athena-archive-ci-image

CI runner image used by both athena-archive (Next.js FE) and athena-archive-api (FastAPI BE). Extends node:24-bookworm-slim with the system packages each test suite needs (exiftool, poppler-utils, ffmpeg) plus uv + Python 3.14 for the BE and pnpm 10.x for the FE.

The FE's pnpm store is pre-populated at image build time so CI runs skip the network round-trip for every package — see Pre-baked pnpm store.

Image

code.modernleft.org/modernleft/athena-archive-ci:sha-<short-sha>

Downstream workflows pin a specific SHA tag for reproducibility (managed by Renovate). :latest is also published but not recommended for pinning.

The image rebuilds automatically on:

• Push to main touching Dockerfile, .forgejo/workflows/build.yml, package.json, or pnpm-lock.yaml.
• Weekly schedule (Mon 06:00 UTC) for security patches.
• Manual workflow_dispatch.

Use in a workflow

jobs:
    test:
        runs-on: docker
        container:
            image: code.modernleft.org/modernleft/athena-archive-ci:sha-<short-sha>
        steps:
            - uses: actions/checkout@v6
            # ...

Pre-baked pnpm store

package.json and pnpm-lock.yaml are vendored from athena-archive and pnpm fetch runs at image build time, populating /home/athena/.local/share/pnpm/store/v10. CI runs (also as athena) find the store on disk and complete pnpm install --frozen-lockfile --offline in ~2 seconds.

When athena-archive's lockfile drifts ahead of the next image rebuild, pnpm install --frozen-lockfile self-heals — it fetches what's missing and ignores what's no longer referenced. Renovate keeps the two lockfiles in sync via the shared local>ModernLeft/renovate preset, and a fresh image rebuild closes the gap.

Build locally

make build      # docker build -t athena-archive-ci:local .
make run        # docker run --rm -it athena-archive-ci:local

Required secret

The build workflow needs one repo-level secret:

Secret	Purpose
REGISTRY_TOKEN	Forgejo application token with package:write scope, owned by gravityfargo