probe: stop filtering away the RUN output

The probe kept succeeding while its results vanished: the grep -vE plus tail -40
dropped the buildkit progress lines that carry the actual curl output. Keep the
full log, then print only the RUN lines with their #N prefix stripped.

.github/workflows/build-image-gitea.yml

@@ -0,0 +1,167 @@
+name: build image (gitea)
+
+# Publishes the runner toolchain image from the SELF-HOSTED Gitea runners, via
+# the in-cluster rootless buildkitd — the same path zegit's own images already
+# use (zegit .github/workflows/image-gitea.yml).
+#
+# Why this exists alongside build-image.yml: that workflow is GitHub-only, so
+# the image the Gitea runners are BUILT FROM could only be produced by GitHub.
+# When GitHub Actions became unavailable on 2026-08-29 that circularity bit —
+# the fix for a missing tool in this very image (openssl/jq, whose absence
+# blocked v0.0.134 and v0.0.135) could not be published on the forge the project
+# is moving to. This removes the dependency.
+#
+# build-image.yml's header says the runners cannot build images because rootless
+# buildah needs user namespaces the pod does not have. That is true of buildah
+# IN THE JOB, and irrelevant here: buildkitd is its own hardened workload in
+# buildkit-system, and this job only speaks to it over the network with
+# buildctl. Nothing is built inside the runner container.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag, e.g. 12.11.1-ci6 (upstream runner version + ci revision)'
+        required: true
+        type: string
+  push:
+    branches: [master]
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/build-image-gitea.yml'
+
+env:
+  BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
+  BUILDKIT_VERSION: v0.32.2
+  REGISTRY: gitea.langenoja.se
+  IMAGE_PATH: zegit-zoo/zegit-forgejo-runner
+
+jobs:
+  build:
+    # Gitea-only: buildkitd is an in-cluster service that GitHub runners cannot
+    # reach. build-image.yml still covers the GitHub/ghcr.io side.
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      # Workspace-local because the runner is non-root and cannot write to
+      # /usr/local/bin. The smoke test uses the FULL PATH deliberately:
+      # $GITHUB_PATH only takes effect for SUBSEQUENT steps, so a bare
+      # `buildctl --version` here would be command-not-found.
+      - name: Install buildctl
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in
+            x86_64) arch=amd64;;
+            aarch64) arch=arm64;;
+            *) echo "::error::unsupported arch $(uname -m)"; exit 1;;
+          esac
+          mkdir -p "$GITHUB_WORKSPACE/.bin"
+          curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+            | tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
+          echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
+          "$GITHUB_WORKSPACE/.bin/buildctl" --version
+
+      - name: buildkitd reachable
+        run: buildctl debug workers
+
+      # A master push VALIDATES that the Dockerfile still builds on both arches
+      # but publishes nothing; only an explicit dispatch names a tag and pushes.
+      # Guessing a tag from a branch push would silently mint versions.
+      - id: meta
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "push=true"  >> "$GITHUB_OUTPUT"
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "push=false" >> "$GITHUB_OUTPUT"
+            echo "tag=ci-validation" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Refuse a publish that cannot complete, rather than reporting success
+      # having pushed nothing. A validation run needs no credentials.
+      # The Gitea Actions token cannot write packages; this needs an explicit
+      # package-write PAT (read:package is pull-only).
+      - name: Registry login
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        env:
+          TOKEN: ${{ secrets.ZEGIT_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${TOKEN:-}" ]; then
+            echo "::error::ZEGIT_PACKAGE_TOKEN is not set, so this dispatch would build an image and push nothing. Issue a package-write token and store it as this secret."
+            exit 1
+          fi
+          mkdir -p "$HOME/.docker"
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' \
+            "$REGISTRY" "$(printf 'zegit-zoo:%s' "$TOKEN" | base64 -w0)" \
+            > "$HOME/.docker/config.json"
+
+      - name: Build multi-arch
+        run: |
+          set -euo pipefail
+          REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
+            out="type=image,name=${REF},push=true"
+          else
+            out="type=cacheonly"
+          fi
+          buildctl build --progress=plain \
+            --frontend dockerfile.v0 \
+            --local context=. \
+            --local dockerfile=. \
+            --opt platform=linux/amd64,linux/arm64 \
+            --output "$out"
+
+      # The image is a TOOLCHAIN, so "it built" is not the property that matters
+      # — "it still contains what the gates shell out to" is. build-image.yml
+      # asserts that with `docker run`, which does not exist on these runners;
+      # buildkit can do it directly by building a stage FROM the published image
+      # whose RUN fails when a tool is absent. That is strictly better: buildkit
+      # runs it natively per platform, so a package that resolves on amd64 but
+      # not on arm64 cannot reach half the nodes unnoticed.
+      #
+      # openssl and jq are on this list because their absence blocked v0.0.134
+      # and v0.0.135: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and a missing tool was reported
+      # as "verdict not signed" and "signature FAILED verification" — a tooling
+      # gap narrated as a security verdict. Extend this list whenever a gate
+      # grows a shell dependency; it only covers what someone remembered to add.
+      - name: Assert the published image carries the toolchain the gates need
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        run: |
+          set -euo pipefail
+          REF="${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }}"
+          work=$(mktemp -d)
+          {
+            echo "FROM ${REF}"
+            echo 'RUN set -eu; \'
+            echo '    python3 -c "import yaml, sys; print(\"python3+yaml\", sys.version.split()[0])"; \'
+            echo '    for t in gcc node bash make curl tar openssl jq; do \'
+            echo '      command -v "$t" >/dev/null || { echo "MISSING: $t" >&2; exit 1; }; \'
+            echo '      echo "ok: $t"; \'
+            echo '    done; \'
+            echo '    test -x "$(git --exec-path)/git-http-backend" || { echo "MISSING: git-http-backend" >&2; exit 1; }; \'
+            echo '    echo "ok: git-http-backend"'
+          } > "$work/Dockerfile"
+          cat "$work/Dockerfile"
+          buildctl build --progress=plain \
+            --frontend dockerfile.v0 \
+            --local context="$work" \
+            --local dockerfile="$work" \
+            --opt platform=linux/amd64,linux/arm64 \
+            --output type=cacheonly
+          echo "✓ toolchain intact on linux/amd64 and linux/arm64"
+
+      - name: Summary
+        run: |
+          if [ "${{ steps.meta.outputs.push }}" = "true" ]; then
+            echo "published ${REGISTRY}/${IMAGE_PATH}:${{ steps.meta.outputs.tag }} (amd64+arm64), toolchain asserted on both"
+          else
+            echo "validation only — the Dockerfile builds on both arches; nothing published"
+          fi

