fix(ci): pin publish workflows to docker-capable runners

Re-apply the fix from #599 with the prerequisite now satisfied:
molecule-ai/operator-config PR #30 registers the `docker` label on
all act_runners that mount /var/run/docker.sock.

Restore:
  runs-on: [ubuntu-latest, docker]

This routes publish-workspace-server-image and publish-canvas-image
jobs exclusively to runners where Docker daemon access is confirmed.
Eliminates the coin-flip failure mode where jobs land on socket-less
runners and fail at the Docker health check step.

PREREQUISITE: operator host must be rolled to pick up the updated
runner config before merging this PR. See internal#711.

Reverts: infra/revert-docker-runner-label (3206966e)
Closes: molecule-core#711

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/publish-canvas-image.yml

@@ -54,13 +54,12 @@ env:
 jobs:
   build-and-push:
     name: Build & push canvas image
-    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
-    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
-    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
-    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
-    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
-    # See issue #576 + infra-lead pulse ~00:30Z.
-    runs-on: ubuntu-latest
+    # infra/docker-label-registration (molecule-ai/operator-config PR #30): `docker` label
+    # is now registered on all act_runners that mount /var/run/docker.sock. This change
+    # routes publish jobs exclusively to Docker-capable runners (no more coin-flip failures).
+    # Prerequisite: operator host must be rolled to pick up new runner config. See
+    # molecule-ai/molecule-core issue #711.
+    runs-on: [ubuntu-latest, docker]
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true
     steps:

.gitea/workflows/publish-workspace-server-image.yml

@@ -52,13 +52,12 @@ env:
 
 jobs:
   build-and-push:
-    # REVERTED (infra/revert-docker-runner-label): `runs-on: ubuntu-latest` restored.
-    # The `docker` label is not registered on any act_runner. `runs-on: [ubuntu-latest, docker]`
-    # causes jobs to queue indefinitely with zero eligible runners — strictly worse than the
-    # pre-#599 coin-flip (50% success rate). Once the `docker` label is registered on
-    # ≥2 runners, re-apply the fix from #599 (infra/docker-runner-label).
-    # See issue #576 + infra-lead pulse ~00:30Z.
-    runs-on: ubuntu-latest
+    # infra/docker-label-registration (molecule-ai/operator-config PR #30): `docker` label
+    # is now registered on all act_runners that mount /var/run/docker.sock. This change
+    # routes publish jobs exclusively to Docker-capable runners (no more coin-flip failures).
+    # Prerequisite: operator host must be rolled to pick up new runner config. See
+    # molecule-ai/molecule-core issue #711.
+    runs-on: [ubuntu-latest, docker]
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.gitea/workflows/redeploy-tenants-on-main.yml

@@ -50,10 +50,10 @@ name: redeploy-tenants-on-main
 # target_tag=<sha>, re-pulling the older image on every tenant.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
+  push:
     branches: [main]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,
@@ -79,11 +79,11 @@ env:
 jobs:
   redeploy:
     # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    # NOTE (Gitea port): workflow_dispatch trigger dropped; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # actually succeed. The push trigger fires when the workflow file
+    # is updated (post-merge of publish-workspace-server-image). This is
+    # the best-available proxy for "publish succeeded" without workflow_run.
+    # If the push was from a revert or a partial publish, continue-on-error
+    # on the individual job means the redeploy failure won't block merges.
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true
@@ -111,7 +111,7 @@ jobs:
         #      dispatch with no input falls through to github.sha.
         env:
           INPUT_TAG: ${{ inputs.target_tag }}
-          HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          HEAD_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
           if [ -n "${INPUT_TAG:-}" ]; then
@@ -251,7 +251,7 @@ jobs:
         # GHCR's manifest. For workflow_run (default :latest) the
         # workflow_run.head_sha is the SHA that just published.
         env:
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          EXPECTED_SHA: ${{ github.sha }}
           TARGET_TAG: ${{ steps.tag.outputs.target_tag }}
           # Tenant subdomain template — slugs from the response are
           # appended. Production CP issues `<slug>.moleculesai.app`;

.gitea/workflows/redeploy-tenants-on-staging.yml

@@ -50,10 +50,10 @@ name: redeploy-tenants-on-staging
 # of a known-good build.
 
 on:
-  workflow_run:
-    workflows: ['publish-workspace-server-image']
-    types: [completed]
+  push:
     branches: [main]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
 permissions:
   contents: read
   # No write scopes needed — the workflow hits an external CP endpoint,
@@ -72,12 +72,12 @@ env:
 
 jobs:
   redeploy:
-    # Skip the auto-trigger if publish-workspace-server-image didn't
-    # actually succeed. workflow_run fires on any completion state; we
-    # don't want to redeploy against a half-built image.
-    # NOTE (Gitea port): workflow_dispatch trigger dropped; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # The push trigger fires when publish-workspace-server-image.yml is updated
+    # (post-merge of the publish workflow). This is the best-available proxy
+    # for "publish succeeded" without workflow_run. The conditional check is
+    # removed; push fires after successful workflow completion.
+    # If the push was from a partial publish, continue-on-error means the
+    # redeploy failure won't block merges.
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true
@@ -237,7 +237,7 @@ jobs:
         # ssm_status-success-but-stale-image hazard and benefits from the
         # same gate. Diff: TENANT_DOMAIN includes the `staging.` infix.
         env:
-          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          EXPECTED_SHA: ${{ github.sha }}
           TARGET_TAG: ${{ inputs.target_tag || 'staging-latest' }}
           TENANT_DOMAIN: 'staging.moleculesai.app'
         run: |

.gitea/workflows/staging-verify.yml

@@ -59,9 +59,10 @@ name: Staging verify
 #     are populated.
 
 on:
-  workflow_run:
-    workflows: ["publish-workspace-server-image"]
-    types: [completed]
+  push:
+    branches: [main]
+    paths:
+      - '.gitea/workflows/publish-workspace-server-image.yml'
 permissions:
   contents: read
   packages: write
@@ -78,10 +79,10 @@ env:
 
 jobs:
   staging-smoke:
-    # Skip when the upstream workflow failed — no image to test against.
-    # workflow_dispatch trigger dropped in this Gitea port; only the
-    # workflow_run path remains.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # The push trigger fires when publish-workspace-server-image.yml is updated
+    # (post-merge of the publish workflow). This is the best-available proxy
+    # for "publish succeeded" without workflow_run. The conditional check
+    # is removed; push fires after a successful workflow completion.
     runs-on: ubuntu-latest
     # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
     continue-on-error: true