ci: run the jobs in the runner image (#120)

The workflows' containers are now lithosananke-runner:72b6cf370db1, built
and published by runner-image.yml, with everything init installs and Maven
already in it; the install steps are gone, except the documents' packages in
nightly-docs.yml and release.yml. The registry refuses anonymous pulls, so
each job pulls with PACKAGES_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/acceptance.yml

@@ -26,7 +26,10 @@ jobs:
     name: Acceptance
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
@@ -34,9 +37,6 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
-      - name: Install the build's dependencies
-        run: make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0
-
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64
       - name: Acceptance aarch64

.gitea/workflows/build.yml

@@ -16,7 +16,10 @@ jobs:
     name: Image ${{ matrix.board }}
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 45
     strategy:
       fail-fast: false
@@ -31,9 +34,6 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
-      - name: Install the build's dependencies
-        run: make ARCH=${{ matrix.arch }} init INIT_DOCS=0
-
       - name: Boot image
         run: make boot_image TARGET=${{ matrix.board }}
 
@@ -52,15 +52,15 @@ jobs:
     name: v4 tests (32- and 64-bit cells)
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: false
 
-      - name: Install the build's dependencies
-        run: make ARCH=amd64 init INIT_DOCS=0
-
       - name: make -C v4 test
         run: make -C v4 test

.gitea/workflows/nightly-docs.yml

@@ -19,7 +19,10 @@ jobs:
     name: Book, volumes, API reference
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
@@ -28,9 +31,7 @@ jobs:
           lfs: false
 
       - name: Install the documents' dependencies
-        run: |
-          make ARCH=amd64 init INIT_PROOFS=0
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless
+        run: make ARCH=amd64 init INIT_PROOFS=0   # the image has all but the documents' packages
 
       - name: Documents
         run: scripts/nightly.sh docs

.gitea/workflows/nightly.yml

@@ -25,7 +25,10 @@ jobs:
     name: Acceptance, proofs, images
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 150
     steps:
       - uses: actions/checkout@v4
@@ -33,11 +36,6 @@ jobs:
           fetch-depth: 0          # the SBOM's version is git describe
           lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
 
-      - name: Install the build's dependencies
-        run: |
-          make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless
-
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64
       - name: Acceptance aarch64

.gitea/workflows/release.yml

@@ -22,7 +22,10 @@ jobs:
     name: Release ${{ github.ref_name }}
     runs-on: ubuntu-latest
     container:
-      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:72b6cf370db1   # ci/runner-image (#120)
+      credentials:                # the registry refuses anonymous pulls
+        username: rajames
+        password: ${{ secrets.PACKAGES_TOKEN }}
     timeout-minutes: 240
     steps:
       - uses: actions/checkout@v4
@@ -38,9 +41,7 @@ jobs:
           echo "NIGHTLY_VERSION=${tree#v}" >> "$GITHUB_ENV"
 
       - name: Install the dependencies
-        run: |
-          make ARCH=amd64,aarch64,riscv64 init
-          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless
+        run: make ARCH=amd64,aarch64,riscv64 init   # the image has all but the documents' packages
 
       - name: Acceptance amd64
         run: scripts/nightly.sh accept amd64

.gitea/workflows/runner-image.yml

@@ -3,7 +3,8 @@
 #
 #   gitea.starshipos-f18.org/rajames/lithosananke-runner:<commit>
 #
-# The workflows name that tag as their container once it is published and has passed acceptance.
+# The workflows name that tag as their container. A new tag -- after a change to init in the
+# Makefile, or to the Dockerfile -- reaches them by a pull request, which acceptance runs on it.
 #
 # Needs the runner to give jobs its Docker daemon (act_runner config.yaml, container.docker_host:
 # automount), and a secret PACKAGES_TOKEN -- a token with write:package -- unless the Actions

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-11-07 — CI jobs start ready: the runner image
+
+The CI jobs now run in `lithosananke-runner` (`ci/runner-image`, #120), an image with everything
+`make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0` installs and Maven already in it, so they no
+longer install the toolchain at their start; only the document jobs still install the documents'
+packages. `runner-image.yml` builds and publishes it, tagged with its commit; the workflows name
+that tag, and a new one reaches them like any change: by a pull request that passed acceptance.
+
 ## 2026-11-06 — One process from developer to master: the acceptance gate, the nightlies to Nexus, one repository
 
 Every pull request into `master` now runs the acceptance protocol (`acceptance.yml`): the three