.github/workflows/build-image.yml

@@ -91,3 +91,57 @@ jobs:
             echo "$out" | grep -q "linux/$want" || { echo "::error::published image is missing linux/$want"; exit 1; }
           done
           echo "✓ ${IMAGE}:${{ inputs.tag }} carries linux/amd64 and linux/arm64"
+
+      # The image is a TOOLCHAIN, so "it built" is not the property that matters
+      # — "it still contains what the gates shell out to" is. This exists because
+      # a hand-built image had drifted from this Dockerfile: the deployed ci3
+      # carried gcc, musl-dev, python3 and py3-yaml, the Dockerfile did not, and
+      # rebuilding from the Dockerfile silently dropped them. CI runs then failed
+      # at "credentials-coverage: need python3" instead of running the tests.
+      #
+      # Asserted on BOTH architectures, because a package that resolves on amd64
+      # and not on arm64 would otherwise reach half the nodes unnoticed.
+      #
+      # openssl and jq were added after this check already existed and still
+      # missed them: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and their absence surfaced as
+      # "verdict not signed" / "signature FAILED verification" rather than as a
+      # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
+      # someone remembered to add, so add to it whenever a gate grows a new
+      # shell dependency.
+      - name: Verify the image still contains the toolchain the gates need
+        if: ${{ steps.meta.outputs.push == 'true' }}
+        run: |
+          set -euo pipefail
+          REF="${IMAGE}:${{ inputs.tag }}"
+          fail=0
+          for plat in linux/amd64 linux/arm64; do
+            echo "── $plat"
+            out=$(docker run --rm --platform "$plat" --entrypoint sh "$REF" -c '
+              set -u
+              py=$(python3 -c "import yaml,sys;print(sys.version.split()[0])" 2>/dev/null) \
+                && echo "python3+yaml=$py" || echo "python3+yaml=MISSING"
+              command -v gcc      >/dev/null && echo "gcc=ok"      || echo "gcc=MISSING"
+              command -v node     >/dev/null && echo "node=ok"     || echo "node=MISSING"
+              command -v bash     >/dev/null && echo "bash=ok"     || echo "bash=MISSING"
+              command -v make     >/dev/null && echo "make=ok"     || echo "make=MISSING"
+              command -v curl     >/dev/null && echo "curl=ok"     || echo "curl=MISSING"
+              command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
+              command -v openssl  >/dev/null && echo "openssl=ok"  || echo "openssl=MISSING"
+              command -v jq       >/dev/null && echo "jq=ok"       || echo "jq=MISSING"
+              [ -x "$(git --exec-path)/git-http-backend" ] \
+                && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
+            ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }
+            echo "$out"
+            if echo "$out" | grep -q MISSING; then
+              echo "$out" | grep MISSING | while read -r l; do
+                echo "::error::$plat is missing a required tool: $l"
+              done
+              fail=1
+            fi
+          done
+          [ "$fail" = 0 ] || {
+            echo "::error::The published image lost a tool the repo's gates depend on. Restore it in the Dockerfile — do not weaken this check."
+            exit 1
+          }
+          echo "✓ toolchain intact on both architectures"

