🚀 Release 0.1.3

🔀 Merge chore/fix-ci into main
🐛 Expand the node base image through a named stage
2026-09-14 15:45:11 +00:00 · 2026-09-14 15:43:57 +00:00 · 2026-09-14 13:28:29 +00:00 · 2026-09-14 12:51:34 +00:00 · 2026-09-14 12:40:22 +00:00 · 2026-09-14 12:37:58 +00:00
10 changed files with 222 additions and 94 deletions
@@ -49,11 +49,16 @@ jobs:
        needs: release-gate
        if: needs.release-gate.outputs.skip != 'true'
        runs-on: ubuntu-latest
-        # Bind-mount the shared pages tree so the coverage step below can write
-        # into it. The runner whitelists this path via `container.valid_volumes`
-        # (docker-space `setup/gitea.sh`); `image` is omitted on purpose so the
-        # runner keeps using its default job image.
+        # `image` extends the runner's default job image (catthehacker/act)
+        # with Node 26 pre-planted in the tool cache layout, so setup-node's
+        # version probe hits and never downloads (see docker/Dockerfile). The
+        # tag MUST equal the exact version pinned in `.node-version`; the bump
+        # ritual is documented in CONTRIBUTING.md § CI runner image. The volume
+        # bind-mounts the shared pages tree so the
+        # coverage step below can write into it; the runner whitelists this
+        # path via `container.valid_volumes` (docker-space `setup/gitea.sh`).
        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
            volumes:
                - /data/gitea-pages:/data/gitea-pages
        steps:
@@ -108,6 +113,10 @@ jobs:
        if: needs.release-gate.outputs.skip != 'true'
        runs-on: ubuntu-latest
        continue-on-error: true
+        # Same baked image as `build` — without it this job re-downloads Node
+        # per run (see docker/Dockerfile).
+        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
        steps:
            - uses: actions/checkout@v4
            - uses: actions/setup-node@v4
@@ -121,6 +130,10 @@ jobs:
        if: startsWith(gitea.ref, 'refs/tags/')
        needs: build
        runs-on: ubuntu-latest
+        # Same baked image as `build` — setup-node still owns the registry-url
+        # `.npmrc` rewrite here; only the Node download is skipped.
+        container:
+            image: gitea.e1nsnull.de/tmu/act-ci:26.8.2
        # The release page is created with the run's automatic Gitea token
        # (`github.token`), not `NPM_TOKEN`, so it needs `contents: write`.
        permissions:
@@ -139,6 +152,10 @@ jobs:
            - uses: actions/setup-node@v4
              with:
                  node-version-file: .node-version
+                  # Same lockfile/key as `build`, and tag runs can read caches
+                  # saved on `main` — without this, every release pays a cold
+                  # `npm ci` despite the warm shared npm cache.
+                  cache: "npm"
                  registry-url: "https://registry.npmjs.org/"
            - run: npm ci
            # Consume the dist/ that `build` produced and gated, instead of
@@ -1 +1 @@
-26
+26.8.2
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.1.3] - 2026-09-14
+
+- change to custom image for CI
+
+## [0.1.2] - 2026-09-14
+
+- upgrade dependencies
+
 ## [0.1.1] - 2026-09-14

 - upgrade dependencies
@@ -15,6 +23,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 - basic setup

-[Unreleased]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.1...main
+[Unreleased]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.3...main
+[0.1.3]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.2...0.1.3
+[0.1.2]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.1...0.1.2
 [0.1.1]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/0.1.0...0.1.1
 [0.1.0]: https://gitea.e1nsnull.de/tmu/tiny-pattern-ts/compare/20308c5a6d8cccfb09b02ac2ebebd8055e91cd11...0.1.0
@@ -90,6 +90,18 @@ This is why every test in the suite pairs an `expectTypeOf(...)` with an `assert
 - CI runs `npm run check` + `npm run test:ci` on every push to `main` — this is the authoritative gate. The one exception: a push headed by a release commit (`:rocket: Release x.y.z`) skips the full `build`/`maintain` jobs, because `create:release` pushes the tag for that exact commit right after and the tag run is the authoritative one (see `release-gate` in [.gitea/workflows/ci.yml](./.gitea/workflows/ci.yml)).
