Migrate Python workflows to python-repositories-ci runner label.

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/ci-image.yml

@@ -17,7 +17,7 @@ on:
 env:
   REGISTRY: gitea.lille-vemmelund.dk
   REGISTRY_USER: ci-bot
-  IMAGE: gitea.lille-vemmelund.dk/brian/python-repositories-ci
+  IMAGE: gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci
 
 jobs:
   build-and-push:
@@ -37,7 +37,7 @@ jobs:
           CI_RUNNER_TOKEN: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
           echo "$CI_RUNNER_TOKEN" > /tmp/uv_token
-          docker build -f docker/ci/Dockerfile \
+          docker build --network=host -f docker/ci/Dockerfile \
             --secret id=uv_token,src=/tmp/uv_token \
             -t "${IMAGE}:latest" \
             .

.gitea/workflows/code-quality.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   code-quality:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Type check with mypy
         run: uv run mypy .

.gitea/workflows/dependency-update-bot.yml

@@ -7,22 +7,17 @@ on:
 
 jobs:
   update-check:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.CI_RUNNER_TOKEN }}
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
       - name: Upgrade dependencies
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: uv lock --upgrade
 
       - name: Commit and push changes

.gitea/workflows/publish.yml

@@ -9,25 +9,24 @@ on:
 
 jobs:
   build-and-publish:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
       - name: Update version in pyproject.toml to match tag
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh --from-tag "${GITHUB_REF##*/}"
 
       - name: Build package
+        env:
+          UV_LINK_MODE: copy
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: |
-          uv sync --no-dev
+          uv sync --no-dev --frozen
           uv build
 
       - name: Publish to Gitea Package Registry

.gitea/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -22,19 +22,12 @@ jobs:
           COMMIT_MSG: ${{ github.event.head_commit.message }}
         run: scripts/ci/parse-merge-commit.sh "$COMMIT_MSG"
 
-      - name: Set up Python
-        if: steps.meta.outputs.bump != 'skip'
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        if: steps.meta.outputs.bump != 'skip'
-        run: pip install uv
-
       - name: Bump version
         if: steps.meta.outputs.bump != 'skip'
         id: bump
+        env:
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
         run: scripts/ci/bump-version.sh "${{ steps.meta.outputs.bump }}"
 
       - name: Generate release notes

.gitea/workflows/security-audit.yml

@@ -7,23 +7,17 @@ on:
 
 jobs:
   safety:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --frozen
 
       - name: Run safety check
         run: uv run safety check

.gitea/workflows/test.yml

@@ -8,23 +8,17 @@ on:
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Run unit tests
         run: |
@@ -43,23 +37,17 @@ jobs:
           compression-level: 0
 
   integration-tests:
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Verify Docker
         run: docker info
@@ -83,24 +71,18 @@ jobs:
   coverage-report:
     # Merges unit + integration coverage and enforces fail_under from pyproject.toml.
     needs: [unit-tests, integration-tests]
-    runs-on: ubuntu-latest
+    runs-on: python-repositories-ci
     if: github.event_name == 'pull_request' || github.event_name == 'push'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version-file: .python-version
-
-      - name: Install uv
-        run: pip install uv
-
-      - name: Install dependencies
+      - name: Sync dependencies
         env:
           UV_LINK_MODE: copy
-        run: uv sync --all-extras
+          UV_INDEX_GITEA_USERNAME: ci-bot
+          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
+        run: uv sync --all-extras --frozen
 
       - name: Download unit coverage
         uses: https://github.com/christopherHX/gitea-download-artifact@v4

docker/ci/Dockerfile

@@ -5,10 +5,10 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        docker.io \
         git \
     && rm -rf /var/lib/apt/lists/*
 
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
 COPY --from=ghcr.io/astral-sh/uv:0.7.0 /uv /usr/local/bin/uv
 
 ENV UV_PYTHON_INSTALL_DIR=/opt/uv-python \

docs/ci-image.md

@@ -14,10 +14,10 @@ Built from [`docker/ci/Dockerfile`](../docker/ci/Dockerfile):
 - Docker CLI (integration tests via testcontainers)
 - Dev dependencies from `uv.lock` (`uv sync --all-extras --no-install-project`)
 
-Published to the Gitea container registry:
+Published to the Gitea container registry (owner segment must be lowercase for Docker):
 
-- `gitea.lille-vemmelund.dk/brian/python-repositories-ci:latest`
-- `gitea.lille-vemmelund.dk/brian/python-repositories-ci:YYYYMMDDHHmm` (timestamped rollback tag)
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest`
+- `gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:YYYYMMDDHHmm` (timestamped rollback tag)
 
 ## Rebuild triggers
 
@@ -108,7 +108,7 @@ homelab-platform
 [`platform/gitea-runners/values.yaml`](https://gitea.lille-vemmelund.dk/LilleVemmelund/homelab-platform/src/branch/main/platform/gitea-runners/values.yaml):
 
 ```yaml
-python-repositories-ci:docker://gitea.lille-vemmelund.dk/brian/python-repositories-ci:latest
+python-repositories-ci:docker://gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest
 ```
 
 After label changes, roll runner pods so they re-register with Gitea.
@@ -137,7 +137,7 @@ bash scripts/ci/build-ci-image.sh --push
 ```
 
 Run from the repo root on the branch you want to test. Runners pull
-`gitea.lille-vemmelund.dk/brian/python-repositories-ci:latest` from the registry;
+`gitea.lille-vemmelund.dk/lillevemmelund/python-repositories-ci:latest` from the registry;
 they do not care which git branch built it.
 
 Override registry settings if needed:

scripts/ci/build-ci-image.sh

@@ -15,7 +15,7 @@
 # Optional overrides:
 #   REGISTRY=gitea.lille-vemmelund.dk
 #   REGISTRY_USER=ci-bot
-#   IMAGE_OWNER=brian
+#   IMAGE_OWNER=lillevemmelund
 #   IMAGE_NAME=python-repositories-ci
 set -euo pipefail
 
@@ -24,7 +24,7 @@ REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
 
 REGISTRY="${REGISTRY:-gitea.lille-vemmelund.dk}"
 REGISTRY_USER="${REGISTRY_USER:-ci-bot}"
-IMAGE_OWNER="${IMAGE_OWNER:-brian}"
+IMAGE_OWNER="${IMAGE_OWNER:-lillevemmelund}"
 IMAGE_NAME="${IMAGE_NAME:-python-repositories-ci}"
 IMAGE="${IMAGE:-${REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}}"
 
@@ -52,7 +52,7 @@ cd "$REPO_ROOT"
 
 if [[ "$MODE" == "local" ]]; then
   echo "=== Building local CI image (no push): python-repositories-ci:local ==="
-  docker build -f docker/ci/Dockerfile \
+  docker build --network=host -f docker/ci/Dockerfile \
     --secret "id=uv_token,src=${TOKEN_FILE}" \
     -t python-repositories-ci:local \
     .
@@ -64,7 +64,7 @@ echo "=== Logging in to ${REGISTRY} as ${REGISTRY_USER} ==="
 echo "$CI_RUNNER_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
 echo "=== Building ${IMAGE}:latest ==="
-docker build -f docker/ci/Dockerfile \
+docker build --network=host -f docker/ci/Dockerfile \
   --secret "id=uv_token,src=${TOKEN_FILE}" \
   -t "${IMAGE}:latest" \
   .