.github/workflows/probe-buildkitd.yml

@@ -0,0 +1,66 @@
+name: probe registry from buildkitd
+
+# TEMPORARY probe branch — not for merge.
+#
+# The first probe ran in the RUNNER pod. buildkitd is a different pod in a
+# different namespace with its own NetworkPolicies, so those results cannot be
+# transferred: an UNREACHABLE there may be the runner's policy, not routing.
+# This runs the same probes THROUGH buildkitd, by building a stage whose RUN
+# does the curling — that egresses from the buildkitd pod, which is the network
+# position that actually has to push.
+#
+# It prints results and always exits 0: this is a measurement, not a gate.
+
+on:
+  workflow_dispatch:
+
+env:
+  BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
+  BUILDKIT_VERSION: v0.32.2
+
+jobs:
+  probe:
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Install buildctl
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in x86_64) arch=amd64;; aarch64) arch=arm64;; *) exit 1;; esac
+          mkdir -p "$GITHUB_WORKSPACE/.bin"
+          curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+            | tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
+          echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
+          "$GITHUB_WORKSPACE/.bin/buildctl" --version
+
+      - name: Probe from inside buildkitd
+        run: |
+          set -euo pipefail
+          work=$(mktemp -d)
+          {
+            echo 'FROM alpine:3.20'
+            echo 'RUN apk add --no-cache curl >/dev/null 2>&1 || true'
+            echo 'RUN set -u; \'
+            echo '  f="http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\\n"; \'
+            echo '  echo "== public name via cluster DNS =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== resolves to =="; getent hosts gitea.langenoja.se || echo "(none)"; \'
+            echo '  echo "== istio-gateway external lb 10.40.0.10 =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== istio-gateway clusterip 10.43.1.114 =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== gitea http service in-cluster =="; \'
+            echo '  curl -s -o /dev/null -w "$f" --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ || echo UNREACHABLE; \'
+            echo '  echo "== gitea http service, headers =="; \'
+            echo '  curl -s -D- -o /dev/null --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ | head -5 || true'
+          } > "$work/Dockerfile"
+          cat "$work/Dockerfile"
+          buildctl build --progress=plain \
+            --frontend dockerfile.v0 \
+            --local context="$work" \
+            --local dockerfile="$work" \
+            --opt platform=linux/amd64 2>&1 | tee /tmp/probe.log | tail -80
+          echo "=== PROBE RESULTS ==="
+          grep -E "^#[0-9]+ [0-9.]+ " /tmp/probe.log | sed -E "s/^#[0-9]+ [0-9.]+ //" || echo "(no RUN output captured)"
+          echo "probe finished (results above, from buildkitd's network position)"

.github/workflows/probe-registry.yml

@@ -0,0 +1,47 @@
+name: probe registry endpoints
+
+# TEMPORARY probe branch — not for merge. Answers one question with evidence
+# instead of inference: which registry endpoints are reachable from a pod inside
+# this cluster, after 10.40.0.10 (the istio-gateway LoadBalancer EXTERNAL
+# address) turned out to be connection-refused from the pod network while
+# answering fine from a LAN workstation.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  probe:
+    if: ${{ github.server_url != 'https://github.com' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Probe candidate registry endpoints
+        run: |
+          set -u
+          fmt='http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\n'
+
+          echo "--- public name via cluster DNS (the path that works today) ---"
+          printf '%-46s ' 'gitea.langenoja.se:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- istio-gateway EXTERNAL lb ip (what #949 pinned) ---"
+          printf '%-46s ' '10.40.0.10:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- istio-gateway CLUSTER ip (candidate) ---"
+          printf '%-46s ' '10.43.1.114:443'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- gitea http service, in-cluster, plain http ---"
+          printf '%-46s ' 'gitea-system-gitea-http:3000'
+          curl -s -o /dev/null -w "$fmt" --max-time 8 \
+            http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ \
+            || echo "UNREACHABLE"
+
+          echo "--- what this pod resolves the public name to ---"
+          getent hosts gitea.langenoja.se || echo "(getent failed)"

