From c11e2b19f8d98c76fb60324212827b7db014bb62 Mon Sep 17 00:00:00 2001
From: agent <markus+agent@langenoja.se>
Date: Tue, 8 Sep 2026 08:08:17 +0200
Subject: [PATCH] ci: build without an exporter on validation runs; assert
 chromium and psql
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

buildctl v0.32 has no "cacheonly" exporter, so every push-triggered
validation build since this workflow was added failed with 'exporter
"cacheonly" could not be found' (run 16, 2026-09-08) — unnoticed, since
nothing depended on it. A build with no --output still builds every
stage on both architectures. The post-publish toolchain assertion now
also requires chromium-browser and psql (12.11.1-ci7).
---
 .github/workflows/build-image-gitea.yml | 29 +++++++++++++++----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-image-gitea.yml b/.github/workflows/build-image-gitea.yml
index f7e7bed..d63e87c 100644
--- a/.github/workflows/build-image-gitea.yml
+++ b/.github/workflows/build-image-gitea.yml
@@ -106,17 +106,25 @@ jobs:
         run: |
           set -euo pipefail
           REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          # No --output on a validation run: buildctl v0.32 has no "cacheonly"
+          # exporter (run 16, 2026-09-08: 'exporter "cacheonly" could not be
+          # found'), so every push-triggered validation since this workflow
+          # was added had failed — silently, since nothing depended on it. A
+          # build without an exporter still builds every stage on both arches.
           if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
-            out="type=image,name=${REF},push=true"
+            buildctl build --progress=plain \
+              --frontend dockerfile.v0 \
+              --local context=. \
+              --local dockerfile=. \
+              --opt platform=linux/amd64,linux/arm64 \
+              --output "type=image,name=${REF},push=true"
           else
-            out="type=cacheonly"
+            buildctl build --progress=plain \
+              --frontend dockerfile.v0 \
+              --local context=. \
+              --local dockerfile=. \
+              --opt platform=linux/amd64,linux/arm64
           fi
-          buildctl build --progress=plain \
-            --frontend dockerfile.v0 \
-            --local context=. \
-            --local dockerfile=. \
-            --opt platform=linux/amd64,linux/arm64 \
-            --output "$out"
 
       # The image is a TOOLCHAIN, so "it built" is not the property that matters
       # — "it still contains what the gates shell out to" is. build-image.yml
@@ -142,7 +150,7 @@ jobs:
             echo "FROM ${REF}"
             echo 'RUN set -eu; \'
             echo '    python3 -c "import yaml, sys; print(\"python3+yaml\", sys.version.split()[0])"; \'
-            echo '    for t in gcc node bash make curl tar openssl jq; do \'
+            echo '    for t in gcc node bash make curl tar openssl jq chromium-browser psql; do \'
             echo '      command -v "$t" >/dev/null || { echo "MISSING: $t" >&2; exit 1; }; \'
             echo '      echo "ok: $t"; \'
             echo '    done; \'
@@ -154,8 +162,7 @@ jobs:
             --frontend dockerfile.v0 \
             --local context="$work" \
             --local dockerfile="$work" \
-            --opt platform=linux/amd64,linux/arm64 \
-            --output type=cacheonly
+            --opt platform=linux/amd64,linux/arm64
           echo "✓ toolchain intact on linux/amd64 and linux/arm64"
 
       - name: Summary