Fix build_cicd function scope and Renovate DNS fallback

.gitea/workflows/cicd.yaml

@@ -238,6 +238,27 @@ jobs:
             rm -f "${headers_file}"
           }
 
+          ensure_registry_auth_realm_host() {
+            if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
+              echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
+            fi
+
+            headers_file="$(mktemp)"
+            if curl -sSI "http://${GITEA_REGISTRY}/v2/" >"${headers_file}"; then
+              realm_url="$(sed -n 's/.*realm="\([^"]*\)".*/\1/p' "${headers_file}" | head -n 1)"
+              if [ -n "${realm_url}" ]; then
+                realm_host="$(printf '%s' "${realm_url}" | sed -E 's#^https?://([^/:]+).*$#\1#')"
+                if [ -n "${realm_host}" ] && [ "${realm_host}" != "${GITEA_REGISTRY_HOST}" ]; then
+                  if ! grep -q "${realm_host}" /etc/hosts; then
+                    echo "${GITEA_REGISTRY_IP} ${realm_host}" >> /etc/hosts
+                    echo "Pinned registry auth realm host: ${realm_host} -> ${GITEA_REGISTRY_IP}"
+                  fi
+                fi
+              fi
+            fi
+            rm -f "${headers_file}"
+          }
+
           if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
             echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
           fi

.gitea/workflows/renovate.yml

@@ -73,6 +73,7 @@ jobs:
           RENOVATE_DRY_RUN: ${{ inputs.dry_run }}
           RENOVATE_PLATFORM: gitea
           RENOVATE_ENDPOINT: https://kankali.darkhelm.lan
+          RENOVATE_ENDPOINT_IP: 10.18.75.2
           RENOVATE_ALLOW_INSECURE_TLS: "true"
           RENOVATE_GIT_AUTHOR: Renovate Bot <renovate@darkhelm.org>
           RENOVATE_ONBOARDING: "false"
@@ -101,6 +102,13 @@ jobs:
 
           ENDPOINT_HOST="$(printf '%s' "${RENOVATE_ENDPOINT_EFFECTIVE}" | sed -E 's#^https?://([^/]+).*$#\1#')"
           ENDPOINT_IP="$(getent hosts "${ENDPOINT_HOST}" | awk '{print $1; exit}' || true)"
+          if [ -z "${ENDPOINT_IP}" ] && [ -n "${RENOVATE_ENDPOINT_IP:-}" ]; then
+            ENDPOINT_IP="${RENOVATE_ENDPOINT_IP}"
+            echo "Using configured Renovate endpoint IP fallback: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
+            if ! grep -q "${ENDPOINT_HOST}" /etc/hosts; then
+              echo "${ENDPOINT_IP} ${ENDPOINT_HOST}" >> /etc/hosts
+            fi
+          fi
           DOCKER_ADD_HOST_ARG=""
           if [ -n "${ENDPOINT_IP}" ]; then
             DOCKER_ADD_HOST_ARG="--add-host ${ENDPOINT_HOST}:${ENDPOINT_IP}"