ci: refuse to re-publish an existing image tag (zegit#262)

A dispatch for 12.11.1-ci7 without sign_only rebuilt and re-pushed the
tag. The registry dropped the old manifest, so flux-config's
12.11.1-ci7@sha256:86d7e3b4 pin now 404s on the next pull. That is the
zegit#143 threat shape, done by accident. Like zegit-arc-runner, a build
now refuses a tag the registry already holds, and sign_only refuses one
it does not.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

.github/workflows/build-image-gitea.yml

@@ -0,0 +1,248 @@
+name: build image (gitea)
+
+# Publishes the runner toolchain image from the SELF-HOSTED Gitea runners, via
+# the in-cluster rootless buildkitd — the same path zegit's own images already
+# use (zegit .github/workflows/image-gitea.yml).
+#
+# Why this exists alongside build-image.yml: that workflow is GitHub-only, so
+# the image the Gitea runners are BUILT FROM could only be produced by GitHub.
+# When GitHub Actions became unavailable on 2026-08-29 that circularity bit —
+# the fix for a missing tool in this very image (openssl/jq, whose absence
+# blocked v0.0.134 and v0.0.135) could not be published on the forge the project
+# is moving to. This removes the dependency.
+#
+# build-image.yml's header says the runners cannot build images because rootless
+# buildah needs user namespaces the pod does not have. That is true of buildah
+# IN THE JOB, and irrelevant here: buildkitd is its own hardened workload in
+# buildkit-system, and this job only speaks to it over the network with
+# buildctl. Nothing is built inside the runner container.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag, e.g. 12.11.1-ci6 (upstream runner version + ci revision)'
+        required: true
+        type: string
+      sign_only:
+        description: 'Sign the already-published tag instead of building it (zegit#262: signs an image published before signing existed)'
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches: [master]
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/build-image-gitea.yml'
+
+env:
+  BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
+  BUILDKIT_VERSION: v0.32.2
+  REGISTRY: gitea.langenoja.se
+  IMAGE_PATH: zegit-zoo/zegit-forgejo-runner
+  COSIGN_VERSION: v3.1.3
+
+jobs:
+  build:
+    # Gitea-only: buildkitd is an in-cluster service that GitHub runners cannot
+    # reach. build-image.yml still covers the GitHub/ghcr.io side.
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      # Workspace-local because the runner is non-root and cannot write to
+      # /usr/local/bin. The smoke test uses the FULL PATH deliberately:
+      # $GITHUB_PATH only takes effect for SUBSEQUENT steps, so a bare
+      # `buildctl --version` here would be command-not-found.
+      - name: Install buildctl
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in
+            x86_64) arch=amd64;;
+            aarch64) arch=arm64;;
+            *) echo "::error::unsupported arch $(uname -m)"; exit 1;;
+          esac
+          mkdir -p "$GITHUB_WORKSPACE/.bin"
+          curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+            | tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
+          echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
+          "$GITHUB_WORKSPACE/.bin/buildctl" --version
+
+      - name: buildkitd reachable
+        run: buildctl debug workers
+
+      # A master push VALIDATES that the Dockerfile still builds on both arches
+      # but publishes nothing; only an explicit dispatch names a tag and pushes.
+      # Guessing a tag from a branch push would silently mint versions.
+      #
+      # Tags are immutable (zegit#262): consumers pin tag@digest, and the
+      # registry drops the old manifest when a tag moves, so re-publishing a
+      # tag breaks every pin on it. A build refuses an existing tag; sign_only
+      # refuses a tag that does not exist.
