fix private pip installation and notification of healed build

.gitea/workflows/docker-publish.yml

@@ -1,5 +1,15 @@
 name: Reusable Docker Publish
 
+# Multi-arch (v1.9.0+): builds a manifest list for `platforms` (amd64 + arm64 by default) with
+# `docker buildx`, so the same tag runs on x86 servers and on the arm64 Raspberry Pi nodes with no
+# per-host changes. The Trivy gate is preserved by building the native amd64 image first with
+# --load, scanning that locally, and only then building + pushing the multi-arch manifest (the
+# amd64 layers are reused from cache, so only arm64 is newly built).
+#
+# Runner requirements (baked into the PipelineImage runner; the workflow also self-installs as a
+# fallback): the `docker buildx` plugin, and a build daemon that permits `--privileged` containers
+# so QEMU/binfmt can be registered for cross-building arm64 on an amd64 runner.
+
 on:
   workflow_call:
     inputs:
@@ -12,6 +22,11 @@ on:
       floating_tag:
         type: string
         default: "edge"
+      platforms:
+        # target platforms for the manifest list. Override to a single platform (e.g.
+        # "linux/amd64") for images that do not need to run on the arm64 nodes.
+        type: string
+        default: "linux/amd64,linux/arm64"
       run_image_scan:
         type: boolean
         default: true
@@ -23,8 +38,10 @@ on:
         # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
         # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
         # token is not baked into an image layer.
-        type: boolean
+        # Gitea 1.27.x does not reliably propagate boolean inputs through
-        default: false
+        # reusable workflows.  Callers pass the literal string "true".
+        type: string
+        default: "false"
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -34,11 +51,22 @@ on:
       NTFY_SERVER: { required: true }
       PIP_EXTRA_INDEX_URL: { required: false }
 
+# Pinned build tooling. Keep in sync with the ARGs in the PipelineImage Dockerfiles.
+# buildx: verify the binary against checksums.txt from the buildx GitHub release before bumping.
+# binfmt: pin by digest (tonistiigi/binfmt@sha256:...) for the strongest posture; the version tag
+# below is immutable enough for CI and avoids a Docker Hub token dance in the workflow.
+env:
+  BUILDX_VERSION: "0.36.1"
+  BUILDX_SHA256: "48af8a397ebd60178778bf63611dbcebe5f5e7a9be90eb9147b24b9587455778"
+  BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
+  TRIVY_VERSION: "0.74.0"
+  TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
+
 jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -51,36 +79,70 @@ jobs:
         id: vars
         shell: bash
         run: |
+          set -euo pipefail
           SHA_SHORT="$(git rev-parse --short HEAD)"
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
-          TAGS="-t ${FULL_IMAGE}:${SHA_SHORT}"
+
-          
+          # the SHA tag is always built; it is also the target Trivy scans before any push
+          PUSH_TAGS="-t ${FULL_IMAGE}:${SHA_SHORT} -t ${FULL_IMAGE}:${{ inputs.floating_tag }}"
+
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             VERSION="${{ gitea.ref_name }}"
             VERSION="${VERSION#v}"
             MAJOR="$(echo "$VERSION" | cut -d. -f1)"
             MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-            TAGS="${TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
+            PUSH_TAGS="${PUSH_TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
           fi
-          
+
-          echo "docker_tags=${TAGS}" >> "$GITEA_OUTPUT"
+          echo "scan_ref=${FULL_IMAGE}:${SHA_SHORT}" >> "$GITEA_OUTPUT"
+          echo "push_tags=${PUSH_TAGS}" >> "$GITEA_OUTPUT"
           echo "full_image=${FULL_IMAGE}" >> "$GITEA_OUTPUT"
 
