deploy: use prebaked nas-deploy image; remove apt-get step

Reviewed-on: #156

.gitea/workflows/anno-apply-pr.yml

@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   apply-approved:
-    runs-on: ubuntu-latest
+    runs-on: mac-ci
     container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 

.gitea/workflows/anno-reject.yml

@@ -1,8 +1,13 @@
-name: Anno Reject
+name: Anno Reject (close issue)
 
 on:
   issues:
     types: [labeled]
+  workflow_dispatch:
+    inputs:
+      issue:
+        description: "Issue number to reject/close"
+        required: true
 
 env:
   NODE_OPTIONS: --dns-result-order=ipv4first
@@ -11,14 +16,26 @@ defaults:
   run:
     shell: bash
 
+concurrency:
+  group: anno-reject-${{ github.event.issue.number || inputs.issue || 'manual' }}
+  cancel-in-progress: true
+
 jobs:
   reject:
-    runs-on: ubuntu-latest
+    runs-on: mac-ci
     container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 
     steps:
-      - name: Derive context
+      - name: Tools sanity
+        run: |
+          set -euo pipefail
+          node --version
+
+      - name: Derive context (event.json / workflow_dispatch)
+        env:
+          INPUT_ISSUE: ${{ inputs.issue }}
+          FORGE_API: ${{ vars.FORGE_API || vars.FORGE_BASE }}
         run: |
           set -euo pipefail
           export EVENT_JSON="/var/run/act/workflow/event.json"
@@ -29,59 +46,115 @@ jobs:
 
           const ev = JSON.parse(fs.readFileSync(process.env.EVENT_JSON, "utf8"));
           const repoObj = ev?.repository || {};
+
           const cloneUrl =
             repoObj?.clone_url ||
             (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-          if (!cloneUrl) throw new Error("No repository url");
 
           let owner =
             repoObj?.owner?.login ||
             repoObj?.owner?.username ||
             (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
+
           let repo =
             repoObj?.name ||
             (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
 
-          if (!owner || !repo) {
+          if ((!owner || !repo) && cloneUrl) {
             const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
             if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
           }
           if (!owner || !repo) throw new Error("Cannot infer owner/repo");
 
-          const issueNumber = ev?.issue?.number || ev?.issue?.index;
-          if (!issueNumber) throw new Error("No issue number");
+          const issueNumber =
+            ev?.issue?.number ||
+            ev?.issue?.index ||
+            (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
 
-          const labelName = ev?.label?.name || ev?.label || "";
-          const u = new URL(cloneUrl);
+          if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
+            throw new Error("No issue number in event.json or workflow_dispatch input");
+          }
+
+          const labelName =
+            ev?.label?.name ||
+            ev?.label ||
+            "workflow_dispatch";
+
+          let apiBase = "";
+          if (process.env.FORGE_API && String(process.env.FORGE_API).trim()) {
+            apiBase = String(process.env.FORGE_API).trim().replace(/\/+$/,"");
+          } else if (cloneUrl) {
+            apiBase = new URL(cloneUrl).origin;
+          } else {
+            apiBase = "";
+          }
 
           function sh(s){ return JSON.stringify(String(s)); }
+
           process.stdout.write([
             `OWNER=${sh(owner)}`,
             `REPO=${sh(repo)}`,
             `ISSUE_NUMBER=${sh(issueNumber)}`,
             `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(u.origin)}`
+            `API_BASE=${sh(apiBase)}`
           ].join("\n") + "\n");
           NODE
 
-      - name: Gate on label state/rejected
+          echo "✅ context:"
+          sed -n '1,120p' /tmp/reject.env
+
+      - name: Gate on label state/rejected only
         run: |
           set -euo pipefail
           source /tmp/reject.env
-          if [[ "$LABEL_NAME" != "state/rejected" ]]; then
+
+          if [[ "$LABEL_NAME" != "state/rejected" && "$LABEL_NAME" != "workflow_dispatch" ]]; then
             echo "ℹ️ label=$LABEL_NAME => skip"
+            echo "SKIP=1" >> /tmp/reject.env
             exit 0
           fi
-          echo "✅ reject issue=$ISSUE_NUMBER"
+          echo "✅ proceed (issue=$ISSUE_NUMBER)"
 
