fix(ci): pin docker-build jobs to docker-capable runners

Fixes #576: publish-workspace-server-image / build-and-push red every run due to runner landing on non-docker-capable machine. Per gitea-operational-quirks.md §3: Hetzner act_runner containers register labels self-hosted + ubuntu-latest + docker. Only docker-labeled runners have /var/run/docker.sock mounted. The previous `runs-on: ubuntu-latest` coin-flipped between docker-capable and non-docker runners, causing Verify Docker daemon access to fail. Fix: runs-on: [self-hosted, docker] for both docker-build workflows: - publish-workspace-server-image.yml - publish-canvas-image.yml (also uses docker/build-push-action) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-11 23:14:17 +00:00
2 changed files with 12 additions and 2 deletions
@@ -54,7 +54,11 @@ env:
 jobs:
  build-and-push:
    name: Build & push canvas image
-    runs-on: ubuntu-latest
+    # Pin to docker-capable runners (self-hosted + docker label).
+    # Per gitea-operational-quirks.md §3: Hetzner act_runner containers
+    # register labels self-hosted + ubuntu-latest + docker. Only runners
+    # with docker label have /var/run/docker.sock mounted.
+    runs-on: [self-hosted, docker]
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    continue-on-error: true
    steps:
@@ -52,7 +52,13 @@ env:

 jobs:
  build-and-push:
-    runs-on: ubuntu-latest
+    # Pin to docker-capable runners (self-hosted + docker label).
+    # Per gitea-operational-quirks.md §3: Hetzner act_runner containers
+    # register labels self-hosted + ubuntu-latest + docker. Only runners
+    # with docker label have /var/run/docker.sock mounted. The previous
+    # `runs-on: ubuntu-latest` coin-flipped between docker-capable and
+    # non-docker runners, causing Verify Docker daemon access to fail.
+    runs-on: [self-hosted, docker]
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2