+      - id: meta
+        env:
+          EVENT: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          SIGN_ONLY: ${{ inputs.sign_only }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT" = "workflow_dispatch" ]; then
+            pull=$(curl -fsS "https://${REGISTRY}/v2/token?scope=repository:${IMAGE_PATH}:pull&service=container_registry" | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')
+            tags=$(curl -fsS -H "Authorization: Bearer ${pull}" "https://${REGISTRY}/v2/${IMAGE_PATH}/tags/list?n=10000" | python3 -c 'import json,sys; print("\n".join(json.load(sys.stdin).get("tags") or []))')
+            if printf '%s\n' "$tags" | grep -qxF "$INPUT_TAG"; then
+              if [ "$SIGN_ONLY" != "true" ]; then
+                echo "::error::${IMAGE_PATH}:${INPUT_TAG} already exists; tags are immutable, so nothing is overwritten (to sign it, dispatch with sign_only)"; exit 1
+              fi
+            elif [ "$SIGN_ONLY" = "true" ]; then
+              echo "::error::${IMAGE_PATH}:${INPUT_TAG} is not published; nothing to sign"; exit 1
+            fi
+            echo "push=true"  >> "$GITHUB_OUTPUT"
+            echo "tag=${INPUT_TAG}" >> "$GITHUB_OUTPUT"
+            echo "sign_only=${SIGN_ONLY}" >> "$GITHUB_OUTPUT"
+          else
+            echo "push=false" >> "$GITHUB_OUTPUT"
+            echo "tag=ci-validation" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Refuse a publish that cannot complete, rather than reporting success
+      # having pushed nothing. A validation run needs no credentials.
+      # The Gitea Actions token cannot write packages; this needs an explicit
+      # package-write PAT (read:package is pull-only).
+      - name: Registry login
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        env:
+          TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${TOKEN:-}" ]; then
+            echo "::error::ZEGIT_CI_PACKAGE_TOKEN is not visible to this run. It is the org-scoped package-write token every zegit-zoo image workflow uses (docs: flux-config docs/rotation/forge-secrets.yaml); this repository must be able to read the org secret, and the name must match."
+            exit 1
+          fi
+          mkdir -p "$HOME/.docker"
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' \
+            "$REGISTRY" "$(printf 'zegit-zoo:%s' "$TOKEN" | base64 -w0)" \
+            > "$HOME/.docker/config.json"
+
+      - name: Build multi-arch
+        if: ${{ steps.meta.outputs.sign_only != 'true' }}
+        run: |
+          set -euo pipefail
+          REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          # No --output on a validation run: buildctl v0.32 has no "cacheonly"
+          # exporter (run 16, 2026-09-08: 'exporter "cacheonly" could not be
+          # found'), so every push-triggered validation since this workflow
+          # was added had failed — silently, since nothing depended on it. A
+          # build without an exporter still builds every stage on both arches.
+          if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
+            buildctl build --progress=plain \
+              --frontend dockerfile.v0 \
+              --local context=. \
+              --local dockerfile=. \
+              --opt platform=linux/amd64,linux/arm64 \
+              --output "type=image,name=${REF},push=true"
+          else
+            buildctl build --progress=plain \
+              --frontend dockerfile.v0 \
+              --local context=. \
+              --local dockerfile=. \
+              --opt platform=linux/amd64,linux/arm64
+          fi
+
+      # The image is a TOOLCHAIN, so "it built" is not the property that matters
+      # — "it still contains what the gates shell out to" is. build-image.yml
+      # asserts that with `docker run`, which does not exist on these runners;
+      # buildkit can do it directly by building a stage FROM the published image
+      # whose RUN fails when a tool is absent. That is strictly better: buildkit
+      # runs it natively per platform, so a package that resolves on amd64 but
+      # not on arm64 cannot reach half the nodes unnoticed.
+      #
+      # openssl and jq are on this list because their absence blocked v0.0.134
+      # and v0.0.135: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and a missing tool was reported
+      # as "verdict not signed" and "signature FAILED verification" — a tooling
+      # gap narrated as a security verdict. Extend this list whenever a gate
+      # grows a shell dependency; it only covers what someone remembered to add.
+      - name: Assert the published image carries the toolchain the gates need
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        run: |
+          set -euo pipefail
+          REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          work=$(mktemp -d)
+          {
+            echo "FROM ${REF}"
+            echo 'RUN set -eu; \'
+            echo '    python3 -c "import yaml, sys; print(\"python3+yaml\", sys.version.split()[0])"; \'
+            echo '    for t in gcc node bash make curl tar openssl jq chromium-browser psql; do \'
+            echo '      command -v "$t" >/dev/null || { echo "MISSING: $t" >&2; exit 1; }; \'
+            echo '      echo "ok: $t"; \'
+            echo '    done; \'
+            echo '    test -x "$(git --exec-path)/git-http-backend" || { echo "MISSING: git-http-backend" >&2; exit 1; }; \'
+            echo '    echo "ok: git-http-backend"'
+          } > "$work/Dockerfile"
+          cat "$work/Dockerfile"
+          buildctl build --progress=plain \
+            --frontend dockerfile.v0 \
+            --local context="$work" \
+            --local dockerfile="$work" \
+            --opt platform=linux/amd64,linux/arm64
+          echo "✓ toolchain intact on linux/amd64 and linux/arm64"
+
+      # zegit#143/#262: a -ci<N> tag is only a name, and ZEGIT_CI_PACKAGE_TOKEN
+      # (readable by every zegit-zoo branch run) can push one. Consumers pin
+      # this image only when `cosign verify` accepts its digest with the
+      # runner-image public key, so every published digest is signed here.