 - **Releases are NOT triggered by pushes.** Only the maintainer triggers a release (see [Publishing workflow](#publishing-workflow)).

+## CI runner image
+
+The `build` / `maintain` / `publish` jobs run in `gitea.e1nsnull.de/tmu/act-ci:<version>` ([docker/Dockerfile](./docker/Dockerfile)) — the runner's default act image with the Node distribution overlaid at the exact `/opt/hostedtoolcache` layout `actions/setup-node` probes before downloading, so no job pays the ~50 MB fetch. The image tag MUST equal the exact version pinned in `.node-version`; `release-gate` uses no Node and stays on the default image. The script is deliberately NOT an `npm run` script: building requires a docker daemon and registry credentials, so it belongs to no feedback tier — per [Script prefix convention](#script-prefix-convention), no existing prefix fits and that is the signal.
+
+Bumping Node is one coordinated change, committed as a unit:
+
+1. Edit `.node-version` to the new exact `x.y.z` — floats like `26` resolve to the latest patch at runtime and silently bust the baked entry; `scripts/runner-image.sh` refuses them.
+2. `docker login gitea.e1nsnull.de` (user + package/access token), then `./scripts/runner-image.sh --push` — it reads the version from `.node-version` and builds/pushes `<IMAGE_REPO>:<version>`.
+3. Repoint the three `container.image` tags in [.gitea/workflows/ci.yml](./.gitea/workflows/ci.yml) to the same version.
+
+Skipping step 2 fails CI at image pull; skipping step 3 silently reverts to the per-job download.
+
 ## Publishing workflow

 Publishing is CI-only by policy. Local `npm publish` is not supported. The maintainer triggers releases from `main`:
@@ -45,3 +45,7 @@ Maintenance:
    ☐ Add a minimal dir-listing webserver to the gitea docker setup for serving landing page (reuse existing reverse proxy)
    ☐ CI writes landing page to a shared volume keyed by project + tag (e.g. `/landing/tiny-pattern-ts/<tag>/`)
    ☐ Browse to `…/tiny-pattern-ts/index.html` in the browser
+☐ Stop Gitea CI re-downloading Node on every job (branch chore/fix-ci)
+    ✔ Share the warm npm cache with the publish job @done
+    ✔ Bake Node into the CI job image (docker/Dockerfile, container.image in ci.yml) @done
+    ☐ Build/push gitea.e1nsnull.de/tmu/act-ci:26.8.2 and confirm setup-node skips the download (first run on the branch = acceptance test) @high
@@ -27,6 +27,14 @@
        "knope",
        "runwisp",
        "glab",
+        "hostedtoolcache",
+        "nodebase",
+        "frontends",
+        "catthehacker",
+        "nsnull",
+        "dedup",
+        "dedupe",
+        "repoint",
        "postversion",
        "prebuild",
        "Zilla",
@@ -0,0 +1,44 @@
+# CI job image for the Gitea act_runner: the runner's default job image with
+# Node pre-planted where actions/setup-node looks first.
+#
+# Why this layout: setup-node ignores `node` on PATH; its only fast path is a
+# probe of /opt/hostedtoolcache/node/<version>/<arch>. Without an entry there
+# it downloads the ~50 MB distribution on EVERY job (the runner's job
+# containers are ephemeral, so its tool cache never survives a job). The
+# official node images keep exactly the layout setup-node expects under
+# /usr/local, so this layer is a pure file overlay — no scripts, no env.
+#
+# Why not a host bind of /opt/hostedtoolcache: binds never self-prune. Docker
+# images are content-addressed: the base layers dedupe against the act image
+# the host already has, and `docker image prune` / re-pulls are the cleanup
+# story.
+#
+# NODE_VERSION must match `.node-version` exactly. setup-node resolves a float
+# like `26` to the latest known patch at runtime, so a bump silently busts the
+# baked entry; `.node-version` is pinned to x.y.z and scripts/runner-image.sh
+# guards the coupling. Rebuild + repoint `container.image` in
+# .gitea/workflows/ci.yml on every bump.
+#
+# The extra `nodebase` stage is load-bearing: `COPY --from=` resolves its value
+# as a *stage name* at parse time, before build args exist, so
+# `COPY --from=node:${NODE_VERSION}` collapses to the invalid `node:` on
+# frontends that do not expand args there. ARGs declared before the first FROM
+# *are* expanded in FROM, so routing through a named stage works everywhere.
