fix: build the runner with a schema that accepts Gitea 28's matrix jobs

Gitea 28 adds job-index and job-total under strategy in the workflow it
sends for a matrix job, and forgejo-runner's schema refuses them, so
every matrix job dies before its first step (zegit image-gitea.yml run
23992, the v0.1.52 tag build). No forgejo-runner release accepts them
(checked through 13.2.1). Build the runner from v12.11.1 at its commit
with a one-file schema patch and two tests, one of them the real payload
of that failed job; the build runs them. Bases are pinned by digest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_018wWyCiV27KmNSauYTdLyp7

Dockerfile

@@ -20,7 +20,27 @@
 # forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
 # version of this comment claimed the package was public and needed no secret;
 # that was wrong for the Gitea registry too, which is private.
-FROM code.forgejo.org/forgejo/runner:12.11.1
+# The runner binary is built from upstream v12.11.1 with one patch: Gitea 28 adds
+# job-index and job-total under `strategy` in the workflow it sends for a matrix
+# job, and the stock schema refuses them ("Unknown Property job-total ... the
+# workflow file is not usable"), so every matrix job dies before its first step.
+# No forgejo-runner release accepts them (checked through 13.2.1). Drop this stage
+# when upstream does, or when the runner is replaced.
+FROM --platform=$BUILDPLATFORM data.forgejo.org/oci/golang:1.25-alpine3.23@sha256:27b3069b25647beacd3745b0b2c83e2f9b8d3935455a32cd4531236ee1c960e0 AS runner-build
+ARG TARGETOS
+ARG TARGETARCH
+RUN apk add --no-cache git
+ADD --keep-git-dir=false https://code.forgejo.org/forgejo/runner.git#8e01d43cd27e0732a1cff664996a92739472d42b /srv
+COPY patches/ /patches/
+WORKDIR /srv
+RUN git apply --verbose /patches/*.patch
+# The patch's own tests, so a build cannot ship a patch that stopped working.
+RUN go test -count=1 ./act/schema/ ./internal/app/run/ -run 'StrategyJobIndexAndTotal|Gitea28MatrixJob'
+RUN CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" go build -trimpath -tags 'netgo osusergo' \
+      -ldflags '-s -w -X code.forgejo.org/forgejo/runner/v12/internal/pkg/ver.version=v12.11.1' \
+      -o /out/forgejo-runner .
+
+FROM code.forgejo.org/forgejo/runner:12.11.1@sha256:a1a2885261a0b8337d4791dd6949651117206741ba66423c24a57c107a64d4a8
 
 USER root
 
@@ -105,5 +125,8 @@ RUN set -eux; \
     echo "brotli-libs ${v}"; \
     [ "$(apk version -t "${v}" 1.2.1-r0)" != "<" ] || { echo "brotli-libs ${v} is older than 1.2.1-r0 (CVE-2026-111497)"; exit 1; }
 
+# The patched binary replaces the stock one (see the runner-build stage).
+COPY --from=runner-build /out/forgejo-runner /bin/forgejo-runner
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000