+      # The private key is a REPOSITORY secret of the runner repos only, never
+      # an org secret. Classic .sig tag, no transparency log: the registry is
+      # private and verifiers use --insecure-ignore-tlog with a pinned key.
+      - name: Sign the published image by digest
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        env:
+          COSIGN_KEY_PEM: ${{ secrets.RUNNER_IMAGE_COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.RUNNER_IMAGE_COSIGN_PASSWORD }}
+          TOKEN: ${{ secrets.ZEGIT_CI_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${COSIGN_KEY_PEM:-}" ] || [ -z "${COSIGN_PASSWORD:-}" ]; then
+            echo "::error::RUNNER_IMAGE_COSIGN_KEY / RUNNER_IMAGE_COSIGN_PASSWORD are not visible to this run (repository secrets, zegit#262). An unsigned runner image is never pinned."
+            exit 1
+          fi
+          case "$(uname -m)" in
+            x86_64) arch=amd64; sum=4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71;;
+            aarch64) arch=arm64; sum=c5d324e091826b0d7a78eb16fef316450b4eb9aaec045611c08ba06f5e73220a;;
+            *) echo "::error::unsupported arch $(uname -m)"; exit 1;;
+          esac
+          bin="$GITHUB_WORKSPACE/.bin/cosign"
+          curl -fsSL -o "$bin" "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${arch}"
+          echo "${sum}  ${bin}" | sha256sum -c -
+          chmod +x "$bin"
+          tag="${{ steps.meta.outputs.tag }}"
+          tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
+          # Credentials go through 0600 curl configs, never argv (zegit#139).
+          ( umask 077; printf 'user = "zegit-zoo:%s"\n' "$TOKEN" > "$tmp/basic.cfg" )
+          tok=$(curl -fsS -K "$tmp/basic.cfg" "https://${REGISTRY}/v2/token?scope=repository:${IMAGE_PATH}:pull&service=container_registry" |
+            python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')
+          ( umask 077; printf 'header = "Authorization: Bearer %s"\n' "$tok" > "$tmp/bearer.cfg" )
+          digest=$(curl -fsS -I -K "$tmp/bearer.cfg" \
+            -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
+            "https://${REGISTRY}/v2/${IMAGE_PATH}/manifests/${tag}" | tr -d '\r' |
+            awk -F': ' 'tolower($1)=="docker-content-digest"{print $2}')
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]] || { echo "::error::no digest for ${IMAGE_PATH}:${tag}"; exit 1; }
+          ref="${REGISTRY}/${IMAGE_PATH}@${digest}"
+          printf '%s\n' "$COSIGN_KEY_PEM" > "$tmp/cosign.key"; chmod 600 "$tmp/cosign.key"
+          "$bin" sign --yes --key "$tmp/cosign.key" --tlog-upload=false \
+            --new-bundle-format=false --use-signing-config=false "$ref"
+          "$bin" public-key --key "$tmp/cosign.key" > "$tmp/cosign.pub"
+          "$bin" verify --key "$tmp/cosign.pub" --insecure-ignore-tlog "${REGISTRY}/${IMAGE_PATH}:${tag}@${digest}" >/dev/null
+          echo "✓ signed and verified ${REGISTRY}/${IMAGE_PATH}:${tag}@${digest}"
+
+      - name: Summary
+        run: |
+          if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
+            echo "published ${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }} (amd64+arm64), toolchain asserted on both"
+          else
+            echo "validation only — the Dockerfile builds on both arches; nothing published"
+          fi

.github/workflows/build-image.yml

@@ -0,0 +1,168 @@
+name: build image
+
+# Publishes the runner toolchain image to ghcr.io.
+#
+# Why GitHub rather than our own Gitea Actions: the runners are host mode
+# (`ubuntu-latest:host`, no job containers) and their container drops ALL
+# capabilities with allowPrivilegeEscalation:false. Rootless buildah needs
+# newuidmap/user namespaces for its RUN steps, so building images there would
+# mean weakening the posture that hardening established. GitHub runners have
+# docker + buildx + QEMU already.
+#
+# Why ghcr.io rather than the Gitea registry: gitea.langenoja.se sits behind
+# Cloudflare, whose request-body cap returns 413 on a registry layer. The
+# cluster already pulls zegit's own images from ghcr.io and the runner
+# deployments already carry a github-registry-credentials pull secret, so this
+# reuses an established, trusted path instead of inventing one.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag, e.g. 12.11.1-ci4 (upstream runner version + ci revision)'
+        required: true
+        type: string
+  push:
+    branches: [master]
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/build-image.yml'
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  IMAGE: ghcr.io/${{ github.repository }}
+
+jobs:
+  build:
+    # GitHub-only: the Gitea mirror has no ghcr.io and no GITHUB_TOKEN.
+    if: ${{ github.server_url == 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      # arm64 is not optional: forgejo-runner runs on arm64 nodes and
+      # zegit-runner on amd64, neither deployment sets a nodeSelector, and both
+      # use this one tag.
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # A master push VALIDATES the Dockerfile still builds on both arches but
+      # publishes nothing — only an explicit dispatch names a tag and pushes.
+      # Guessing a tag from a branch push would silently mint versions.
+      - id: meta
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "push=true" >> "$GITHUB_OUTPUT"
+            echo "tags=${IMAGE}:${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "push=false" >> "$GITHUB_OUTPUT"
+            echo "tags=${IMAGE}:ci-validation" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ steps.meta.outputs.push }}
+          tags: ${{ steps.meta.outputs.tags }}
+          provenance: false
+          sbom: false
+
+      # Read the published index back rather than trusting the push's exit
+      # code, and fail if either architecture is absent — a single-arch image
+      # under this tag would CrashLoop on half the nodes.
+      - name: Verify both architectures were published
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        run: |
+          set -euo pipefail
+          out=$(docker buildx imagetools inspect "${IMAGE}:${{ inputs.tag }}")
+          echo "$out"
+          for want in amd64 arm64; do
+            echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
+          done
+          echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
+
+      # The image is a TOOLCHAIN, so "it built" is not the property that matters
+      # — "it still contains what the gates shell out to" is. This exists because
+      # a hand-built image had drifted from this Dockerfile: the deployed ci3
+      # carried gcc, musl-dev, python3 and py3-yaml, the Dockerfile did not, and
+      # rebuilding from the Dockerfile silently dropped them. CI runs then failed
+      # at "credentials-coverage: need python3" instead of running the tests.
+      #
+      # Asserted on BOTH architectures, because a package that resolves on amd64
+      # and not on arm64 would otherwise reach half the nodes unnoticed.
+      #
+      # openssl and jq were added after this check already existed and still
+      # missed them: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and their absence surfaced as
+      # "verdict not signed" / "signature FAILED verification" rather than as a
+      # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
+      # someone remembered to add, so add to it whenever a gate grows a new
+      # shell dependency.
+      #
+      # DERIVED once, 2026-08-31, rather than remembered: every command invoked
+      # from a `run:` block across zegit's Gitea-executed workflows and its
+      # composite actions was extracted and checked against this list. Result:
+      # no missing apk package. Everything resolved to one of three sources —
+      # baked in here; provided by busybox/coreutils; or downloaded per-run and
+      # immediately version-checked (go via setup-go, buildctl, flux, cosign,
+      # syft, goreleaser). The download path needs nothing from this image
+      # beyond curl and tar, both already asserted.
+      #
+      # What the audit DID find is that the busybox/coreutils layer was entirely
+      # unasserted, so dropping `coreutils` from the apk line above would pass
+      # this check while base64, mktemp, seq and sort silently vanished — and by
+      # the history above, their absence would be narrated as whatever the gate
+      # using them happened to be doing. They are asserted below now. They are
+      # cheap to check and the failure they prevent is expensive to read.
