merge build+scan+report into single job, drop artifacts

actions/upload-artifact@v4 doesn't work on Gitea (GHES error).
No need for multi-job — all steps share the same Docker socket
so local/name:build images are visible throughout. Single
build-scan-report job: build → push → scan → report.

Zero GitHub Actions used in the Gitea backend now:
- crane for daemonless push
- trivy binary for local image scan
- uv via install script
- plain docker build via socket

.gitea/workflows/deploy.yml

@@ -8,14 +8,12 @@ on:
     branches: [main]
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-
-
       - name: Install crane
         run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
 
@@ -24,6 +22,14 @@ jobs:
         env:
           CRANE_INSECURE: "true"
 
+      - name: Install trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Set up uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+        env:
+          UV_INSTALL_DIR: /usr/local/bin
+
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
@@ -72,16 +78,6 @@ jobs:
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure
 
-  scan:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-
       - name: Scan notebooks
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
 
@@ -94,29 +90,6 @@ jobs:
       - name: Scan api
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
 
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans
-          path: "*-scan.json"
-
-  report-vulns:
-    runs-on: ubuntu-latest
-    needs: scan
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Set up uv
-        run: curl -LsSf https://astral.sh/uv/install.sh | sh
-        env:
-          UV_INSTALL_DIR: /usr/local/bin
-
-      - name: Download scan results
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: trivy-scans
-
       - name: Report vulnerabilities
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}

.gitea/workflows/harden.yml

@@ -9,14 +9,12 @@ on:
     - cron: "0 2 * * 0"
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-
-
       - name: Install crane
         run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
 
@@ -25,6 +23,14 @@ jobs:
         env:
           CRANE_INSECURE: "true"
 
+      - name: Install trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Set up uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+        env:
+          UV_INSTALL_DIR: /usr/local/bin
+
       - name: Build notebooks
         run: docker build --no-cache -f notebooks/Dockerfile -t local/notebooks:build notebooks/
 
@@ -70,16 +76,6 @@ jobs:
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:hardened --insecure
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure
 
-  scan:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-
       - name: Scan notebooks
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
 
@@ -92,29 +88,6 @@ jobs:
       - name: Scan api
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
 
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans-harden
-          path: "*-scan.json"
-
-  close-or-report-vulns:
-    runs-on: ubuntu-latest
-    needs: scan
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Set up uv
-        run: curl -LsSf https://astral.sh/uv/install.sh | sh
-        env:
-          UV_INSTALL_DIR: /usr/local/bin
-
-      - name: Download scan results
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: trivy-scans-harden
-
       - name: Close resolved or file new vuln issues
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}

.gitea/workflows/rebuild-all.yml

@@ -7,14 +7,12 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: https://github.com/actions/checkout@v4
 
-
-
       - name: Install crane
         run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
 
@@ -23,6 +21,14 @@ jobs:
         env:
           CRANE_INSECURE: "true"
 
+      - name: Install trivy
+        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Set up uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+        env:
+          UV_INSTALL_DIR: /usr/local/bin
+
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
@@ -71,16 +77,6 @@ jobs:
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
           crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure
 
-  scan:
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Install trivy
-        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
-
       - name: Scan notebooks
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
 
@@ -93,29 +89,6 @@ jobs:
       - name: Scan api
         run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
 
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans-rebuild
-          path: "*-scan.json"
-
-  report-vulns:
-    runs-on: ubuntu-latest
-    needs: scan
-    steps:
-      - name: Checkout
-        uses: https://github.com/actions/checkout@v4
-
-      - name: Set up uv
-        run: curl -LsSf https://astral.sh/uv/install.sh | sh
-        env:
-          UV_INSTALL_DIR: /usr/local/bin
-
-      - name: Download scan results
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: trivy-scans-rebuild
-
       - name: Report vulnerabilities
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}

dev/scripts/backends/gitea.py

@@ -98,23 +98,6 @@ def _trivy_step(
         run: trivy image --severity {sev} --exit-code {ec} --format json -o {name}-scan.json {local_tag}"""
 
 
-def _upload_artifact_step(name: str, path: str) -> str:
-    return f"""\
-      - name: Upload {name}
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: {name}
-          path: "{path}\""""
-
-
-def _download_artifact_step(name: str) -> str:
-    return f"""\
-      - name: Download {name}
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: {name}"""
-
-
 # ── Gitea-specific helpers ───────────────────────────────────────
 
 
@@ -206,49 +189,24 @@ on:
     branches: [main]
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: {runner}
     steps:
 {_checkout_step()}
 
-{_setup_buildx_step()}
-
 {_docker_login_step(registry)}
 
+{_install_trivy_step()}
+
+{_setup_uv_step(uv_version)}
+
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
 {build_block}
 
-  scan:
-    runs-on: {runner}
-    needs: build
-    steps:
-{_checkout_step()}
-
-{_install_trivy_step()}
-
 {scan_block}
 
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans
-          path: "*-scan.json"
-
-  report-vulns:
-    runs-on: {runner}
-    needs: scan
-    steps:
-{_checkout_step()}
-
-{_setup_uv_step(uv_version)}
-
-      - name: Download scan results
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: trivy-scans
-
       - name: Report vulnerabilities
         env:
           GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}
@@ -298,45 +256,20 @@ on:
     - cron: "0 2 * * 0"
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: {runner}
     steps:
 {_checkout_step()}
 
-{_setup_buildx_step()}
-
 {_docker_login_step(registry)}
 
-{build_block}
-
-  scan:
-    runs-on: {runner}
-    needs: build
-    steps:
-{_checkout_step()}
-
 {_install_trivy_step()}
 
-{scan_block}
-
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans-harden
-          path: "*-scan.json"
-
-  close-or-report-vulns:
-    runs-on: {runner}
-    needs: scan
-    steps:
-{_checkout_step()}
-
 {_setup_uv_step(uv_version)}
 
-      - name: Download scan results
+{build_block}
-        uses: https://github.com/actions/download-artifact@v4
+
-        with:
+{scan_block}
-          name: trivy-scans-harden
 
       - name: Close resolved or file new vuln issues
         env:
@@ -388,49 +321,24 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
+  build-scan-report:
     runs-on: {runner}
     steps:
 {_checkout_step()}
 
-{_setup_buildx_step()}
-
 {_docker_login_step(registry)}
 
+{_install_trivy_step()}
+
+{_setup_uv_step(uv_version)}
+
       - name: Compute short SHA
         run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
 
 {build_block}
 
-  scan:
-    runs-on: {runner}
-    needs: build
-    steps:
-{_checkout_step()}
-
-{_install_trivy_step()}
-
 {scan_block}
 
-      - name: Upload scan results
-        uses: https://github.com/actions/upload-artifact@v4
-        with:
-          name: trivy-scans-rebuild
-          path: "*-scan.json"
-
-  report-vulns:
-    runs-on: {runner}
-    needs: scan
-    steps:
-{_checkout_step()}
-
-{_setup_uv_step(uv_version)}
-
-      - name: Download scan results
-        uses: https://github.com/actions/download-artifact@v4
-        with:
-          name: trivy-scans-rebuild
-
       - name: Report vulnerabilities
         env:
           GITEA_TOKEN: ${{{{ secrets.GITEA_TOKEN }}}}