immosai-ci

Prebuilt CI runner image for the Immosai Forgejo Actions pipeline.

Publishes git.minnecker.com/florian/immosai-ci:latest (+ :<commit>) from this repository's pipeline — no manual/local builds. The main repo (florian/repr) declares it a hard prerequisite: every CI job needs: [build-ci-image] and runs container.image of this image.

What's in the image

• Debian bookworm base
• Node 22 (nodesource)
• Rust stable + aarch64-unknown-linux-gnu target (cross-compile for Graviton2) + gcc-aarch64-linux-gnu
• zig (cargo-lambda linker), python3 + venv + pip
• AWS CLI v2
• cargo-lambda, cargo-audit, cargo-deny, sccache (compile cache)
• aws-cdk CLI + the pinned CDK Python deps from iac/cdk/requirements.txt in the main repo (florian/repr)

Build

The image is built by the build workflow (.forgejo/workflows/build.yml), which requires the Forgejo runner to mount the host docker socket (/var/run/docker.sock); the job installs the docker CLI via get.docker.com and builds against that daemon (amd64 — the runner's architecture).

Triggers:

• push to main touching Dockerfile / the workflow
• workflow_dispatch (manual)

Use from other repos

jobs:
  checks:
    runs-on: docker
    container:
      image: git.minnecker.com/florian/immosai-ci:latest
      credentials:
        username: oauth2
        password: ${{ secrets.GITHUB_TOKEN }}

Caveats

• Bookworm python is PEP-668 (externally managed) — in downstream jobs use pip install --break-system-packages or a venv.
• amd64 only (AWS CLI is an x86_64 binary).

Secrets (one-time, for publishing)

IMMOSAI_PKG_TOKEN — a Forgejo personal access token with the write:package scope (+ read:repository). Create it under Settings → Applications → Generate New Token, then add it as a secret on this repository. The workflow's automatic token can log in but cannot upload blobs (401 on /v2/.../blobs/uploads/).