More CICD fixes

Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>

.gitea/workflows/docker-build-base.yaml

@@ -168,6 +168,7 @@ jobs:
 
   publish-base:
     name: Build and Publish CICD Base Image
+    # Heavy Docker build: schedule only on 8GB Pi runners.
     runs-on: ubuntu-act-8gb
     needs: registry-preflight
     outputs:

.gitea/workflows/docker-build-main.yaml

@@ -31,6 +31,7 @@ concurrency:
 jobs:
   build:
     name: Build and Push CICD Complete Image
+    # Heavy Docker build: schedule only on 8GB Pi runners.
     runs-on: ubuntu-act-8gb
     outputs:
       head_sha: ${{ steps.meta.outputs.head_sha }}

.gitea/workflows/renovate.yml

@@ -15,33 +15,10 @@ on:
 jobs:
   renovate:
     name: Renovate Dependencies
+    # Non-heavy workflow: allow any host exposing the generic ubuntu-act label.
     runs-on: ubuntu-act
 
     steps:
-      - name: Checkout repository
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
-        run: |
-          echo "=== Repository Checkout for Renovate ==="
-
-          # Set up SSH key securely
-          if [ -n "${SSH_PRIVATE_KEY}" ]; then
-            mkdir -p ~/.ssh
-            echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
-            chmod 600 ~/.ssh/id_rsa
-            ssh-keyscan -p 2222 kankali.darkhelm.lan >> ~/.ssh/known_hosts 2>/dev/null
-          fi
-
-          # Clone repository
-          GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no" \
-            git clone --depth 1 \
-            ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git .
-
-          # Clean up SSH key
-          rm -f ~/.ssh/id_rsa
-
-          echo "✓ Repository checked out for Renovate processing"
-
       - name: Setup Node.js for Renovate
         run: |
           echo "=== Setting up Node.js 24 for Renovate ==="