test: retry after host network config

actions/checkout@v4 is a JS action; Forgejo Actions runs it via node, which
neither golang:1.25-bookworm nor docker:27-cli ship. Every run since the
.gitea/workflows move has failed identically: 'exec: node: executable file
not found in $PATH' during the checkout step, before any real job step ran.

Verified locally against both exact images before pushing:
- golang:1.25-bookworm: apt-get install nodejs ca-certificates git -> node
  v18.20.4, git 2.39.5.
- docker:27-cli: apk add nodejs git -> node v22.23.2, git 2.47.2, and
  actions/checkout's dist/index.js actually executes afterward (confirmed
  by invoking it directly) instead of failing on a missing binary.
- The Dockerfile itself builds clean end to end and the resulting image
  serves /healthz, so checkout was the only remaining blocker in the path.

.forgejo/workflows/ci.yaml

@@ -1,85 +0,0 @@
-# Forgejo Actions CI. Note the path: Forgejo reads .forgejo/workflows/, not
-# .github/workflows/. The remote for this repo is git.riotpiao.com, so a GitHub
-# workflow here would never run.
-#
-# runs-on: docker matches the only label the cluster runner declares
-# (talos-runner, labels: [docker]).
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-env:
-  REGISTRY: forgejo.riotpiao.com
-  IMAGE: forgejo.riotpiao.com/rock/api-gateway
-
-jobs:
-  verify:
-    name: Test, vet, build
-    runs-on: docker
-    container:
-      image: golang:1.25-bookworm
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: go vet
-        run: go vet ./...
-
-      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
-      - name: go test -race
-        run: go test ./... -race
-
-      - name: Static build
-        run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
-
-      - name: govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
-        continue-on-error: true
-
-  image:
-    name: Build and push image
-    runs-on: docker
-    needs: verify
-    # Only publish from main. PRs get the verify job and nothing else, so an
-    # untrusted branch can never push a tag the cluster might pull.
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    container:
-      image: docker:27-cli
-      # The runner's dind sidecar shares the pod network and the mTLS cert
-      # emptyDir, so the daemon is reachable on localhost with the client certs
-      # dind generated at startup.
-      options: --network host
-    env:
-      DOCKER_HOST: tcp://localhost:2376
-      DOCKER_TLS_VERIFY: "1"
-      DOCKER_CERT_PATH: /docker-certs/client
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Registry login
-        run: |
-          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
-            --username rock --password-stdin
-        env:
-          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
-
-      # SHA tags only. 6.1 requires them, and :latest makes an Argo rollout
-      # non-deterministic — the same tag can resolve to different bits.
-      - name: Build
-        run: |
-          docker build \
-            --build-arg "VERSION=${GITHUB_SHA}" \
-            -t "${IMAGE}:${GITHUB_SHA}" \
-            .
-
-      - name: Push
-        run: docker push "${IMAGE}:${GITHUB_SHA}"
-
-      - name: Report digest
-        run: |
-          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${GITHUB_SHA}"