+      - name: Verify the image still contains the toolchain the gates need
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        run: |
+          set -euo pipefail
+          REF="${IMAGE}:${{ inputs.tag }}"
+          fail=0
+          for plat in linux/amd64 linux/arm64; do
+            echo "── $plat"
+            out=$(docker run --rm --platform "$plat" --entrypoint sh "$REF" -c '
+              set -u
+              py=$(python3 -c "import yaml,sys;print(sys.version.split()[0])" 2>/dev/null) \
+                && echo "python3+yaml=$py" || echo "python3+yaml=MISSING"
+              command -v gcc      >/dev/null && echo "gcc=ok"      || echo "gcc=MISSING"
+              command -v node     >/dev/null && echo "node=ok"     || echo "node=MISSING"
+              command -v bash     >/dev/null && echo "bash=ok"     || echo "bash=MISSING"
+              command -v make     >/dev/null && echo "make=ok"     || echo "make=MISSING"
+              command -v curl     >/dev/null && echo "curl=ok"     || echo "curl=MISSING"
+              command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
+              command -v openssl  >/dev/null && echo "openssl=ok"  || echo "openssl=MISSING"
+              command -v jq       >/dev/null && echo "jq=ok"       || echo "jq=MISSING"
+              # busybox/coreutils layer: used across zegit's gates for base64
+              # decoding of DSSE payloads, temp dirs, poll loops and sorting.
+              for t in base64 mktemp seq sort sed grep cut head wc uname date; do
+                command -v "$t" >/dev/null && echo "$t=ok" || echo "$t=MISSING"
+              done
+              [ -x "$(git --exec-path)/git-http-backend" ] \
+                && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
+            ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }
+            echo "$out"
+            if echo "$out" | grep -q MISSING; then
+              echo "$out" | grep MISSING | while read -r l; do
+                echo "::error::$plat is missing a required tool: $l"
+              done
+              fail=1
+            fi
+          done
+          [ "$fail" = 0 ] || {
+            echo "::error::The published image lost a tool the repo's gates depend on. Restore it in the Dockerfile — do not weaken this check."
+            exit 1
+          }
+          echo "✓ toolchain intact on both architectures"

Dockerfile

@@ -6,38 +6,92 @@
 # The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
 # runtime -- the tools must be baked in here.
 #
-# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
+# PUBLISHING IS AUTOMATED. Run the "build image" workflow on GitHub with a tag
+# (e.g. 12.11.1-ci4); it builds both architectures and pushes to
+# ghcr.io/zegit-zoo/zegit-forgejo-runner. ./push-image.sh remains for building
+# by hand. README.md explains why the registry moved off Gitea (Cloudflare's
+# request-body cap returns 413 on a registry layer) and why the build cannot run
+# on our own runners (host mode, all capabilities dropped).
 #
-#   docker buildx create --use --name zegit-ci 2>/dev/null || true
-#   docker login gitea.langenoja.se        # username + a Gitea personal access token
-#   docker buildx build --platform linux/amd64,linux/arm64 \
-#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
+# Then in flux-config set the image on BOTH deployment-zegit-runner and
+# deployment-forgejo-runner, digest-pinned.
 #
-# Then in flux-config set both containers' image: to the tag above and commit.
-# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
+# The image is NOT public. Pulls need a registry credential in
+# forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
+# version of this comment claimed the package was public and needed no secret;
+# that was wrong for the Gitea registry too, which is private.
 FROM code.forgejo.org/forgejo/runner:12.11.1
 
 USER root
 
 # nodejs   -> JS actions runtime (actions/checkout, actions/setup-go, ...)
 # git      -> checkout
+# git-daemon -> provides git-http-backend, which Alpine splits OUT of the `git`
+#             package (git alone ships git-remote-http/https but NOT the CGI
+#             backend). Without it, internal/forgeprobe's smart-HTTP tests died
+#             with "fork/exec git-http-backend: no such file or directory" and
+#             reported three FAILURES for a missing tool — which turned Gitea CI
+#             red on every zegit master commit while GitHub stayed green, for
+#             hours, unnoticed.
 # bash     -> `shell: bash` steps and many action entrypoints
 # coreutils-> GNU userland (alpine busybox tools trip up some scripts)
 # curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
 # make     -> zegit Makefile targets
 # ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
+# openssl  -> the release tag gate verifies the Control Plane's SIGNED quorum
+#             verdict (Ed25519 DSSE) with `openssl pkeyutl -verify -rawin`.
