fix: restore gcc, musl-dev, python3 and py3-yaml to the image

REGRESSION, mine. The committed Dockerfile had drifted from the image actually
in service: the running ci3 image contained these four packages, the Dockerfile
did not, and I rebuilt ci4 from the Dockerfile. The rollout therefore removed
tools zegit's CI depends on.

Proof the deployed ci3 had them: its Gitea runs got PAST `make credentials-check`
— which shells out to python3 — and failed later at cover-check. The ci4 run
fails earlier, at `credentials-coverage: need python3`.

What each is for, so the next rebuild does not drop them again:
  python3, py3-yaml  the repo's own gates are Python — credentials-coverage.sh,
                     validate-admission.sh and feature-lint.sh all shell out to
                     it, and credentials-coverage parses manifests with yaml
  gcc, musl-dev      cgo, which `go test -race` in the Makefile test target
                     requires: a C compiler plus libc headers (musl on Alpine)

Verified on the real base image rather than assumed — on
code.forgejo.org/forgejo/runner:12.11.1, `apk add git git-daemon gcc musl-dev
python3 py3-yaml` yields Python 3.12.14, a working `import yaml`, gcc 15.2.0,
and git-http-backend on the git exec path.

The deeper lesson is that a hand-built image can drift from its Dockerfile
silently, and nothing notices until someone rebuilds. Publishing via CI (#2)
is what stops that recurring, since every future image comes from the
committed file.

.github/workflows/build-image.yml

@@ -91,47 +91,3 @@ jobs:
             echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
           done
           echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
-
-      # The image is a TOOLCHAIN, so "it built" is not the property that matters
-      # — "it still contains what the gates shell out to" is. This exists because
-      # a hand-built image had drifted from this Dockerfile: the deployed ci3
-      # carried gcc, musl-dev, python3 and py3-yaml, the Dockerfile did not, and
-      # rebuilding from the Dockerfile silently dropped them. CI runs then failed
-      # at "credentials-coverage: need python3" instead of running the tests.
-      #
-      # Asserted on BOTH architectures, because a package that resolves on amd64
-      # and not on arm64 would otherwise reach half the nodes unnoticed.
-      - name: Verify the image still contains the toolchain the gates need
-        if: ${{ steps.meta.outputs.push == 'true' }}
-        run: |
-          set -euo pipefail
-          REF="${IMAGE}:${{ inputs.tag }}"
-          fail=0
-          for plat in linux/amd64 linux/arm64; do
-            echo "── $plat"
-            out=$(docker run --rm --platform "$plat" --entrypoint sh "$REF" -c '
-              set -u
-              py=$(python3 -c "import yaml,sys;print(sys.version.split()[0])" 2>/dev/null) \
-                && echo "python3+yaml=$py" || echo "python3+yaml=MISSING"
-              command -v gcc      >/dev/null && echo "gcc=ok"      || echo "gcc=MISSING"
-              command -v node     >/dev/null && echo "node=ok"     || echo "node=MISSING"
-              command -v bash     >/dev/null && echo "bash=ok"     || echo "bash=MISSING"
-              command -v make     >/dev/null && echo "make=ok"     || echo "make=MISSING"
-              command -v curl     >/dev/null && echo "curl=ok"     || echo "curl=MISSING"
-              command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
-              [ -x "$(git --exec-path)/git-http-backend" ] \
-                && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
-            ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }
-            echo "$out"
-            if echo "$out" | grep -q MISSING; then
-              echo "$out" | grep MISSING | while read -r l; do
-                echo "::error::$plat is missing a required tool: $l"
-              done
-              fail=1
-            fi
-          done
-          [ "$fail" = 0 ] || {
-            echo "::error::The published image lost a tool the repo's gates depend on. Restore it in the Dockerfile — do not weaken this check."
-            exit 1
-          }
-          echo "✓ toolchain intact on both architectures"

Dockerfile

@@ -6,20 +6,15 @@
 # The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
 # runtime -- the tools must be baked in here.
 #
-# PUBLISHING IS AUTOMATED. Run the "build image" workflow on GitHub with a tag
-# (e.g. 12.11.1-ci4); it builds both architectures and pushes to
-# ghcr.io/zegit-zoo/zegit-forgejo-runner. ./push-image.sh remains for building
-# by hand. README.md explains why the registry moved off Gitea (Cloudflare's
-# request-body cap returns 413 on a registry layer) and why the build cannot run
-# on our own runners (host mode, all capabilities dropped).
+# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
 #
-# Then in flux-config set the image on BOTH deployment-zegit-runner and
-# deployment-forgejo-runner, digest-pinned.
+#   docker buildx create --use --name zegit-ci 2>/dev/null || true
+#   docker login gitea.langenoja.se        # username + a Gitea personal access token
+#   docker buildx build --platform linux/amd64,linux/arm64 \
+#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
 #
-# The image is NOT public. Pulls need a registry credential in
-# forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
-# version of this comment claimed the package was public and needed no secret;
-# that was wrong for the Gitea registry too, which is private.
+# Then in flux-config set both containers' image: to the tag above and commit.
+# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
 FROM code.forgejo.org/forgejo/runner:12.11.1
 
 USER root
@@ -38,6 +33,12 @@ USER root
 # curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
 # make     -> zegit Makefile targets
 # ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
+# gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test
+#             target) requires cgo, which needs a C compiler + libc headers
+#             (musl on Alpine)
+# python3,py3-yaml -> the repo's own gates are Python: credentials-coverage.sh,
+#             validate-admission.sh and feature-lint.sh all shell out to
+#             python3, and credentials-coverage parses manifests with yaml
 #
 # Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
 # per-run (node + tar are present), so the image needs no rebuild on Go bumps.
@@ -50,7 +51,11 @@ RUN apk add --no-cache \
       curl \
       tar \
       make \
-      ca-certificates
+      ca-certificates \
+      gcc \
+      musl-dev \
+      python3 \
+      py3-yaml
 
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000