktemp dir so its runroot is writable. (check + on:/go-version fixes already landed; this unblocks the image build → registry.)	2026-06-03 08:23:40 +02:00
mathias	7ee0684b81	fix(ci): quote "on" key so gitea parses workflow triggers ... Bare 'on:' is a YAML boolean (Norway problem) — parsed as the key True, not the string 'on'. Gitea's workflow loader then materialised 0 jobs and every run failed instantly. Quoting "on": fixes dispatch.	2026-06-03 07:42:30 +02:00
mathias	c7250fc493	ci: add Gitea Actions workflow (gitea-ci skill conventions) ... check -> build -> mirror, self-hosted runner, buildah to localhost:5000, k3s smoke test. Follows the gitea-ci skill template and its act_runner gotchas (secrets inlined in run:, no heredocs). check will be RED until the engine is implemented (acceptance suite). Deploy job omitted until k3s manifests exist in infra. GH_DEPLOY_KEY secret must be set before mirror succeeds.	2026-06-02 11:06:09 +00:00