+#             Absent, that command failed "command not found" and the gate's
+#             `|| { echo ...; exit 1; }` reported it as "Quorum verdict
+#             signature FAILED verification" -- a TOOLING gap narrated as a
+#             SECURITY verdict, pointing the investigation at a perfectly
+#             valid signed approval instead of at this image. It blocked
+#             v0.0.134 and v0.0.135 on 2026-08-31.
+# jq       -> the same story one step earlier: the gate parsed that envelope
+#             with `jq -e`, and a missing jq was reported as "not a signed
+#             DSSE envelope". jq is the reflex tool for JSON in shell steps,
+#             so its absence keeps resurfacing as a misleading failure in
+#             whichever step reaches for it next.
+# gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test
+#             target) requires cgo, which needs a C compiler + libc headers
+#             (musl on Alpine)
+# python3,py3-yaml -> the repo's own gates are Python: credentials-coverage.sh,
+#             validate-admission.sh and feature-lint.sh all shell out to
+#             python3, and credentials-coverage parses manifests with yaml
+#
+# chromium, font-noto -> the browser gates (2026-09-08): zegit's `browser
+#             tests` (chromedp + a CDP virtual authenticator over the WebAuthn
+#             ceremony pages) and `lighthouse` (treosh/lighthouse-ci-action
+#             via chrome-launcher) were github.com-only jobs, so when `ci`
+#             was routed to this runner on 2026-08-31 they stopped running
+#             anywhere. chromedp finds `chromium`/`chromium-browser` on PATH;
+#             chrome-launcher honours CHROME_PATH. font-noto so text renders
+#             (an empty font set makes layout/contrast audits meaningless).
+# postgresql-client -> `psql`, so the lighthouse job can CREATE/DROP its own
+#             database on the runner's ci-postgres (ZEGIT_TESTPG_DSN) instead
+#             of migrating the shared maintenance database from under the
+#             integration suite's template.
 #
 # Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
 # per-run (node + tar are present), so the image needs no rebuild on Go bumps.
 RUN apk add --no-cache \
       nodejs \
       git \
+      git-daemon \
       bash \
       coreutils \
       curl \
       tar \
       make \
-      ca-certificates
+      ca-certificates \
+      gcc \
+      musl-dev \
+      python3 \
+      py3-yaml \
+      openssl \
+      jq \
+      chromium \
+      font-noto \
+      postgresql-client
 
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000

README.md

@@ -37,3 +37,60 @@ reconciles). Do this only *after* the image exists, or the pod ImagePullBackOffs
 
 `<base-runner-version>-ci` (e.g. `12.11.1-ci`). Must satisfy the cluster's
 Gatekeeper `enforce-semantic-image-tags` constraint — never `:latest`.
+
+## Publishing a new image
+
+    ./push-image.sh 12.11.1-ci4
+
+The registry hostname in the image reference must stay `gitea.langenoja.se`,
+because that is what the cluster pulls. The script therefore keeps the NAME and
+changes only the ROUTE: it pins that hostname to the Istio gateway on the LAN
+(`10.40.0.10`) for the duration of the push, then removes the pin.
+
+That matters because `gitea.langenoja.se` resolves to Cloudflare, which caps
+request bodies below a registry layer and returns **413 Payload Too Large**. The
+gateway serves a `*.langenoja.se` wildcard cert, so TLS still validates normally
+— no `insecure-registries`, no `--tls-verify=false`.
+
+If a run is killed before it can clean up, the pin is left behind. It carries a
+marker comment, so the next run recognises it as its own and removes it — or you
+can clear it directly:
+
+    ./push-image.sh --unpin
+
+A pin you added yourself (no marker) is never touched, and the script refuses to
+run if an unmarked pin points somewhere other than the gateway.
+
+Requirements: a Gitea PAT with **`write:package`** (`read:package` is pull-only),
+LAN reachability of the gateway, and qemu/binfmt registered for the arm64 build.
+
+Multi-arch is not optional. `forgejo-runner` runs on arm64 nodes and
+`zegit-runner` on amd64, neither deployment sets a `nodeSelector`, and both use
+this single tag.
+
+Two traps the script exists to prevent: pushing to the bare MagicDNS name
+(`gitea-system-gitea-tailscale-http`) makes Docker treat it as a **Docker Hub
+namespace**, since a registry host is only recognised when it contains a dot or
+colon; and `docker push $_` pushes `.`, because `$_` is the last ARGUMENT of the
+build command, not its tag.
+
+### Automated builds
+
+`.github/workflows/build-image.yml` builds and publishes to
+**ghcr.io/zegit-zoo/zegit-forgejo-runner** on GitHub.
+
+Run it from the Actions tab (**build image** → Run workflow) with the tag, e.g.
+`12.11.1-ci4`. A push to `master` that touches the Dockerfile only VALIDATES
+that both architectures still build — it publishes nothing, because guessing a
+tag from a branch push would silently mint versions.
+
+It builds on GitHub rather than our own Gitea Actions because the runners are
+host mode (`ubuntu-latest:host`, no job containers) and drop ALL capabilities
+with `allowPrivilegeEscalation: false`; rootless buildah needs user namespaces
+for its RUN steps, so building there would mean weakening that posture. It
+publishes to ghcr.io rather than the Gitea registry because
+`gitea.langenoja.se` sits behind Cloudflare, whose body cap returns **413** on a
+registry layer — and the cluster already pulls zegit's own images from ghcr.io
+with an existing `github-registry-credentials` pull secret.
+
+`push-image.sh` remains for building by hand when you need it.

push-image.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+# push-image.sh — build and publish the runner toolchain image, multi-arch.
+#
+# Why this script exists: doing it by hand hit four obstacles in a row.
+#
+#   1. 413 Payload Too Large. gitea.langenoja.se is behind Cloudflare, which
+#      caps request bodies well below a registry layer. Fixed by pinning the
+#      hostname to the Istio gateway on the LAN (below) so the push never
+#      traverses Cloudflare.
+#   2. Docker only treats a name as a registry HOST if it contains a dot or a
+#      colon. Pushing to the bare MagicDNS name `gitea-system-gitea-tailscale-http`
+#      was parsed as a Docker Hub NAMESPACE, so Docker Hub refused the auth.
+#   3. The Gitea PAT needs `write:package`. `read:package` is pull-only.
+#   4. Multi-arch is required: forgejo-runner runs on arm64 nodes and
+#      zegit-runner on amd64, neither deployment sets a nodeSelector, and both
+#      use this one tag.
+#
+# The hostname MUST stay gitea.langenoja.se in the image reference, because that
+# is what the cluster pulls. So we keep the name and change only the ROUTE, via
+# an /etc/hosts pin that is removed again on exit.
+#
+# The Istio gateway serves a *.langenoja.se wildcard cert, so TLS validates
+# normally — no insecure-registries, no --tls-verify=false.
+set -euo pipefail
+
+TAG="${1:-}"
+GATEWAY_IP="${GATEWAY_IP:-10.40.0.10}"
+REGISTRY="gitea.langenoja.se"
+REPO="$REGISTRY/zegit-zoo/zegit-forgejo-runner"
+MARKER="# added by push-image.sh"
+HOSTS_LINE="$GATEWAY_IP  $REGISTRY  $MARKER"
+
+die() { echo "error: $*" >&2; exit 1; }
+
+if [ "$TAG" = "--unpin" ]; then
+  MARKER="# added by push-image.sh"
+  if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
+    sudo sed -i "\|${MARKER}\$|d" /etc/hosts; echo "removed the leftover pin"
+  else
+    echo "no pin of ours in /etc/hosts; nothing to do"
+  fi
+  exit 0
+fi
+[ -n "$TAG" ] || die "usage: $0 <tag> | --unpin   (e.g. $0 12.11.1-ci4)"
+command -v docker >/dev/null || die "docker not on PATH"
+
+# Three cases, and they must not be confused:
+#   OURS      — a line carrying our marker. A LEFTOVER from a run that died
+#               before its trap fired. Reuse it, and DO remove it on exit.
+#   THEIRS    — a line without our marker. Deliberate; never touch it, and
+#               refuse if it points somewhere other than the gateway.
+#   ABSENT    — add ours.
+# The earlier version could not tell OURS from THEIRS, so a leftover pin was
+# treated as deliberate and survived every subsequent run. That is the bug that
+# made an operator revert /etc/hosts by hand.
