Fix sectool installation step by removing version check

.gitea/actions/setup-sectool/action.yml

@@ -13,4 +13,3 @@ runs:
         unzip -o /tmp/sectool.zip -d /usr/local/bin
         rm /tmp/sectool.zip
         chmod +x /usr/local/bin/sectool
-        sectool version

ansible/files/dockerfiles/linux-runners/Dockerfile.cicd-base

@@ -1,31 +1,18 @@
 FROM local/gitea-runner-base:latest
 
-# Base image sets USER runner; switch back to root for package installs
+# cicd-base runner profile: common CI build and release tooling.
 USER root
-RUN apt-get update && apt-get install -y --no-install-recommends \
-	buildah \
-	fuse-overlayfs \
-	iptables \
-	podman \
-	skopeo \
-	slirp4netns \
-	uidmap \
-	&& rm -rf /var/lib/apt/lists/*
-
-RUN mkdir -p /etc/containers /var/lib/containers /run/containers && \
-	printf '%s\n' '[storage]' 'driver = "vfs"' > /etc/containers/storage.conf && \
-	printf '%s\n' '[engine]' > /etc/containers/containers.conf && \
-	chown -R 1000:1000 /var/lib/containers
-
-ENV BUILDAH_ISOLATION=chroot
-ENV STORAGE_DRIVER=vfs
-
-ARG TRIVY_VERSION=0.72.0
-RUN curl -fsSL -o /tmp/trivy.tar.gz \
-	"https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" && \
-	tar -xzf /tmp/trivy.tar.gz -C /tmp && \
-	install -m 0755 /tmp/trivy /usr/local/bin/trivy && \
-	rm -f /tmp/trivy.tar.gz /tmp/trivy
-
-# Default to non-root execution
-USER runner
+RUN apk add --no-cache \
+	bash \
+	ca-certificates \
+	curl \
+	git \
+	jq \
+	make \
+	openssh-client \
+	python3 \
+	py3-pip \
+	rsync \
+	unzip \
+	yq \
+	zip

ansible/files/dockerfiles/linux-runners/Dockerfile.cpp-build

@@ -1,11 +1,20 @@
 FROM local/gitea-runner-base:latest
 
-# Base image sets USER runner; switch back to root for package installs
+# cpp-build runner profile: dedicated C/C++ build environment.
 USER root
-RUN apt-get update && apt-get install -y --no-install-recommends \
-	build-essential \
+RUN apk add --no-cache \
+	bash \
+	build-base \
+	ca-certificates \
 	cmake \
-	&& rm -rf /var/lib/apt/lists/*
-
-# Default to non-root execution
-USER runner
+	curl \
+	git \
+	jq \
+	make \
+	openssh-client \
+	python3 \
+	py3-pip \
+	rsync \
+	unzip \
+	yq \
+	zip

ansible/files/dockerfiles/linux-runners/Dockerfile.gitea-runner-base

@@ -1,38 +1,13 @@
-# Stage 1: Extract the gitea-runner binary from the official Alpine-based image
-FROM docker.io/gitea/runner:latest AS runner
+FROM docker.io/gitea/runner:latest
 
-# Stage 2: Debian-based image with native glibc support
-FROM debian:bookworm-slim
+USER root
 
-COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
-COPY --from=runner /usr/local/bin/run.sh /usr/local/bin/run.sh
-RUN chmod +x /usr/local/bin/run.sh
-
-ENTRYPOINT ["/usr/local/bin/run.sh"]
-
-# Create dedicated runner user (UID 1000) for non-root container execution
-RUN groupadd -g 1000 runner && \
-    useradd -u 1000 -g 1000 -m -d /home/runner -s /bin/bash runner
-
-# Install runner tooling
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apk add --no-cache \
     bash \
     ca-certificates \
     curl \
     git \
     jq \
-    make \
-    nodejs \
     openssh-client \
-    python3 \
-    python3-pip \
-    rsync \
     unzip \
-    zip \
-    && rm -rf /var/lib/apt/lists/*
-
-# Set work directory
-ENV RUNNER_WORKDIR=/home/runner
-
-# Ensure container runs as non-root by default
-USER runner
+    zip

ansible/files/dockerfiles/linux-runners/Dockerfile.go-build

@@ -1,10 +1,19 @@
 FROM local/gitea-runner-base:latest
 
-# Base image sets USER runner; switch back to root for package installs
+# go-build runner profile: dedicated Go build environment.
 USER root
-RUN apt-get update && apt-get install -y --no-install-recommends \
-	golang-go \
-	&& rm -rf /var/lib/apt/lists/*
-
-# Default to non-root execution
-USER runner
+RUN apk add --no-cache \
+	bash \
+	ca-certificates \
+	curl \
+	git \
+	go \
+	jq \
+	make \
+	openssh-client \
+	python3 \
+	py3-pip \
+	rsync \
+	unzip \
+	yq \
+	zip

