act_runner's cache PVC is 1Gi and also holds .runner, the runner's own
registration file. --cache-to type=gha,mode=max for three images is several GB;
filling that volume breaks the runner, not just the cache. act_runner also
evicts by age with no size cap, so it fills whatever it is given.
type=registry has no such limit and lives beside the images it caches. The uv
cache still uses the runner's cache service, which is a few hundred MB.
Registry login is no longer gated to master: the build now reads and writes the
cache on every run. Pushing the release image keeps its own master-only gate.
trivy-action@v0.29.0 internally uses setup-trivy@v0.2.2, a tag removed
upstream (earliest published is now v0.2.6), so it cannot resolve on any
runner. Run trivy from a digest-pinned image instead, as gitleaks already is.
RUNBOOK gains a 'Setting up CI/CD from scratch' section with the traps that
actually cost time: GITEA_TOKEN is 401 at the package registry, the runner's
cache fails soft, service containers resolve by name not localhost.
Not pushed: pushing triggers a run, and the runner is being restarted by the
ansible change that enables its cache.
- --cov pointed at libs/svcforge_core/domain, a path that does not exist (the
package nests one level deeper). Coverage measured 0.00% of the code. Use the
module form, which is layout-independent.
- pip-audit --strict cannot audit our own editable, not-on-PyPI packages. Audit
the locked dependency set instead and keep --strict.
- bandit re-reports B608/B104, which ruff's S ruleset already enforces with
justified per-line noqa it cannot see. Skipped in config, with reasons.
- registry host was git.oci-oci; it is gitea.oci-oci.
- integration job set SVCFORGE_PG_DSN; conftest reads SVCFORGE_TEST_DSN.
Nguyen Minh Phuc