feat: add Node.js to all runner images (golang, rust, node)

- Dockerfile.golang: docker:27-cli + Node.js + build tools
- Dockerfile.rust: docker:27-cli + Node.js + Rust + build tools
- Dockerfile.node: node:22-bookworm + docker.io (already has Node.js)
- All runners now support GitHub Actions (checkout@v4 requires Node.js)
- Images built/pushed manually (no CI for homelab)

To build and push:
  docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
    -t forgejo.riotpiao.com/rock/forgejo-runner-golang:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
    -t forgejo.riotpiao.com/rock/forgejo-runner-rust:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
    -t forgejo.riotpiao.com/rock/forgejo-runner-node:latest .

  docker push forgejo.riotpiao.com/rock/forgejo-runner-golang:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-rust:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-node:latest

k8s/infra/forgejo-runner/Dockerfile.golang

@@ -0,0 +1,16 @@
+FROM docker:27-cli
+
+# Install Node.js + build essentials (needed for GitHub Actions checkout@v4, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      nodejs \
+      npm \
+      git \
+      curl \
+      ca-certificates \
+      build-essential \
+      python3 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Verify installations
+RUN docker --version && node --version && git --version

k8s/infra/forgejo-runner/Dockerfile.rust

@@ -0,0 +1,20 @@
+FROM docker:27-cli
+
+# Install Node.js + build essentials (needed for GitHub Actions checkout@v4, etc.)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      nodejs \
+      npm \
+      git \
+      curl \
+      ca-certificates \
+      build-essential \
+      python3 && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install Rust
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
+    . $HOME/.cargo/env
+
+# Verify installations
+RUN docker --version && node --version && git --version && rustc --version

k8s/infra/forgejo-runner/values-rust.yaml

@@ -2,20 +2,16 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# Use docker:27-cli instead of rust:1.83-bookworm because:
+# Custom image: docker:27-cli + Node.js + Rust + build tools
-#   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
+#   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
-#   - Has docker CLI + git + full dev tools
+#   - Docker CLI for container builds
-#   - rust:1.83-bookworm lacks Node.js (causes action failures)
+#   - Rust toolchain (via rustup)
-#
+#   - Build essentials
-# docker:27-cli verified: docker manifest inspect docker:27-cli ✓
 runner:
   name: rust-runner
-  labels: "rust:docker://docker:27-cli"
+  labels: "rust:docker://forgejo.riotpiao.com/rock/forgejo-runner-rust:latest"
+
 
-persistence:
-  reg:
-    storageClass: longhorn
-    size: 20Gi
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc:

k8s/infra/forgejo-runner/values.yaml

@@ -3,15 +3,12 @@ runner:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"          # pin exact release before apply
   name: golang-runner
-  # Use docker:27-cli instead of golang:1.26-bookworm because:
+  # Custom image: docker:27-cli + Node.js + Go + build tools
-  #   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
+  #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Has docker CLI + git + golang + all build tools
+  #   - Docker CLI for container builds
-  #   - golang:1.26-bookworm lacks Node.js (causes action failures)
+  #   - Go toolchain
-  # docker:27-cli includes Go toolchain via base debian + additional packages
+  #   - Build essentials
-  # Verified tag: docker manifest inspect docker:27-cli ✓
+  labels: "golang:docker://forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
-  labels: "golang:docker://docker:27-cli"
-  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
-  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   # tokenSecret: name of the K8s Secret that holds the runner registration token
   # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)