+
+# Global scope: only visible to FROM lines, but that is exactly where we need it.
+ARG NODE_VERSION=26.8.2
+FROM node:${NODE_VERSION} AS nodebase
+
+FROM catthehacker/ubuntu:act-latest
+
+# ARGs do not cross stage boundaries; redeclare (with the same default, so a
+# bare `docker build -f docker/Dockerfile .` still works) for the paths below.
+# Keep this default in sync with the global one above.
+ARG NODE_VERSION=26.8.2
+
+# node image: bin/ + lib/ under /usr/local → tool cache: bin/ + lib/ under <ver>/x64.
+COPY --from=nodebase /usr/local /opt/hostedtoolcache/node/${NODE_VERSION}/x64
+
+# Fail the build (not CI) if the overlay or the version arg were wrong.
+# Shell form on purpose: exec form (`RUN [...]`) does not expand ARG values.
+RUN "/opt/hostedtoolcache/node/${NODE_VERSION}/x64/bin/node" --version
@@ -1,12 +1,12 @@
 {
    "name": "tiny-pattern-ts",
-    "version": "0.1.1",
+    "version": "0.1.3",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "tiny-pattern-ts",
-            "version": "0.1.1",
+            "version": "0.1.3",
            "license": "MIT",
            "devDependencies": {
                "@arethetypeswrong/cli": "^0.18.5",
@@ -20,7 +20,7 @@
                "expect-type": "1.4.0",
                "knip": "^6.34.0",
                "lefthook": "^2.1.12",
-                "oxfmt": "^0.66.0",
+                "oxfmt": "^0.67.0",
                "oxlint": "^1.81.0",
                "oxlint-tsgolint": "^7.0.2001",
                "publint": "^0.3.24",
@@ -1507,9 +1507,9 @@
            ]
        },
        "node_modules/@oxfmt/binding-android-arm-eabi": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.66.0.tgz",
-            "integrity": "sha512-2Me9eoptv6ERdEuI2P8AOlYdHHraXebJaM6SC0kc2Dfb+mLrep2db+fedBPKaYn673h/vBgvP4tkOdAbaudX6w==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-android-arm-eabi/-/binding-android-arm-eabi-0.67.0.tgz",
+            "integrity": "sha512-2olh3ioEmc4gRzQm7jxyB1b/PFBoFvTq8KdgYySeNpysDtA6DEg2Mvya4/I6flhL7G0eOrE8RD7JCNCIMhE16Q==",
            "cpu": [
                "arm"
            ],
@@ -1524,9 +1524,9 @@
            }
        },
        "node_modules/@oxfmt/binding-android-arm64": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.66.0.tgz",
-            "integrity": "sha512-u7O+bSSF0HGsDKkQQxBqvLGVepu93RA+JKu+ONqvfh4sCnCEbj31wZj4iG5gk3XfRwrmYj0/8catkO2LcblQKQ==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-android-arm64/-/binding-android-arm64-0.67.0.tgz",
+            "integrity": "sha512-ulfw8EHN1MBq/MFFDXw2/M1VAFu5mRUcnuZ8Hqbv9viAnFzO9t1jKSAsDqKYYDGMlytF/uj6Z5z5n/tHupnKhw==",
            "cpu": [
                "arm64"
            ],
@@ -1541,9 +1541,9 @@
            }
        },
        "node_modules/@oxfmt/binding-darwin-arm64": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.66.0.tgz",
-            "integrity": "sha512-/ikyMIVjX/sdo7KtjxoEsSUosfPzveVhT9RWMx9yGqFDKFJ89JAEKuEeLBmurDjrkb4w8tOnAdSO3SBaplY3bw==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-darwin-arm64/-/binding-darwin-arm64-0.67.0.tgz",
+            "integrity": "sha512-MfONZx/O2o9M5v2jDFol556G9+A+P9xCuJ4DZ+qhE+RnaCdoscy6Eu5nq1dbuNxhwdJyZ6kLI7fnG9mwEeOeGg==",
            "cpu": [
                "arm64"
            ],
@@ -1558,9 +1558,9 @@
            }
        },
        "node_modules/@oxfmt/binding-darwin-x64": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.66.0.tgz",