       - name: Docker Login
         run: |
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
-      - name: Build image
+      - name: Set up Docker Buildx and QEMU
+        shell: bash
+        env:
+          PLATFORMS: ${{ inputs.platforms }}
+        run: |
+          set -euo pipefail
+
+          # Ensure the buildx plugin. Baked into the runner image (PipelineImage); this fallback
+          # covers older runners, mirroring the Trivy fallback below. Pinned + checksum-verified.
+          if ! docker buildx version >/dev/null 2>&1; then
+            echo "=== buildx not in runner image, installing v${BUILDX_VERSION} ==="
+            mkdir -p /usr/libexec/docker/cli-plugins
+            curl -sSfLo /usr/libexec/docker/cli-plugins/docker-buildx \
+              "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
+            echo "${BUILDX_SHA256}  /usr/libexec/docker/cli-plugins/docker-buildx" | sha256sum -c -
+            chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
+          fi
+          docker buildx version
+
+          # Register QEMU so this amd64 runner can cross-build the non-native platforms. binfmt is
+          # a kernel concern, so it cannot live in the runner image and is installed here against
+          # the build daemon (needs --privileged).
+          if echo "${PLATFORMS}" | grep -q 'arm'; then
+            echo "=== Registering QEMU emulators (${BINFMT_IMAGE}) ==="
+            docker run --privileged --rm "${BINFMT_IMAGE}" --install arm64
+          fi
+
+          # A docker-container builder is required for multi-platform output (the default docker
+          # driver builds a single platform only). Idempotent across re-runs on a warm runner.
+          docker buildx inspect multiarch >/dev/null 2>&1 || \
+            docker buildx create --name multiarch --driver docker-container --bootstrap
+          docker buildx use multiarch
+
+      - name: Build image for vulnerability scan
+        if: ${{ inputs.run_image_scan }}
         shell: bash
         env:
           PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
           set -euo pipefail
-          SHA_SHORT="$(git rev-parse --short HEAD)"
-          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
 
-          # optionally hand the private package index to the build as a BuildKit secret so the
-          # Dockerfile can install the in-house BB* packages without the token entering a layer
           SECRET_ARGS=""
           if [ "${{ inputs.use_private_index }}" = "true" ]; then
             if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
@@ -90,28 +152,17 @@ jobs:
             SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
           fi
 
-          DOCKER_BUILDKIT=1 docker build \
+          # native amd64 only, loaded into the local image store so Trivy can scan it before
+          # anything is pushed. The amd64 result is cached and reused by the multi-arch push.
+          # CVEs live in the base image and OS/Python packages, which are identical across arches,
+          # so scanning amd64 is a faithful gate for the whole manifest list.
+          DOCKER_BUILDKIT=1 docker buildx build \
+            --load \
+            --platform linux/amd64 \
             ${SECRET_ARGS} \
-            -t "${FULL_IMAGE}:${SHA_SHORT}" \
+            -t "${{ steps.vars.outputs.scan_ref }}" \
             ${{ inputs.dockerfile_path }}
 
-          # Floating tag points at the most recent build on any branch/tag, so
-          # the nightly image-security scan always has a stable target even
-          # before a release exists. ":latest" stays release-only (below).
-          docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${{ inputs.floating_tag }}"
-
-          if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
-            VERSION="${{ gitea.ref_name }}"
-            VERSION="${VERSION#v}"
-            MAJOR="$(echo "$VERSION" | cut -d. -f1)"
-            MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:latest"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${VERSION}"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MINOR}"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MAJOR}"
-          fi
-
       - name: Image Vulnerability Scan
         if: ${{ inputs.run_image_scan }}
         shell: bash
@@ -122,8 +173,6 @@ jobs:
           # checksum, never "latest": Trivy releases were compromised in the
           # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
           # with the ARGs in the PipelineImage Dockerfiles.
-          TRIVY_VERSION=0.71.0
-          TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
           if ! command -v trivy >/dev/null 2>&1; then
             echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
             curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -133,74 +182,73 @@ jobs:
           fi
           trivy --version
 
-          SHA_SHORT="$(git rev-parse --short HEAD)"
+          # Trivy's default vulnerability-DB source (mirror.gcr.io/aquasec/trivy-db) is a
-          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
+          # Google-hosted cache of the upstream GHCR image, used to dodge GHCR's unauthenticated
+          # rate limits. That cache occasionally 404s on a specific layer digest (a known,
+          # recurring upstream issue: aquasecurity/trivy). Point at the canonical GHCR source
+          # instead, and retry the DB download alone a few times — trivy exits 1 both for "DB
+          # download failed" and for "vulnerabilities found", so the download is a separate step
+          # from the scan to keep those two outcomes distinguishable.
+          export TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db:2"
+          export TRIVY_JAVA_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-java-db:1"
 
-          echo "=== Scanning ${FULL_IMAGE}:${SHA_SHORT} (fail on fixable ${{ inputs.scan_severity }}) ==="
+          echo "=== Ensuring vulnerability DB is up to date ==="
+          db_attempt=1
+          db_max_attempts=3
+          until trivy image --download-db-only; do
+            if [ "$db_attempt" -ge "$db_max_attempts" ]; then
+              echo "=== Failed to download the Trivy vulnerability DB after ${db_max_attempts} attempts ==="
+              exit 1
+            fi
+            echo "=== DB download failed, retrying (${db_attempt}/${db_max_attempts})... ==="
+            db_attempt=$((db_attempt + 1))
+            sleep $((db_attempt * 5))
+          done
+
+          echo "=== Scanning ${{ steps.vars.outputs.scan_ref }} (fail on fixable ${{ inputs.scan_severity }}) ==="
           trivy image \
             --exit-code 1 \
             --severity "${{ inputs.scan_severity }}" \
             --ignore-unfixed \
+            --skip-db-update \
             --scanners vuln,secret \
-            "${FULL_IMAGE}:${SHA_SHORT}"
+            "${{ steps.vars.outputs.scan_ref }}"
 
-      - name: Push image
+      - name: Build and push multi-arch image
         shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
           set -euxo pipefail
 
           echo "=== Git / Ref Info ==="
           git rev-parse HEAD
-          git rev-parse --short HEAD
           echo "gitea.ref=${{ gitea.ref }}"
           echo "gitea.ref_name=${{ gitea.ref_name }}"
+          echo "platforms=${{ inputs.platforms }}"
 
-          SHA_SHORT="$(git rev-parse --short HEAD)"
+          SECRET_ARGS=""
-          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
+            fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
 
-          echo "=== Image Info ==="
+          # one build produces every platform and pushes a manifest list per tag. The Trivy gate
-          echo "FULL_IMAGE=${FULL_IMAGE}"
+          # above already ran on the amd64 image these layers are reused from, so a scan failure
-          echo "SHA_SHORT=${SHA_SHORT}"
+          # aborts the job before this step. On a version tag this also pushes latest/major/minor.
-          echo "Expected image: ${FULL_IMAGE}:${SHA_SHORT}"
+          DOCKER_BUILDKIT=1 docker buildx build \
+            --push \
+            --platform "${{ inputs.platforms }}" \
+            ${SECRET_ARGS} \
+            ${{ steps.vars.outputs.push_tags }} \
+            ${{ inputs.dockerfile_path }}
 
-          echo "=== Local Docker Images ==="
+      - name: Verify pushed manifest
-          docker images | grep "${{ inputs.image_name }}" || true
+        shell: bash
-
+        run: |
-          echo "=== Inspect Image ==="
+          set -euo pipefail
-          docker image inspect "${FULL_IMAGE}:${SHA_SHORT}" >/dev/null
+          # confirm the pushed tag really is a multi-arch manifest list
-
+          docker buildx imagetools inspect "${{ steps.vars.outputs.scan_ref }}"
-          echo "=== Docker Auth Check ==="
-          docker info
-
-          echo "=== Push SHA tag ==="
-          docker push "${FULL_IMAGE}:${SHA_SHORT}"
-
-          echo "=== Push floating tag (${{ inputs.floating_tag }}) ==="
-          docker push "${FULL_IMAGE}:${{ inputs.floating_tag }}"
-
-          if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
-            echo "=== Version tag detected ==="
-
-            VERSION="${{ gitea.ref_name }}"
-            VERSION="${VERSION#v}"
-            MAJOR="$(echo "$VERSION" | cut -d. -f1)"
-            MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-
-            echo "VERSION=${VERSION}"
-            echo "MINOR=${MINOR}"
-            echo "MAJOR=${MAJOR}"
-
-            echo "=== Push latest ==="
-            docker push "${FULL_IMAGE}:latest"
-
-            echo "=== Push version ==="
-            docker push "${FULL_IMAGE}:${VERSION}"
-
-            echo "=== Push minor ==="
-            docker push "${FULL_IMAGE}:${MINOR}"
-
-            echo "=== Push major ==="
-            docker push "${FULL_IMAGE}:${MAJOR}"
-          else
-            echo "=== No version tag detected, only SHA tag pushed ==="
-          fi

.gitea/workflows/image-security-checks.yml

@@ -21,7 +21,7 @@ jobs:
   scan:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -48,8 +48,8 @@ jobs:
           # checksum, never "latest": Trivy releases were compromised in the
           # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
           # with the ARGs in the PipelineImage Dockerfiles.
-          TRIVY_VERSION=0.71.0
+          TRIVY_VERSION=0.74.0
-          TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
+          TRIVY_SHA256=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
           if ! command -v trivy >/dev/null 2>&1; then
             echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
             curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -61,10 +61,34 @@ jobs:
 
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
 
+          # Trivy's default vulnerability-DB source (mirror.gcr.io/aquasec/trivy-db) is a
+          # Google-hosted cache of the upstream GHCR image, used to dodge GHCR's unauthenticated
+          # rate limits. That cache occasionally 404s on a specific layer digest (a known,
+          # recurring upstream issue: aquasecurity/trivy). Point at the canonical GHCR source
+          # instead, and retry the DB download alone a few times — trivy exits 1 both for "DB
+          # download failed" and for "vulnerabilities found", so the download is a separate step
+          # from the scan to keep those two outcomes distinguishable.
+          export TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db:2"
+          export TRIVY_JAVA_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-java-db:1"
+
+          echo "=== Ensuring vulnerability DB is up to date ==="
+          db_attempt=1
+          db_max_attempts=3
+          until trivy image --download-db-only; do
+            if [ "$db_attempt" -ge "$db_max_attempts" ]; then
+              echo "=== Failed to download the Trivy vulnerability DB after ${db_max_attempts} attempts ==="
+              exit 1
+            fi
+            echo "=== DB download failed, retrying (${db_attempt}/${db_max_attempts})... ==="
+            db_attempt=$((db_attempt + 1))
+            sleep $((db_attempt * 5))
+          done
+
           echo "=== Scanning ${FULL_IMAGE} (fail on fixable ${{ inputs.scan_severity }}) ==="
           trivy image \
             --exit-code 1 \
             --severity "${{ inputs.scan_severity }}" \
             --ignore-unfixed \
+            --skip-db-update \
             --scanners vuln,secret \
             "${FULL_IMAGE}"

.gitea/workflows/notifications.yml

@@ -43,72 +43,76 @@ jobs:
           current_event = "${{ gitea.event_name }}"
           token = os.environ["API_GITEA_TOKEN"]
 
-          url = (
-              f"{server}/api/v1/repos/{repo}/actions/runs"
-              f"?page=1&limit=5"
-          )
-
-          print(f"Fetching workflow runs from: {url}")
           print(f"Current run number: {current_run_number}")
           print(f"Current branch: {current_branch}")
           print(f"Current event: {current_event}")
-
-          req = urllib.request.Request(
-              url,
-              headers={
-                  "Authorization": f"token {token}",
-                  "Accept": "application/json",
-              },
-          )
-
-          with urllib.request.urlopen(req) as response:
-              data = json.loads(response.read().decode("utf-8"))
-
-          runs = data.get("workflow_runs", [])
-
-          print(f"Received {len(runs)} workflow runs")
-
           previous = "unknown"
 
-          for run in runs:
+          # Scheduled runs can push the prior run for this branch/event beyond the
-              run_number = run.get("run_number")
+          # first page.  Scan a bounded history so a succeeding push after a failure
-              status = run.get("status")
+          # is still reported as healed.
-              conclusion = run.get("conclusion")
+          for page in range(1, 11):
-              branch = run.get("head_branch")
+              url = f"{server}/api/v1/repos/{repo}/actions/runs?page={page}&limit=100"
-              event = run.get("event")
+              print(f"Fetching workflow runs page {page}: {url}")
-
+              req = urllib.request.Request(
-              print(
+                  url,
-                  f"Inspecting run #{run_number}: "
+                  headers={
-                  f"status={status}, "
+                      "Authorization": f"token {token}",
-                  f"conclusion={conclusion}, "
+                      "Accept": "application/json",
-                  f"branch={branch}, "
+                  },
-                  f"event={event}"
               )
+              with urllib.request.urlopen(req) as response:
+                  data = json.loads(response.read().decode("utf-8"))
 
-              # aktuellen Run überspringen
+              runs = data.get("workflow_runs", [])
-              if int(run_number) == current_run_number:
+              if not isinstance(runs, list):
-                  print(" -> skipping current run")
+                  print("Received an invalid workflow-runs payload; stopping lookup.")
-                  continue
+                  break
+              print(f"Received {len(runs)} workflow runs on page {page}")
+              if not runs:
+                  break
 
-              # nur abgeschlossene Runs
+              for run in runs:
-              if status != "completed":
+                  run_number = run.get("run_number")
-                  print(" -> skipping non-completed run")
+                  status = run.get("status")
-                  continue
+                  conclusion = run.get("conclusion")
+                  branch = run.get("head_branch")
+                  event = run.get("event")
 
-              # nur gleicher Branch
+                  print(
-              if branch != current_branch:
+                      f"Inspecting run #{run_number}: "
-                  print(" -> skipping different branch")
+                      f"status={status}, "
-                  continue
+                      f"conclusion={conclusion}, "
+                      f"branch={branch}, "
+                      f"event={event}"
+                  )
 
-              # nur gleiches Event
+                  # aktuellen Run überspringen
-              if event != current_event:
+                  if str(run_number) == str(current_run_number):
-                  print(" -> skipping different event")
+                      print(" -> skipping current run")
-                  continue
+                      continue
 
