feat: switch CI to linux runner with podman containers

Replace ubuntu-latest runner with linux label and migrate all
container operations from docker to podman. Add requirements.txt
as single source of truth for runtime dependencies.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -6,38 +6,38 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - run: |
-        with:
+          podman run --rm \
-          python-version: '3.13'
+            -v "$PWD:/app:ro" \
-      - run: pip install pyyaml ruff pytest
+            -w /app \
-      - run: ruff check src/ tests/
+            python:3.13-alpine \
-      - run: PYTHONPATH=src pytest tests/ -v
+            sh -c "pip install --no-cache-dir -r requirements.txt ruff pytest && \
+                   ruff check src/ tests/ && \
+                   PYTHONPATH=src pytest tests/ -v"
 
   secrets:
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - run: |
-          docker run --rm \
+          podman run --rm \
             -v "$PWD:/scan:ro" \
             ghcr.io/gitleaks/gitleaks:latest \
             detect --source /scan -v
 
   build:
     needs: [test, secrets]
-    runs-on: ubuntu-latest
+    runs-on: linux
     steps:
       - uses: actions/checkout@v4
-      - run: |
+      - run: echo "$HARBOR_PASS" | podman login -u "$HARBOR_USER" --password-stdin harbor.mymx.me
-          mkdir -p ~/.docker
-          AUTH=$(printf '%s:%s' "$HARBOR_USER" "$HARBOR_PASS" | base64 -w0)
-          printf '{"auths":{"harbor.mymx.me":{"auth":"%s"}}}\n' "$AUTH" > ~/.docker/config.json
         env:
           HARBOR_USER: ${{ secrets.HARBOR_USER }}
           HARBOR_PASS: ${{ secrets.HARBOR_PASS }}
-      - run: docker build --push -t harbor.mymx.me/s5p/s5p:latest -f Containerfile .
+      - run: podman build -t harbor.mymx.me/s5p/s5p:latest -f Containerfile .
+      - run: podman push harbor.mymx.me/s5p/s5p:latest

Containerfile

@@ -1,10 +1,11 @@
 FROM python:3.13-alpine
 
-RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir pyyaml>=6.0
-
 WORKDIR /app
 
+COPY requirements.txt .
+RUN pip install --no-cache-dir --upgrade pip && \
+    pip install --no-cache-dir -r requirements.txt
+
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONPATH=/app/src

requirements.txt

@@ -0,0 +1 @@
+pyyaml>=6.0