fix(ci): pass immutable base hash to main build

.gitea/workflows/cicd-start.yaml

@@ -26,6 +26,7 @@ jobs:
     outputs:
       base_needed: ${{ steps.base-decision.outputs.base_needed }}
       head_sha: ${{ steps.base-decision.outputs.head_sha }}
+      base_hash: ${{ steps.base-decision.outputs.base_hash }}
 
     steps:
       - name: Audit trigger context
@@ -125,6 +126,7 @@ jobs:
           echo "Base ref: ${BASE_REF_HASH}"
 
           echo "head_sha=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
+          echo "base_hash=${BASE_HASH}" >> "$GITHUB_OUTPUT"
 
           for i in 1 2 3; do
             echo "Base availability check ${i}/3 for ${BASE_REF_HASH}"
@@ -162,6 +164,7 @@ jobs:
           DISPATCH_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN || secrets.PACKAGE_ACCESS_TOKEN }}
           BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
           HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
+          BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
           REPO_FULL: ${{ github.repository }}
           HEAD_REF: ${{ github.head_ref }}
           REF_NAME: ${{ github.ref_name }}
@@ -188,6 +191,7 @@ jobs:
             "ref": "${TARGET_REF}",
             "inputs": {
               "head_sha": "${HEAD_SHA}",
+              "base_hash": "${BASE_HASH}",
               "source_workflow": "CICD Start",
               "base_needed": "${BASE_NEEDED}"
             }

.gitea/workflows/docker-build-base.yaml

@@ -170,12 +170,22 @@ jobs:
     name: Build and Publish CICD Base Image
     runs-on: ubuntu-act-8gb
     needs: registry-preflight
+    outputs:
+      base_hash: ${{ steps.base-state.outputs.base_hash }}
+      head_sha: ${{ steps.meta.outputs.head_sha }}
 
     steps:
+      - name: Resolve head SHA
+        id: meta
+        env:
+          HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }}
+        run: |
+          echo "head_sha=${HEAD_SHA}" >> "$GITHUB_OUTPUT"
+
       - name: Minimal checkout for base inputs
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-          GITHUB_SHA: ${{ github.event.inputs.head_sha || github.sha }}
+          GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
         run: |
           umask 077
           trap 'rm -f ~/.ssh/id_rsa' EXIT
@@ -341,7 +351,8 @@ jobs:
       - name: Dispatch main build workflow
         env:
           DISPATCH_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN || secrets.PACKAGE_ACCESS_TOKEN }}
-          HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }}
+          HEAD_SHA: ${{ needs.publish-base.outputs.head_sha }}
+          BASE_HASH: ${{ needs.publish-base.outputs.base_hash }}
           REPO_FULL: ${{ github.repository }}
           HEAD_REF: ${{ github.head_ref }}
           REF_NAME: ${{ github.ref_name }}
@@ -367,6 +378,7 @@ jobs:
             "ref": "${TARGET_REF}",
             "inputs": {
               "head_sha": "${HEAD_SHA}",
+              "base_hash": "${BASE_HASH}",
               "source_workflow": "CICD Base Image",
               "base_needed": "true"
             }

.gitea/workflows/docker-build-main.yaml

@@ -6,6 +6,9 @@ on:
       head_sha:
         description: Commit SHA to process
         required: false
+      base_hash:
+        description: Immutable base hash to use for CICD base image
+        required: false
       source_workflow:
         description: Upstream workflow name
         required: false
@@ -39,6 +42,7 @@ jobs:
           SOURCE_WORKFLOW: ${{ github.event.inputs.source_workflow || 'manual' }}
           BASE_NEEDED: ${{ github.event.inputs.base_needed || 'false' }}
           HEAD_SHA: ${{ github.event.inputs.head_sha || github.sha }}
+          BASE_HASH_INPUT: ${{ github.event.inputs.base_hash || '' }}
           REF: ${{ github.ref }}
           REF_NAME: ${{ github.ref_name }}
           HEAD_REF: ${{ github.head_ref }}
@@ -48,6 +52,7 @@ jobs:
           echo "source_workflow=${SOURCE_WORKFLOW}"
           echo "base_needed=${BASE_NEEDED}"
           echo "head_sha=${HEAD_SHA}"
+          echo "base_hash_input=${BASE_HASH_INPUT}"
           echo "ref=${REF}"
           echo "ref_name=${REF_NAME}"
           echo "head_ref=${HEAD_REF}"
@@ -92,6 +97,7 @@ jobs:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
           HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
+          BASE_HASH_INPUT: ${{ github.event.inputs.base_hash || '' }}
         run: |
           set -e
           umask 077
@@ -103,7 +109,14 @@ jobs:
 
           echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
 
-          BASE_HASH=$(./scripts/compute-cicd-base-hash.sh)
+          if [ -n "${BASE_HASH_INPUT}" ]; then
+            BASE_HASH="${BASE_HASH_INPUT}"
+            echo "Using provided immutable base hash from upstream workflow dispatch: ${BASE_HASH}"
+          else
+            BASE_HASH=$(./scripts/compute-cicd-base-hash.sh)
+            echo "No base_hash input provided; computed base hash locally: ${BASE_HASH}"
+          fi
+
           BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
 
           verify_base_image() {
@@ -117,11 +130,12 @@ jobs:
             return 1
           }
 
-          max_attempts=220
-          sleep_seconds=30
+          max_attempts=12
+          sleep_seconds=10
           for i in $(seq 1 "${max_attempts}"); do
             echo "Base availability check ${i}/${max_attempts}..."
             if verify_base_image; then
+              echo "✓ Base image available and hash matched: ${BASE_IMAGE}"
               break
             fi