ansible/files/dockerfiles/linux-runners/Dockerfile.image-build

@@ -0,0 +1,32 @@
+FROM local/gitea-runner-base:latest
+
+# image-build runner profile: dedicated environment for container image builds.
+USER root
+RUN apk add --no-cache \
+	bash \
+	buildah \
+	ca-certificates \
+	curl \
+	fuse-overlayfs \
+	git \
+	iptables \
+	jq \
+	make \
+	openssh-client \
+	podman \
+	python3 \
+	py3-pip \
+	rsync \
+	shadow-uidmap \
+	skopeo \
+	slirp4netns \
+	unzip \
+	yq \
+	zip
+
+RUN mkdir -p /etc/containers /var/lib/containers /run/containers && \
+	printf '%s\n' '[storage]' 'driver = "vfs"' > /etc/containers/storage.conf && \
+	printf '%s\n' '[engine]' > /etc/containers/containers.conf
+
+ENV BUILDAH_ISOLATION=chroot
+ENV STORAGE_DRIVER=vfs

ansible/files/dockerfiles/linux-runners/Dockerfile.infra-tools

@@ -0,0 +1,28 @@
+FROM local/gitea-runner-base:latest
+
+# infra-tools runner profile: Ansible and infrastructure automation tools.
+USER root
+RUN apk add --no-cache \
+		bash \
+		ca-certificates \
+		curl \
+		git \
+		jq \
+		make \
+		openssh-client \
+		python3 \
+		py3-pip \
+		rsync \
+		unzip \
+		yq \
+		zip && \
+		python3 -m venv /opt/infra-venv && \
+		/opt/infra-venv/bin/pip install --no-cache-dir \
+			ansible \
+			ansible-lint \
+			bcrypt \
+			fabric \
+			passlib \
+			pywinrm
+
+ENV PATH="/opt/infra-venv/bin:${PATH}"

ansible/files/dockerfiles/linux-runners/Dockerfile.security-scan

@@ -0,0 +1,25 @@
+FROM local/gitea-runner-base:latest
+
+# security-scan runner profile: image and dependency scanning tooling.
+USER root
+RUN apk add --no-cache \
+	bash \
+	ca-certificates \
+	curl \
+	git \
+	jq \
+	make \
+	openssh-client \
+	python3 \
+	py3-pip \
+	rsync \
+	unzip \
+	yq \
+	zip
+
+ARG TRIVY_VERSION=0.72.0
+RUN curl -fsSL -o /tmp/trivy.tar.gz \
+	"https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" && \
+	tar -xzf /tmp/trivy.tar.gz -C /tmp && \
+	install -m 0755 /tmp/trivy /usr/local/bin/trivy && \
+	rm -f /tmp/trivy.tar.gz /tmp/trivy

terraform/iac/scaleway/iam.tf

@@ -96,3 +96,25 @@ resource "scaleway_iam_api_key" "gitea_app_api" {
   application_id = scaleway_iam_application.gitea_app.id
   description    = "gitea access API key"
 }
+
+resource "scaleway_iam_application" "ci_app" {
+  name = "ci_app"
+}
+
+resource "scaleway_iam_policy" "registry_full_access" {
+  name           = "CI Registry full access policy"
+  description    = "Gives CI app full access to container registry in project"
+  application_id = scaleway_iam_application.ci_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "RegistryFullAccess",
+    ]
+  }
+}
+
+resource "scaleway_iam_api_key" "ci_app_api" {
+  application_id = scaleway_iam_application.ci_app.id
+  description    = "CI app API key for registry push"
+}

terraform/iac/scaleway/outputs.tf

@@ -49,3 +49,20 @@ output "gitea_bucket_name" {
   description = "The name of the Gitea bucket."
   value       = scaleway_object_bucket.gitea.name
 }
+
+output "registry_endpoint" {
+  description = "The endpoint of the a13labs container registry."
+  value       = scaleway_registry_namespace.a13labs.endpoint
+}
+
+output "ci_app_api_access_key" {
+  description = "The access key for the CI app API."
+  value       = scaleway_iam_api_key.ci_app_api.access_key
+  sensitive   = true
+}
+
+output "ci_app_api_secret_key" {
+  description = "The secret key for the CI app API."
+  value       = scaleway_iam_api_key.ci_app_api.secret_key
+  sensitive   = true
+}

terraform/iac/scaleway/registry.tf

@@ -1,5 +1,5 @@
 resource "scaleway_registry_namespace" "a13labs" {
   name        = "a13labs"
   description = "A13Labs container registry"
-  is_public   = false
+  is_public   = true
 }