-            "integrity": "sha512-q5xUsKeFqawa9NXa6ZGXWimFV19m8MogKPdTaSVDAAk2EQKBmBZRDeluwcl1p8ty/OFc9s9888OKEh3xfPVH0g==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-darwin-x64/-/binding-darwin-x64-0.67.0.tgz",
+            "integrity": "sha512-CYnIx5LvFVJnyJcCqwH2jxMKjFjqo5678MPjdmNFoSGMhlOvZ/xRZqvhDcolKrXc8fezW3AKh+C4wyoFuWOSSg==",
            "cpu": [
                "x64"
            ],
@@ -1575,9 +1575,9 @@
            }
        },
        "node_modules/@oxfmt/binding-freebsd-x64": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.66.0.tgz",
-            "integrity": "sha512-CR+x4VzMY0pRXLK/xFQ/RzsSFkP5t2Z2mef0QY6OP/rTRcMUoMLCOM62/3Fp/t0K+UDoBKxvMyeb6D0zPMjleA==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-freebsd-x64/-/binding-freebsd-x64-0.67.0.tgz",
+            "integrity": "sha512-7/iF1orvIS9mxhKUqnmtMgm+OrSQ5acPwuvdQrm6ECgqbwPmC+Pw9cdke3sNfVN6pT2hbJ58+jP8BCThl5HXOg==",
            "cpu": [
                "x64"
            ],
@@ -1592,9 +1592,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-arm-gnueabihf": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.66.0.tgz",
-            "integrity": "sha512-ZEYmO/LbH9tTQCADILHGZE4GeOXOAj2VzedHkASNwjmwlwtutJCLpCJbIs37wRGTFgWRoEcD72jpMX+IBJUGjQ==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.67.0.tgz",
+            "integrity": "sha512-yy+OGys07IZOpOmYPZoObKyUQLkfxeQqeCypk+1jaZd8HGo77hzvU1Jg8X3+W75o+9lszOjBfg0nkGtlwYywXw==",
            "cpu": [
                "arm"
            ],
@@ -1609,9 +1609,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-arm-musleabihf": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.66.0.tgz",
-            "integrity": "sha512-hNtR9/oU0CeTkq7JnRkmBQwqe17v2ZaAMLC4VcN7IIOWeRyWDk0knSPWS9iiLmtbZ2RRBBtsG01jQgkZmKCJeQ==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.67.0.tgz",
+            "integrity": "sha512-wPIeeigXgJpwNw3wydYRt3U9iN9Y/ejpOZuYL9IA7igxWs7LIQMOkhKxTumRvy6dIv0iXKk3RTw3Vmjg0i+2sg==",
            "cpu": [
                "arm"
            ],
@@ -1626,9 +1626,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-arm64-gnu": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.66.0.tgz",
-            "integrity": "sha512-uwOVQ8i6I1LT/+eDzfsgrrcZp8Fn6NPVUPn8fF5gdFGekFf0PddF+LEuwsD0/pbNUcKZhDj2rQ5UpITh9gF4iQ==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.67.0.tgz",
+            "integrity": "sha512-0+XNxcdbkTfxdcD4qW6Ci9n+mBNJ8xTBumnxKvKBmRFOdx0Wf8/KiHjCJayooXmYkqRpRVd98Q5egvzx5BLSgQ==",
            "cpu": [
                "arm64"
            ],
@@ -1646,9 +1646,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-arm64-musl": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.66.0.tgz",
-            "integrity": "sha512-tTkF2Dmx4nGAjmBlZb+UtTGqR/EK4ZrW9qBfzte07a9XWqzoGGKzpFFlyNDhQe+Uwql94+ReCTeNbhOXscw1Dg==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.67.0.tgz",
+            "integrity": "sha512-I75LKPJyNOYUzkqAiAMIE31+Ye7xtQXZdoty1IXn4B+bw5Zpmez5wfG19ejGpNnS/BzQ7LFS+7jxuTPb+vHiZw==",
            "cpu": [
                "arm64"
            ],
@@ -1666,9 +1666,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-ppc64-gnu": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.66.0.tgz",
-            "integrity": "sha512-F3cKHUav4yXOHn6GFnwpBhSYsJOYKKf9eqO/9jlEuqPxNw9zb98E9ZFct79gcg8pibUGkbveEu9WDlmXJpDzKw==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.67.0.tgz",
