Runners migrated to 2 isolated runner+dind pairs (capacity 1 each): each job
gets its own docker daemon (job-to-job isolation; host daemon untouched).
- e2e: seed BRouter segment into the compose volume via a DinD container
(no cross-daemon bind mount); services addressed at host.docker.internal;
compose project pinned to 'trails'.
- image-smoke: db:push reaches postgres at host.docker.internal; the
--network-host journal container uses localhost; health-check via
host.docker.internal.
DOCKER_HOST is also injected globally via the runner's config (runner.envs).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Verified empirically: from a job container the DinD daemon is reachable at
host.docker.internal:2375 (host-gateway 172.17.0.1), not docker-in-docker
(a host-network alias absent inside DinD). Runner container.network reverted
to "" (a host network name is not found inside DinD and fails every job).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- forgejo/upload-artifact -> full code.forgejo.org URL (not on github.com,
where DEFAULT_ACTIONS_URL sent it).
- e2e + journal-image-smoke: set DOCKER_HOST=tcp://docker-in-docker:2375 so
the job's docker CLI reaches the DinD daemon (no /var/run/docker.sock).
(Runner config also now attaches jobs to the runner network.)
- @trails-cool/db test: --testTimeout=20000; the cold drizzle/postgres import
exceeds vitest's 5s default under runner CPU contention.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- gitleaks: GITLEAKS_ENABLE_UPLOAD_ARTIFACT=false (its @actions/artifact v2
upload throws GHESNotSupportedError on Forgejo; the scan itself passes).
- swap actions/upload-artifact@v7 -> forgejo/upload-artifact@v4 (v4+ artifact
API is unsupported on non-github.com servers).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- ci.yml: all 10 jobs (security/dockerfile/openspec/typecheck/lint/test/
build/visual/e2e/image-smoke); drop merge_group, gitleaks via full URL,
visual-diff PR comment via Forgejo API.
- cd-apps/cd-brouter/cd-infra/cd-staging: drop GitHub Environments, GHCR
push auth via DEPLOY_GHCR_TOKEN. cd-staging flags Forgejo PR-event and
peter-evans comment-action risks for validation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
First step of porting CI/CD from GitHub Actions to the self-hosted
Forgejo at git.ullrich.is. Proves the trails-forgejo runner executes
a real job (checkout + pnpm + typecheck) before porting the full suite.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
