Andreas Niemann dda83bdc87 feat(ci): baked CI image + runner config + self-check workflow (T14) ... Stand up the foundation's own CI on its Forgejo runner. The committed scope here is the self-contained half (toolchain + typecheck); the stack-state-dependent pipelines (pulumi preview, backup-verify) need CI secrets + a state fetch and land next. - containers/ci-image/Dockerfile + VERSIONS IMAGE_CI: one baked image carrying exactly what preflight validates (pulumi/bun/node/docker/git/age/zstd/jq/vault/ psql/mc). Built on the VM (like caddy-cloudflare) and used LOCALLY by the runner. - runner.ts: give act_runner a config.yaml — container.network=foundation-net (so job containers reach foundation-forgejo:3000 for checkout + the data plane) and force_pull=false (use the local foundation-ci image, no registry). Self-heals on up. - .forgejo/workflows/ci.yml: preflight (tools + versions vs VERSIONS pins) + typecheck (bun install + tsc --noEmit on bootstrap). Gates every push. - run.sh / backup.sh / restore.sh / dr: take PULUMI_CONFIG_PASSPHRASE from env when set (CI secret), falling back to `pass` (operator) — so the scripts run pass-free in CI. Reusable-workflows architecture (per the chosen direction) — the ecosystem CI (semantic-release, docker/npm/bun builds, eslint/yamllint over the 999_testing.md candidates) builds on this image + runner next phase. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-07-01 00:15:01 +02:00
..
.gitkeep	chore: scaffold olsitec-foundation mono-repo	2026-06-30 17:10:46 +02:00
backup-remote.sh	fix(backup): bundle the whole forgejo /data (app.ini + ssh host keys)	2026-06-30 23:58:07 +02:00
backup.sh	feat(ci): baked CI image + runner config + self-check workflow (T14)	2026-07-01 00:15:01 +02:00
restore-remote.sh	feat(backup): age at-rest encryption of bundles (CONTRACT_004 §4.3)	2026-06-30 23:23:38 +02:00
restore.sh	feat(ci): baked CI image + runner config + self-check workflow (T14)	2026-07-01 00:15:01 +02:00