Dockerfile

@@ -6,15 +6,20 @@
 # The runner pod is non-root with all caps dropped, so it cannot apt/apk-add at
 # runtime -- the tools must be baked in here.
 #
-# Build multi-arch (cluster is mixed amd64/arm64) and push to the Gitea registry:
+# PUBLISHING IS AUTOMATED. Run the "build image" workflow on GitHub with a tag
+# (e.g. 12.11.1-ci4); it builds both architectures and pushes to
+# ghcr.io/zegit-zoo/zegit-forgejo-runner. ./push-image.sh remains for building
+# by hand. README.md explains why the registry moved off Gitea (Cloudflare's
+# request-body cap returns 413 on a registry layer) and why the build cannot run
+# on our own runners (host mode, all capabilities dropped).
 #
-#   docker buildx create --use --name zegit-ci 2>/dev/null || true
+# Then in flux-config set the image on BOTH deployment-zegit-runner and
-#   docker login gitea.langenoja.se        # username + a Gitea personal access token
+# deployment-forgejo-runner, digest-pinned.
-#   docker buildx build --platform linux/amd64,linux/arm64 \
-#     -t gitea.langenoja.se/zegit-zoo/zegit-forgejo-runner:12.11.1-ci --push .
 #
-# Then in flux-config set both containers' image: to the tag above and commit.
+# The image is NOT public. Pulls need a registry credential in
-# Package visibility is PUBLIC, so the runner namespace pulls without a secret.
+# forgejo-runner-system -- github-registry-credentials for ghcr.io. An earlier
+# version of this comment claimed the package was public and needed no secret;
+# that was wrong for the Gitea registry too, which is private.
 FROM code.forgejo.org/forgejo/runner:12.11.1
 
 USER root
@@ -33,6 +38,25 @@ USER root
 # curl,tar -> setup-go / gitleaks download + extract their own arch-specific binaries
 # make     -> zegit Makefile targets
 # ca-certificates -> trusted roots for HTTPS to gitea/github/goproxy
+# openssl  -> the release tag gate verifies the Control Plane's SIGNED quorum
+#             verdict (Ed25519 DSSE) with `openssl pkeyutl -verify -rawin`.
+#             Absent, that command failed "command not found" and the gate's
+#             `|| { echo ...; exit 1; }` reported it as "Quorum verdict
+#             signature FAILED verification" -- a TOOLING gap narrated as a
+#             SECURITY verdict, pointing the investigation at a perfectly
+#             valid signed approval instead of at this image. It blocked
+#             v0.0.134 and v0.0.135 on 2026-08-31.
+# jq       -> the same story one step earlier: the gate parsed that envelope
+#             with `jq -e`, and a missing jq was reported as "not a signed
+#             DSSE envelope". jq is the reflex tool for JSON in shell steps,
+#             so its absence keeps resurfacing as a misleading failure in
+#             whichever step reaches for it next.
+# gcc,musl-dev -> C toolchain for cgo; `go test -race` (the Makefile test
+#             target) requires cgo, which needs a C compiler + libc headers
+#             (musl on Alpine)
+# python3,py3-yaml -> the repo's own gates are Python: credentials-coverage.sh,
+#             validate-admission.sh and feature-lint.sh all shell out to
+#             python3, and credentials-coverage parses manifests with yaml
 #
 # Go is intentionally NOT baked in: actions/setup-go fetches the pinned version
 # per-run (node + tar are present), so the image needs no rebuild on Go bumps.
@@ -45,7 +69,13 @@ RUN apk add --no-cache \
       curl \
       tar \
       make \
-      ca-certificates
+      ca-certificates \
+      gcc \
+      musl-dev \
+      python3 \
+      py3-yaml \
+      openssl \
+      jq
 
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000