+PIN_OWNED=0
+if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
+  PIN_OWNED=1
+  echo "found a leftover pin from an interrupted run; reusing and will clean it up"
+elif grep -qE "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts 2>/dev/null; then
+  existing=$(grep -E "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts | head -1)
+  [ "$(echo "$existing" | awk '{print $1}')" = "$GATEWAY_IP" ] \
+    || die "/etc/hosts already pins $REGISTRY elsewhere (not ours, not the gateway): $existing"
+  echo "an unmarked pin to the gateway already exists; leaving it exactly as found"
+fi
+
+# Removes ONLY lines carrying our marker, so a deliberate pin is never touched.
+unpin() {
+  if grep -qF "$MARKER" /etc/hosts 2>/dev/null; then
+    sudo sed -i "\|${MARKER}\$|d" /etc/hosts
+    echo "removed the /etc/hosts pin"
+  fi
+}
+cleanup() { [ "$PIN_OWNED" = "1" ] && unpin; }
+# INT and TERM too: EXIT alone leaves the pin behind on Ctrl-C in some shells.
+trap cleanup EXIT INT TERM
+
+if [ "$PIN_OWNED" = "0" ] && ! grep -qE "^[^#]*[[:space:]]$REGISTRY([[:space:]]|\$)" /etc/hosts 2>/dev/null; then
+  echo "pinning $REGISTRY -> $GATEWAY_IP (bypasses Cloudflare; removed on exit)"
+  echo "$HOSTS_LINE" | sudo tee -a /etc/hosts >/dev/null
+  PIN_OWNED=1
+fi
+
+# Prove the route before building anything: 401 means the registry answered and
+# wants auth, which is success here. A timeout means the pin or the LAN is wrong.
+code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 "https://$REGISTRY/v2/" || true)
+case "$code" in
+  401|200) echo "registry reachable via the pin (HTTP $code)" ;;
+  *) die "registry not reachable via $GATEWAY_IP (HTTP ${code:-timeout}). Is this host on the LAN?" ;;
+esac
+
+docker login "$REGISTRY" || die "login failed — the PAT needs write:package, not read:package"
+
+for arch in amd64 arm64; do
+  echo "building linux/$arch"
+  docker build --platform "linux/$arch" -t "$REPO:$TAG-$arch" . \
+    || die "build failed for $arch (arm64 needs qemu/binfmt registered)"
+  # Explicit tag, never $_ — in zsh $_ is the last ARGUMENT, which here is '.'
+  docker push "$REPO:$TAG-$arch" || die "push failed for $arch"
+done
+
+# `docker manifest create` REFUSES a source that is itself a manifest list:
+#   ERROR: gitea.langenoja.se/...:<tag>-amd64 is a manifest list
+# With Docker's containerd image store, `docker build --platform linux/amd64`
+# produces an OCI index rather than a plain manifest, so both per-arch tags are
+# lists and the combine step fails after the (slow, large) pushes have already
+# succeeded — leaving the per-arch tags published and the plain tag absent,
+# which is the one the Deployments reference. Seen on 12.11.1-ci6, 2026-08-31.
+#
+# `buildx imagetools create` accepts indexes as sources and does the combine
+# registry-side, so it works with either image store.
+docker buildx imagetools create -t "$REPO:$TAG" "$REPO:$TAG-amd64" "$REPO:$TAG-arm64" \
+  || die "failed to combine the per-arch tags into $REPO:$TAG"
+
+# Verify by reading it back, rather than trusting the push's exit code.
+echo "verifying the published manifest lists both architectures"
+inspect=$(docker buildx imagetools inspect "$REPO:$TAG") \
+  || die "published $REPO:$TAG cannot be read back"
+got=$(echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u | grep -cE 'linux/(amd64|arm64)')
+[ "$got" -ge 2 ] || die "published manifest does not list both architectures:
+$inspect"
+echo "$inspect" | grep -o 'linux/[a-z0-9]*' | sort -u
+
+cat <<EOF
+
+published $REPO:$TAG
+
+Next, in flux-config, bump BOTH deployments that use this image:
+  applications/forgejo-runner/base/deployment-zegit-runner.yaml
+  applications/forgejo-runner/base/deployment-forgejo-runner.yaml
+(markus-runner uses markus/gitea-runner and is unaffected.)
+EOF