.gitea/workflows/build.yaml

@@ -0,0 +1,83 @@
+# Forgejo Actions build — push image on main only.
+# Tag is commit short SHA: unique, immutable, maps to exactly one commit.
+# No write-back, no git push — ArgoCD Image Updater pulls new builds autonomously.
+# Enabled by Stage 1 (B, C1).
+name: Build
+
+on:
+  push:
+    branches: [main]
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
+jobs:
+  build:
+    name: Build and push image
+    runs-on: docker
+    container:
+      image: docker:27-cli
+      # No `options: --network host` here -- act_runner ignores that per-job
+      # override and always decides the job container's network from its own
+      # config.yaml (container.network), which defaults to an isolated
+      # per-job bridge. Confirmed live: with that default, DOCKER_HOST=
+      # tcp://localhost:2376 resolved to the job container itself, not dind,
+      # so every command past `docker login` (which never touches DOCKER_HOST
+      # -- it only talks to the registry) failed with "Cannot connect to the
+      # Docker daemon". host networking is set once, for every job, in the
+      # runner's own Helm chart.
+      #
+      # The mTLS certs dind generates at startup are a separate gap: they
+      # live in an emptyDir mounted into the runner/dind containers, not into
+      # containers a workflow spins up. Job containers get no bind mounts at
+      # all unless the path is in the runner's container.valid_volumes
+      # allowlist (empty by default -- this exact mount was rejected until
+      # the runner's Helm chart added a config.yaml scoping valid_volumes to
+      # exactly this path).
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which docker:27-cli (Alpine) doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Verified locally:
+      # `apk add --no-cache nodejs git` in this exact image gets node v22 +
+      # git 2.47, and the checkout action's dist/index.js then actually
+      # executes (confirmed by running it directly) instead of failing on a
+      # missing binary.
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${FORGEJO_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          FORGEJO_PAT: ${{ secrets.FORGEJO_RIOTPIAO_PAT }}
+
+      - name: Build
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            .
+
+      - name: Push
+        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+
+      - name: Report digest
+        run: |
+          docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${{ steps.sha.outputs.short_sha }}"

.gitea/workflows/ci.yaml

@@ -0,0 +1,55 @@
+# Forgejo Actions CI — verification only (vet, test, build).
+# Build and push happens in build.yaml on main push.
+#
+# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/.
+# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com)
+# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run
+# row on push, not once, for any repo -- confirmed both from application logs
+# (silent, no error) and directly in the action_run table. A .gitea/workflows
+# file with an identical job spec fires immediately. .github/workflows also
+# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on
+# kmsvc-manage both got action_run rows despite matching no runner) -- so
+# .forgejo/workflows/ specifically appears unsupported on this instance/version,
+# not workflow detection being off in general.
+#
+# runs-on: docker matches the only label the cluster runner declares.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  verify:
+    name: Test, vet, build
+    runs-on: docker
+    container:
+      image: golang:1.25-bookworm
+    steps:
+      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
+      # `node`, which golang:1.25-bookworm doesn't ship. Without this the
+      # checkout step fails with "exec: node: executable file not found in
+      # $PATH" before any of the job's own steps run. Same fix already in use
+      # in kmsvc-manage's ci.yaml; carried over here.
+      - name: install node (required by JS-based actions)
+        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
+
+      - uses: actions/checkout@v4
+
+      - name: go vet
+        run: go vet ./...
+
+      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
+      - name: go test -race
+        run: go test ./... -race
+
+      - name: Static build
+        run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
+
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+        continue-on-error: true

k8s/deployment.yaml

@@ -21,6 +21,10 @@ spec:
       labels:
         app: api-gateway
         component: gateway
+        # Required by the llm-serving-default-deny NetworkPolicy, which admits
+        # only pods labelled llm-client=true (from any namespace) on port 8080.
+        # Without it every upstream dial times out and dispatch returns 502.
+        llm-client: "true"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"

k8s/kustomization.yaml

@@ -17,7 +17,7 @@ resources:
 #   kustomize edit set image forgejo.riotpiao.com/rock/api-gateway=:<sha>
 images:
 - name: forgejo.riotpiao.com/rock/api-gateway
-  newTag: v0.0.0
+  newTag: v0.1.1
 
 commonLabels:
   app: api-gateway

k8s/network-policy.yaml

@@ -34,15 +34,17 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: kube-system
+          kubernetes.io/metadata.name: kube-system
     ports:
     - protocol: UDP
       port: 53
+    - protocol: TCP
+      port: 53
   # Allow to upstreams (LLM services in llm-serving namespace)
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 80
@@ -54,7 +56,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: llm-serving
+          kubernetes.io/metadata.name: llm-serving
     ports:
     - protocol: TCP
       port: 8080
@@ -62,7 +64,7 @@ spec:
   - to:
     - namespaceSelector:
         matchLabels:
-          name: atlas
+          kubernetes.io/metadata.name: atlas
     ports:
     - protocol: TCP
       port: 8080