Let's get this CICD to be stable again

Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>

.gitea/workflows/docker-build-base.yaml

@@ -34,14 +34,17 @@ defaults:
     shell: bash
 
 jobs:
-  startup-audit:
-    name: Base Workflow Startup Audit
+  publish-base:
+    name: Build and Publish CICD Base Image
     # Use ubuntu-act runner pool which is known to be available.
     runs-on: ubuntu-act
-    timeout-minutes: 5
+    timeout-minutes: 35
+    outputs:
+      base_hash: ${{ steps.base-state.outputs.base_hash }}
+      head_sha: ${{ steps.meta.outputs.head_sha }}
+
     steps:
       - name: Identify runner
-        shell: sh
         run: |
           echo "=== Runner Identity ==="
           echo "runner_name=${RUNNER_NAME:-}"
@@ -84,43 +87,29 @@ jobs:
           echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           echo "startup_audit=ok"
 
-      - name: Check control-plane reachability
-        shell: sh
+      - name: Preflight Docker and registry connectivity
+        env:
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          REGISTRY_USER: ${{ github.actor }}
         run: |
-          SERVER_URL="${GITHUB_SERVER_URL:-}"
-          if command -v curl >/dev/null 2>&1; then
-            if [ -n "${SERVER_URL}" ] && curl -fsS --connect-timeout 5 --max-time 10 "${SERVER_URL%/}/api/v1/version" >/tmp/gitea-version.json 2>/dev/null; then
-              echo "gitea_api_reachable=true"
-              cat /tmp/gitea-version.json || true
-            else
-              echo "gitea_api_reachable=false"
-            fi
-          else
-            echo "curl unavailable; skipping reachability check"
+          set -e
+          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
+            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
           fi
 
-  publish-base:
-    name: Build and Publish CICD Base Image
-    # Use ubuntu-act runner pool which is known to be available.
-    runs-on: ubuntu-act
-    needs: startup-audit
-    timeout-minutes: 35
-    outputs:
-      base_hash: ${{ steps.base-state.outputs.base_hash }}
-      head_sha: ${{ steps.meta.outputs.head_sha }}
+          echo "=== Docker Preflight ==="
+          command -v docker
+          docker --version
+          docker info >/tmp/docker-info.log 2>&1 || (echo "❌ docker info failed" && tail -n 40 /tmp/docker-info.log && exit 1)
+          grep -qi "${GITEA_REGISTRY}" /tmp/docker-info.log || echo "⚠ Registry not listed in docker info insecure registries: ${GITEA_REGISTRY}"
 
-    steps:
-      - name: Identify runner
-        run: |
-          echo "=== Runner Identity ==="
-          echo "runner_name=${RUNNER_NAME:-}"
-          echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
-          echo "runner_hostname_env=${HOSTNAME:-unknown}"
-          echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
-          echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
-          echo "runner_os=${RUNNER_OS:-unknown}"
-          echo "runner_arch=${RUNNER_ARCH:-unknown}"
-          echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          echo "=== Registry Login Preflight ==="
+          if [ -z "${PACKAGE_ACCESS_TOKEN}" ]; then
+            echo "❌ PACKAGE_ACCESS_TOKEN is empty"
+            exit 1
+          fi
+          echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin >/tmp/docker-login.log 2>&1 || (echo "❌ Registry login preflight failed" && tail -n 40 /tmp/docker-login.log && exit 1)
+          echo "registry_login_preflight=ok"
 
       - name: Audit trigger context
         env: