Fix CI/CD: full runner config, shell-only workflow, config mount fix

- Replace all GitHub action clones (login-action, build-push-action)
  with plain docker CLI commands — eliminates GitHub dependency
- Expand act_runner_config.yaml to full format (partial config was
  silently falling back to defaults)
- Mount config at /etc/act_runner/ with CONFIG_FILE env var to avoid
  named volume shadowing at /data/

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -16,29 +16,23 @@ jobs:
           token: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Login to Gitea Container Registry
-        uses: https://github.com/docker/login-action@v3
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ vars.REGISTRY_HOST }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
-        with:
-          registry: ${{ vars.REGISTRY_HOST }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push backend
-        uses: https://github.com/docker/build-push-action@v5
+        run: |
-        with:
+          docker build -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest \
-          context: ./backend
+                       -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:${{ github.sha }} \
-          push: true
+                       ./backend
-          tags: |
+          docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest
-            ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest
+          docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:${{ github.sha }}
-            ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:${{ github.sha }}
 
       - name: Build and push frontend
-        uses: https://github.com/docker/build-push-action@v5
+        run: |
-        with:
+          docker build -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest \
-          context: ./frontend
+                       -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:${{ github.sha }} \
-          push: true
+                       ./frontend
-          tags: |
+          docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest
-            ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest
+          docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:${{ github.sha }}
-            ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:${{ github.sha }}
 
       - name: Pull new images
         run: |

act_runner_config.yaml

@@ -1,4 +1,20 @@
+log:
+  level: info
+
+runner:
+  capacity: 1
+  timeout: 3h
+  insecure: false
+
+cache:
+  enabled: false
+
 container:
   network: host
   privileged: false
   options: "--security-opt label:disable"
+  valid_volumes:
+    - "**"
+
+host:
+  workdir_parent: /tmp/act_runner

docker-compose.yaml

@@ -72,8 +72,9 @@ services:
     volumes:
       - act_runner_data:/data
       - /var/run/docker.sock:/var/run/docker.sock
-      - ./act_runner_config.yaml:/data/config.yaml:ro
+      - ./act_runner_config.yaml:/etc/act_runner/config.yaml:ro
     environment:
+      - CONFIG_FILE=/etc/act_runner/config.yaml
       - GITEA_INSTANCE_URL=https://git.sentinelforest.xyz
       - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
       - GITEA_RUNNER_NAME=umbra-runner