fix(ci): use docker pull (not manifest inspect) for base availability checks

.gitea/workflows/cicd-start.yaml

@@ -131,16 +131,17 @@ jobs:
           for i in 1 2 3; do
             echo "Base availability check ${i}/3 for ${BASE_REF_HASH}"
 
-            if timeout 30 docker manifest inspect "${BASE_REF_HASH}" >/dev/null 2>&1; then
+            # Manifest inspect is unreliable on some runners; use pull as truth.
-              echo "manifest_check=ok"
+            if timeout 60 docker pull "${BASE_REF_HASH}" >/dev/null 2>&1; then
+              echo "pull_check=ok"
               echo "Base rebuild needed: false"
               echo "base_needed=false" >> "$GITHUB_OUTPUT"
               exit 0
             fi
 
-            echo "manifest_check=missing_or_unreachable"
+            echo "pull_check=failed"
             if [ "${i}" -lt 3 ]; then
-              sleep 20
+              sleep 10
             fi
           done
 

.gitea/workflows/docker-build-base.yaml

@@ -258,14 +258,15 @@ jobs:
 
           for i in 1 2 3; do
             echo "Existing base check ${i}/3 for ${BASE_REF_HASH}..."
-            if timeout 30 docker manifest inspect "${BASE_REF_HASH}" >/dev/null 2>&1; then
+            # Manifest inspect is unreliable on some runners; use pull as truth.
-              echo "✓ Immutable base image tag already exists: ${BASE_REF_HASH}"
+            if timeout 60 docker pull "${BASE_REF_HASH}" >/dev/null 2>&1; then
+              echo "✓ Immutable base image already exists and is pullable: ${BASE_REF_HASH}"
               echo "needs_build=false" >> $GITHUB_OUTPUT
               exit 0
             fi
 
             if [ "${i}" -lt 3 ]; then
-              sleep 20
+              sleep 10
             fi
           done
 

.gitea/workflows/docker-build-main.yaml

@@ -120,8 +120,8 @@ jobs:
           BASE_IMAGE="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"
 
           verify_base_image() {
-            # Immutable tag existence is the source of truth; avoid label-based false negatives.
+            # Manifest inspect unreliable on these runners; use pull as truth.
-            timeout 30 docker manifest inspect "${BASE_IMAGE}" >/dev/null 2>&1
+            timeout 60 docker pull "${BASE_IMAGE}" >/dev/null 2>&1
           }
 
           max_attempts=12
@@ -140,9 +140,7 @@ jobs:
             sleep "${sleep_seconds}"
           done
 
-          # Optional warm-up pull for diagnostics only; build step remains authoritative.
+          echo "✓ Base image ready: ${BASE_IMAGE}"
-          timeout 60 docker pull "${BASE_IMAGE}" >/dev/null 2>&1 || \
-            echo "⚠ Warm-up pull failed; continuing to docker build for authoritative failure details"
 
           echo "${SSH_PRIVATE_KEY}" > /tmp/ssh_key
           chmod 600 /tmp/ssh_key