-      - name: Comment + close issue
+      - name: Comment + close (only if not conflicting with state/approved)
         env:
           FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
         run: |
           set -euo pipefail
           source /tmp/reject.env
-          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
+          [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
+          test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
+          test -n "${API_BASE:-}" || { echo "❌ Missing API_BASE"; exit 1; }
+
+          ISSUE_JSON="$(curl -fsS \
+            -H "Authorization: token $FORGE_TOKEN" \
+            -H "Accept: application/json" \
+            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER")"
+
+          # conflict guard: approved + rejected => do nothing, comment warning
+          node --input-type=module - <<'NODE' "$ISSUE_JSON" > /tmp/reject.flags
+          const issue = JSON.parse(process.argv[1] || "{}");
+          const labels = Array.isArray(issue.labels) ? issue.labels.map(l => String(l.name || "")).filter(Boolean) : [];
+          const hasApproved = labels.includes("state/approved");
+          const hasRejected = labels.includes("state/rejected");
+          process.stdout.write(`HAS_APPROVED=${hasApproved ? "1":"0"}\nHAS_REJECTED=${hasRejected ? "1":"0"}\n`);
+          NODE
+
+          source /tmp/reject.flags
+
+          if [[ "${HAS_APPROVED:-0}" == "1" && "${HAS_REJECTED:-0}" == "1" ]]; then
+            MSG="⚠️ Conflit d'état sur le ticket #${ISSUE_NUMBER} : labels **state/approved** et **state/rejected** présents.\n\n➡️ Action manuelle requise : retirer l'un des deux labels avant relance."
+            PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
+            curl -fsS -X POST \
+              -H "Authorization: token $FORGE_TOKEN" \
+              -H "Content-Type: application/json" \
+              "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
+              --data-binary "$PAYLOAD"
+            echo "ℹ️ conflict => stop"
+            exit 0
+          fi
+
+          # comment reject
           MSG="❌ Ticket #${ISSUE_NUMBER} refusé (label state/rejected)."
           PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
 
@@ -91,8 +164,11 @@ jobs:
             "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
             --data-binary "$PAYLOAD"
 
+          # close issue
           curl -fsS -X PATCH \
             -H "Authorization: token $FORGE_TOKEN" \
             -H "Content-Type: application/json" \
             "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
-            --data-binary '{"state":"closed"}'
+            --data-binary '{"state":"closed"}'
+
+          echo "✅ rejected+closed"

.gitea/workflows/auto-label-issues.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   label:
-    runs-on: ubuntu-latest
+    runs-on: mac-ci
     steps:
       - name: Apply labels from Type/State/Category
         env:

.gitea/workflows/ci.yaml

@@ -3,7 +3,7 @@ name: CI
 on:
   push:
   pull_request:
-    branches: [master]
+    branches: [main]
   workflow_dispatch:
 
 env:
@@ -15,7 +15,7 @@ defaults:
 
 jobs:
   build-and-anchors:
-    runs-on: ubuntu-latest
+    runs-on: mac-ci
     container:
       image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
 

.gitea/workflows/deploy-staging-live.yml

@@ -26,9 +26,9 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: nas-deploy
     container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
+      image: localhost:5000/archicratie/nas-deploy-node22:2026-02-28-1
 
     steps:
       - name: Tools sanity
@@ -127,25 +127,17 @@ jobs:
             echo "ℹ️ no annotations/media change -> skip deploy"
           fi
 
-      - name: Install docker client + docker compose plugin (v2) + python yaml
+      - name: Toolchain sanity + resolve COMPOSE_PROJECT_NAME
         run: |
           set -euo pipefail
           source /tmp/deploy.env
           [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          apt-get -o Acquire::Retries=5 -o Acquire::ForceIPv4=true update
-          apt-get install -y --no-install-recommends ca-certificates curl docker.io python3 python3-yaml
-          rm -rf /var/lib/apt/lists/*
-
-          mkdir -p /usr/local/lib/docker/cli-plugins
-          curl -fsSL \
-            "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64" \
-            -o /usr/local/lib/docker/cli-plugins/docker-compose
-          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
-
+          # tools are prebaked in the image
+          git --version
           docker version
           docker compose version
-          python3 --version
+          python3 -c 'import yaml; print("PyYAML OK")'
 
           # Reuse existing compose project name if containers already exist
           PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"

.gitea/workflows/smoke.yml

@@ -3,7 +3,7 @@ on: [push, workflow_dispatch]
 
 jobs:
   smoke:
-    runs-on: ubuntu-latest
+    runs-on: mac-ci
     steps:
       - run: node -v && npm -v
       - run: echo "runner OK"