-              previous = conclusion or "unknown"
+                  # nur abgeschlossene Runs
+                  if status != "completed":
+                      print(" -> skipping non-completed run")
+                      continue
 
-              print(f" -> selected previous conclusion: {previous}")
+                  # nur gleicher Branch
-              break
+                  if branch != current_branch:
+                      print(" -> skipping different branch")
+                      continue
+
+                  # nur gleiches Event
+                  if event != current_event:
+                      print(" -> skipping different event")
+                      continue
+
+                  previous = conclusion or "unknown"
+                  print(f" -> selected previous conclusion: {previous}")
+                  break
+
+              if previous != "unknown" or len(runs) < 100:
+                  break
 
           print(f"Previous conclusion final: {previous}")
 
@@ -170,4 +174,4 @@ jobs:
             -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" \
             -H "Content-Type: application/json" \
             -d @/tmp/ntfy-payload.json \
-            "${{ secrets.NTFY_SERVER }}"
+            "${{ secrets.NTFY_SERVER }}"

.gitea/workflows/python-checks.yml

@@ -22,14 +22,16 @@ on:
         type: boolean
         default: true
       use_private_index:
-        type: boolean
+        # Gitea 1.27.x does not reliably propagate boolean inputs through
-        default: false
+        # reusable workflows.  Keep this a string until that regression is fixed.
+        type: string
+        default: "false"
 
 jobs:
   check:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -38,15 +40,54 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Configure private package index
+      # Keep this step unconditional.  A Gitea Actions update can otherwise silently
-        if: ${{ inputs.use_private_index }}
+      # skip it when a boolean workflow_call input is not propagated as expected;
+      # pip then misleadingly reports that the private package does not exist.
+      - name: Configure and verify private package index
         env:
+          PRIVATE_INDEX_ENABLED: ${{ inputs.use_private_index }}
           PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
+          echo "Private package index requested: ${PRIVATE_INDEX_ENABLED:-<empty>}"
+          if [ "${PRIVATE_INDEX_ENABLED}" != "true" ]; then
+            echo "Private package index is not requested for this workflow call."
+            exit 0
+          fi
           if [ -z "$PRIVATE_INDEX_URL" ]; then
             echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
             exit 1
           fi
+
+          # Probe the configured simple index before pip resolves dependencies.  The
+          # probe deliberately prints only scheme/host/path, never URL credentials.
+          python - "$PRIVATE_INDEX_URL" <<'PY'
+          import base64
+          import sys
+          from urllib.error import HTTPError, URLError
+          from urllib.parse import unquote, urlsplit, urlunsplit
+          from urllib.request import Request, urlopen
+
+          configured_url = sys.argv[1]
+          parsed = urlsplit(configured_url)
+          hostname = parsed.hostname or "<missing host>"
+          port = f":{parsed.port}" if parsed.port else ""
+          safe_url = urlunsplit((parsed.scheme, f"{hostname}{port}", parsed.path, parsed.query, ""))
+          request = Request(safe_url, headers={"Accept": "application/vnd.pypi.simple.v1+json"})
+          if parsed.username is not None:
+              credentials = f"{unquote(parsed.username)}:{unquote(parsed.password or '')}".encode()
+              request.add_header("Authorization", "Basic " + base64.b64encode(credentials).decode())
+          try:
+              with urlopen(request, timeout=15) as response:  # nosec B310 -- configured CI package index
+                  print(f"Private package-index probe: HTTP {response.status} at {safe_url}")
+          except HTTPError as error:
+              print(f"Private package-index probe: HTTP {error.code} at {safe_url}")
+              if error.code in {401, 403}:
+                  print("Authentication was rejected by the private package index.")
+              raise SystemExit(1)
+          except URLError as error:
+              print(f"Private package-index probe could not reach {safe_url}: {error.reason}")
+              raise SystemExit(1)
+          PY
           pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
 
       - name: Install Tools & Deps
@@ -86,4 +127,4 @@ jobs:
         with:
           name: coverage-xml
           path: coverage.xml
-          if-no-files-found: warn
+          if-no-files-found: warn

.gitea/workflows/python-package-publish.yml

@@ -17,8 +17,10 @@ on:
         type: string
       use_private_index:
         # build backends that need the in-house BB* packages to resolve build dependencies
-        type: boolean
+        # Gitea 1.27.x does not reliably propagate boolean inputs through
-        default: false
+        # reusable workflows.  Callers pass the literal string "true".
+        type: string
+        default: "false"
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -30,7 +32,7 @@ jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}

.gitea/workflows/python-security-checks.yml

@@ -20,7 +20,7 @@ jobs:
   security:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.1.0
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}