3 Commits

Author	SHA1	Message	Date
pi	5fb07e0a39	ci: no image build on push — split cheap checks from builds ... A push to main used to trigger validate.yml, which builds an amd64 variant and runs the smoke test. Pushing work-in-progress to main therefore cost a build. Restructure so the three workflows divide by cost, matching pi-devbox: lint.yml cheap checks, every push/PR — the ONLY workflow a push to main triggers validate.yml amd64 build + smoke test — pull_request and workflow_dispatch only, no push trigger at all docker-publish-split.yml the release path, tag-only (unchanged) docs-check (DOCKER_HUB.md vs HUB_TEMPLATE) moves from validate.yml to lint.yml. It needs no image, and anything that needs no image belongs in the workflow that actually runs on push — otherwise the doc-drift guard would have been silently lost when validate.yml stopped running on pushes. That guard earns its keep: it has caught real drift. validate-base/validate-omos additionally keep a `github.event_name != 'push'` clause. It is redundant now that the trigger is gone, and deliberately so: re-adding a push trigger later cannot silently re-enable builds on every push. Renamed lint.yml `Lint workflows` -> `Lint`, since it now covers Dockerfiles and docs as well as workflows. No references to the old name existed. Safe because the release path already fails closed: docker-publish-split.yml pushes variant tags only after smoke-base/smoke-omos pass and promotes base-latest last, so an aborted release leaves at worst an unreferenced base-<hash> blob on Hub — never a half-published version tag. Pre-tag validation remains available three ways: open a PR, dispatch Validate, or dispatch docker-publish-split.yml against a throwaway tag with promote_latest=false — the only route that also exercises a CHANGED base, which validate.yml structurally cannot (it builds variants on Hub's base-latest). Coverage lost is narrower than it looks: validate-base/validate-omos were already skipped whenever a commit touched Dockerfile.base, rootfs/, or entrypoint*.sh, so they only ever ran for variant-only changes — most usefully a bare OPENCODE_VERSION bump, for which an explicit dispatch is now the equivalent. Verified with the CI-pinned actionlint 1.7.7 and scripts/check-workflow-shell.sh. AGENTS.md updated in the same commit (file roles for both workflows + the trigger-model convention). The CHANGELOG entry lands with the v2.9.0 changeset in the following commit, which is one unreleased block covering all of v2.9.0.	2026-08-04 16:23:03 +02:00
pi	281ccbaa70	feat: pi-devbox parity — typst PDF, terminal terminfo, nvim colour, host-ssh check, hygiene ... Ports the base additions from pi-devbox v1.4.0 + v1.5.0 that opencode-devbox lacked (opencode-devbox already tracks pi-devbox for CLI-toolset parity, v2.6.0): - typst PDF engine for pandoc (v1.4.0) + the pandoc typst-template default-font patch (v1.5.0) so 'pandoc --pdf-engine=typst' works without -V mainfont. pandoc shipped since v2.6.0 as a front-end only (no PDF back-end). +xz-utils. Tracks latest; --build-arg TYPST_VERSION escape hatch. - Terminal support (v1.5.0): ncurses-term + kitty-terminfo + a compiled xterm-ghostty alias (tic -x, use=ghostty), so wezterm/alacritty/foot/ghostty/ kitty resolve TERM over SSH instead of degrading to a dumb fallback. - Readable Neovim colours (v1.5.0): system-wide /etc/xdg/nvim/sysinit.vim with termguicolors. - Host SSH reachability check at shell startup (v1.4.0): one-time probe in .bash_aliases warning (with fix steps + inline pubkey) when the Mac host is unreachable. The rest of the LAN stack was already present. - .claude/settings.local.json added to the gitignore_global seed (v1.5.0). - Repo hygiene (v1.5.0): LICENSE (MIT), THIRD_PARTY.md, hadolint CI job (pinned v2.14.0) + .hadolint.yaml, IDEAS.md backlog. Base-affecting (Dockerfile.base + rootfs) → base-<hash> advances, base rebuilds. smoke-test gains typst/PDF, terminfo, and nvim-tgc assertions. Validated: hadolint clean on both Dockerfiles, bash -n OK, base-hash guard OK, workflow guard OK. CHANGELOG v2.7.0.	2026-07-13 19:55:50 +02:00
pi	acb2096406	ci: port pi-devbox CI hardening — bash-default footgun guard + base-latest digest promote ... Two CI-only changes ported from pi-devbox (no runtime/image impact), adapted to opencode-devbox's split-base 2-variant pipeline. Rides the next release. C — eliminate the sh-vs-bash footgun class: - Add `defaults: run: shell: bash` workflow-wide to docker-publish-split.yml and validate.yml. Gitea's default step shell is sh/dash, so bash-only syntax in a step that omits `shell: bash` fails silently. All pre-existing steps are POSIX, so bash runs them unchanged (no behavioural change). - New .gitea/workflows/lint.yml (push/PR/dispatch): a Gitea-accurate shell guard (scripts/check-workflow-shell.sh) + pinned actionlint + shellcheck. The guard closes the actionlint blind spot: actionlint models GitHub (default shell bash) so it does NOT flag bash syntax in a shell-less step. Guard scans ALL .gitea/workflows/*.yml (hence the validate.yml default too). Ported from pi-devbox 26384fe/d1db595. B — promote-base-latest re-points base-latest by digest, not need_build: The gate keyed off need_build=='true', assuming need_build==false meant base-latest was current. A dry-run dispatch that pre-builds base-<hash> falsifies that, leaving base-latest one base behind. Gate now runs on every tag release / promote dispatch; the no-op optimization moved into the step as a crane digest compare (re-tags only when base-latest != released base-<hash>). Ported from pi-devbox b7197e8. Validated locally: all 3 workflows YAML-parse; shell guard passes real workflows and correctly fails a synthetic omit-shell+pipefail workflow; actionlint (pinned 1.7.7) passes with explicit .gitea/workflows/*.yml glob.	2026-07-01 23:00:20 +02:00