release: pull private Gitea packages via gitea-pull secret (ns pargar)

download.docker.com resets intermittently from the cluster network, and
/root/.docker/cli-plugins is not searched when the workflow sets
DOCKER_CONFIG=/tmp/.docker ('Docker buildx is required').

- jobs on the apollo runner use act-job:20 (.gitea/job-image: node 20 +
  docker CLI + buildx in system plugin paths) - no runtime downloads
- other runners fall back to installing, now into a system plugin path

.gitea/job-image/Dockerfile

@@ -0,0 +1,14 @@
+# CI job image for the Gitea Actions runners.
+#
+# JS actions (actions/checkout, docker/build-push-action) execute INSIDE the
+# job container and need node; builds talk to the runner's daemon through the
+# mounted /var/run/docker.sock, so this image needs the docker CLI + buildx
+# but no daemon. Baking them in means jobs never download binaries at runtime:
+# download.docker.com and github.com releases are unreachable (connection
+# reset) from the cluster's network.
+#
+# Tagged as src.panahifar.ir/ahp/act-job:20 (node 20 / bookworm).
+FROM node:20-bookworm
+
+COPY --from=docker:27-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker:27-cli /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx

.gitea/workflows/build-and-push.yaml

@@ -36,21 +36,28 @@ jobs:
         id: meta
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
-      # The job container (node:20-bookworm) ships no docker CLI, and builds
-      # run against the runner host's daemon (docker-outside-of-docker), so
-      # the socket must be mounted by the runner config.
-      - name: Set up Docker CLI (not shipped in job container)
+      # Builds run docker-outside-of-docker through the runner-mounted
+      # /var/run/docker.sock. The apollo runner's job image (act-job:20,
+      # .gitea/job-image) already ships the docker CLI + buildx in system
+      # plugin paths; runners on other networks fall back to installing them
+      # at runtime (needs access to download.docker.com + github.com, and the
+      # plugin must land where docker looks with DOCKER_CONFIG set).
+      - name: Set up Docker CLI (preinstalled on apollo; install elsewhere)
         run: |
           set -eu
           if [ ! -S /var/run/docker.sock ]; then
-            echo "::error::/var/run/docker.sock is not mounted in the job container - add 'options: -v /var/run/docker.sock:/var/run/docker.sock' and 'valid_volumes: [/var/run/docker.sock]' under 'container:' in the act_runner config.yaml, then restart the runner."
+            echo "::error::/var/run/docker.sock is not mounted in the job container - the act_runner config must mount it (docker_host: \"\" auto-mounts it)."
             exit 1
           fi
-          curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
-          mkdir -p /root/.docker/cli-plugins
-          curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
-          chmod +x /root/.docker/cli-plugins/docker-buildx
+          if ! command -v docker >/dev/null 2>&1 || ! docker buildx version >/dev/null 2>&1; then
+            curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+            mkdir -p /root/.docker/cli-plugins /usr/local/libexec/docker/cli-plugins
+            curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
+            cp /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+            chmod +x /root/.docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+          fi
           docker version
+          docker buildx version
 
       - name: Login to Gitea container registry
         uses: docker/login-action@v3

deploy/helm/pargar/values-apollo.yaml

@@ -11,7 +11,7 @@ backend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-backend
-    tag: 0.3.6
+    tag: 0.3.7
   metrics:
     serviceMonitor:
       enabled: true
@@ -41,7 +41,7 @@ frontend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-frontend
-    tag: 0.3.6
+    tag: 0.3.7
   podDisruptionBudget:
     enabled: false
   replicaCount: 2
@@ -58,7 +58,10 @@ global:
   # Images published by .gitea/workflows/build-and-push.yaml on tag push.
   imageRegistry: src.panahifar.ir/ahp
   publicUrl: https://pargar.panahifar.ir
-imagePullSecrets: []
+# Gitea packages are private: kubelet pulls need secret `gitea-pull`
+# (docker-registry secret for src.panahifar.ir, created in ns pargar).
+imagePullSecrets:
+  - gitea-pull
 ingress:
   enabled: true
   tls: