DSH Agent
0dcf760f13
Build and release image / build (push) Successful in 9s
Neither was visible without running the workflows for real. ## dependency-check: the report never ran `rust:1.95-bookworm` has no Node, so every run died on `exec: node: not found` before producing anything. The report needs cargo to resolve the workspace graph and Node to read four HTTP APIs and compare semantic versions — the rust image has one, the node image has the other. `.gitea/scripts/ci.Dockerfile` layers the two together, copying Node's binaries from the official image rather than adding a third-party apt repository: no extra signing key, no extra network dependency mid-build. The check now builds that image on its own pinned Rust version. Writing the parsing twice, once per language, was the alternative. It would have been two places for the pre-1.0 semver rule to drift apart. ## release: the smoke test asserted a file that shouldn't exist It required `push-state.json`, which a fresh boot does not create: `vault.json` and `push-state.json` are written when there is something to store, and a brand-new install has no accounts. The container was healthy the whole time — the assertion was simply wrong about what a first run leaves behind. It now checks the binary reports the tagged version (which is the check that actually matters, since it catches a tag pushed without a version bump) and that `vault.key` was created non-empty, which is the honest proof that the entrypoint's chown made the volume writable by the service user. Also serializes image builds across refs: a tag push and a main push can land together and both want to move the same `:latest`.