GRM-97: ci: use pre-built tier images for all CI workflows

.gitea/workflows/ci.yml

@@ -8,13 +8,12 @@ on:
 jobs:
   quality:
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=lint
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-quality
       - name: Lint all
         run: |
           . .venv/bin/activate
@@ -56,15 +55,14 @@ jobs:
     needs: [quality, detect-changes]
     if: needs.detect-changes.outputs.user-facing-changed == 'true'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=ci,lint
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-release
       - name: Release dry-run validation
         env:
           PYTHONPATH: src
@@ -77,6 +75,7 @@ jobs:
 
   detect-changes:
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     outputs:
       ansible-changed: ${{ steps.detect.outputs.ansible-changed }}
@@ -86,9 +85,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Detect changed paths
         id: detect
         env:
@@ -105,6 +102,7 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.ansible-changed == 'true'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     outputs:
       runner-count: ${{ steps.discover.outputs.runner-count }}
@@ -112,9 +110,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Discover available runners
         id: discover
         env:
@@ -132,6 +128,7 @@ jobs:
     needs: [quality, detect-changes, discover-runners]
     if: needs.detect-changes.outputs.ansible-changed == 'true'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
     timeout-minutes: 10
     strategy:
       matrix:
@@ -139,9 +136,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=ci,molecule
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+      - name: Install Ansible collections
-        run: make setup-molecule
+        run: |
+          . .venv/bin/activate
+          python3 -m devx.tools.setup --skip-install --no-pre-commit --no-tea-login
       - name: Discover assigned test pairs
         env:
           RUNNER_INDEX: ${{ matrix.runner-index }}
@@ -172,13 +171,15 @@ jobs:
   pr-review:
     if: github.event_name == 'pull_request'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Run automated PR review
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
@@ -203,16 +204,18 @@ jobs:
       needs.pr-review.result == 'success' &&
       (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.REPO_TOKEN }}
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Squash merge with task ID
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}

.gitea/workflows/post-merge.yml

@@ -33,6 +33,7 @@ on:
 jobs:
   detect-type:
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     outputs:
       is-release: ${{ steps.check.outputs.is-release }}
@@ -41,9 +42,7 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Check if this is a release commit
         id: check
         env:
@@ -56,15 +55,14 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Validate latest commit message
         env:
           PYTHONPATH: src
@@ -79,6 +77,7 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
     timeout-minutes: 15
     outputs:
       tag: ${{ steps.release-tag.outputs.tag }}
@@ -88,9 +87,7 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.REPO_TOKEN }}
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=ci,lint
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-release
       - name: Configure git
         run: |
           git config user.name "grm-ci-bot"
@@ -106,13 +103,6 @@ jobs:
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
-      - name: Extract tag (fallback if GITHUB_OUTPUT not set)
-        if: steps.release-tag.outputs.tag == ''
-        run: |
-          tag=$(git describe --tags --abbrev=0 2>/dev/null || true)
-          if [ -n "$tag" ]; then
-            echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          fi
       - name: Notify on failure
         if: failure()
         env:
@@ -131,15 +121,14 @@ jobs:
     needs: [release]
     if: needs.release.outputs.tag != ''
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=ci,lint
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-release
       - name: Build and publish release
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
@@ -168,15 +157,14 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Sync documentation to wiki
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
@@ -201,6 +189,7 @@ jobs:
     needs: [detect-type]
     if: always()
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -213,9 +202,7 @@ jobs:
           git fetch origin master
           git reset --hard origin/master
       - name: Set up environment
-        env:
+        run: make setup-image EXTRAS=lint
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Generate and push badges
         env:
           PRE_COMMIT_ALLOW_NO_CONFIG: "1"
@@ -239,15 +226,14 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Update Vikunja task
         env:
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
@@ -274,13 +260,12 @@ jobs:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
-        env:
+        run: make setup-image
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-ci
       - name: Ensure branch protection and labels
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-molecule setup-release install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools
+.PHONY: all setup setup-ci setup-quality setup-molecule setup-release setup-image install update lint ansible-lint makefile-lint lint-all lint-ruff lint-format lint-bandit lint-deps typecheck checkmake install-hooks test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check install-tools
 .PHONY: configure-gitea-pypi
 .PHONY: create-task create-pr push-with-pr git-push
 
@@ -62,6 +62,14 @@ setup-release: $(VENV)/bin/activate .env configure-gitea-pypi
 	@export PATH="$(HOME)/.local/bin:$$PATH"; \
 	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --skip-install --no-ansible-collections --no-pre-commit
 
+# Setup for pre-built image jobs (deps already in image, just link venv + install project)
+# Usage: make setup-image              (runtime deps only)
+#        make setup-image EXTRAS=lint  (runtime + lint deps, e.g. ansible-lint)
+#        make setup-image EXTRAS=ci,lint (runtime + ci + lint deps)
+setup-image:
+	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate && pip install -e .$(if $(EXTRAS),[$(EXTRAS)],) 2>/dev/null; \
+	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
+
 # Helper: run pip install with Gitea registry configured
 # Usage: $(PIP_INSTALL) install -e '.[ci,lint]'
 PIP_INSTALL := if [ -z "$$REPO_TOKEN" ]; then . ./.env 2>/dev/null; fi; \