+            "integrity": "sha512-c2M5iRpe1QMZSRE/UvZoPdXBWb5Ic/ycvOyNiKCqPwQ/OyOKIMiJs02ynlNnjb7ZZJnRXYLmGcohoINOcwDK3w==",
            "cpu": [
                "ppc64"
            ],
@@ -1686,9 +1686,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-riscv64-gnu": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.66.0.tgz",
-            "integrity": "sha512-K5fDaNZfDyQMYA/3qL21bqyN0X9T15LLwwbFPt2aHc94+ZG7bh0vZEsy2y7NlRnjjHFSwN+Hzg6ldJtbOriH4Q==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.67.0.tgz",
+            "integrity": "sha512-dQzzYlV24Udhfm5ECuSdgqRvFJU/CGHzcYYEO3dLM6W6+CHiBFrq9OjIllkdCcPhsoSQ8o223Dja84MOSzed9A==",
            "cpu": [
                "riscv64"
            ],
@@ -1706,9 +1706,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-riscv64-musl": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.66.0.tgz",
-            "integrity": "sha512-44Yc+I+qOmTElRcEhm5hUKIUJEQIOugymz4ua4tB0Wox7tGAfIbjzmXz/HDAtw1Ij6gmBwZlzh4hc9679RhWeA==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.67.0.tgz",
+            "integrity": "sha512-rFNq1CgX4qMJANOq42LkAs90JE80GpiaEohAV2qn/gT2hGjQTW1zBO5zQBxArI4926pM1OSzo3CN0tBszGBIaA==",
            "cpu": [
                "riscv64"
            ],
@@ -1726,9 +1726,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-s390x-gnu": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.66.0.tgz",
-            "integrity": "sha512-1e29Eg9hEj2kRBB19M0seIehPbbXHCk35GvImjDvb79rjjYjXCRmtbUNHJcgoktZAMIzXrTbxDBKmTc1V4bg3A==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.67.0.tgz",
+            "integrity": "sha512-Sky6rEdz2o5IGq01lPhS12yEvDdChVEcaYrcLHkveh4Fx0qPjljE/Iul6SX/bRMl6lNc8J7J/mDQdzgBdA++Pg==",
            "cpu": [
                "s390x"
            ],
@@ -1746,9 +1746,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-x64-gnu": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.66.0.tgz",
-            "integrity": "sha512-vODY1UQo10gngn0+D4xHKU84F1Twm1LqrzV4SqPXvmQKSd87paehvZ6jqA5wKs6XQrlWul9clYMDVHcoW9CPMA==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.67.0.tgz",
+            "integrity": "sha512-vPXmlNORV8AZq2Ocxh07pxwMjfENUWCV/eZArnao0qC3NO/hDeTVkQvee7SJJUbIiF5PZbBa4kYmaXnu7Rk58w==",
            "cpu": [
                "x64"
            ],
@@ -1766,9 +1766,9 @@
            }
        },
        "node_modules/@oxfmt/binding-linux-x64-musl": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.66.0.tgz",
-            "integrity": "sha512-YDzXx2JsT4+HL4MdkVrYjO55NS5lUKNm8rLC4ZPou8+seu0v0jhecSh+ufoO6+xEa8gccEezMlI2WHJi4ApUgw==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-linux-x64-musl/-/binding-linux-x64-musl-0.67.0.tgz",
+            "integrity": "sha512-x/WAtFqYtVr3vZ9ni8nr4kn9whSitg8fOljq/pZzBpxopRdY1BMLZCZkrbIbaBcYkm46qGbqVea2FCWmtQ2P9w==",
            "cpu": [
                "x64"
            ],
@@ -1786,9 +1786,9 @@
            }
        },
        "node_modules/@oxfmt/binding-openharmony-arm64": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.66.0.tgz",
-            "integrity": "sha512-mJjUYd8lj0+j4JkYyEM+5qKBf1Rnrpgjn/SVYKJhicVDqLz566ooa7Fs8zflPqt+dnZDV7X054rVIQX6ZcQNlQ==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-openharmony-arm64/-/binding-openharmony-arm64-0.67.0.tgz",
+            "integrity": "sha512-eRw9Neh4/aA6i+q/R3WU1gGQINhVM0J4fXIm6t27caOamkr/37uAkp1IdBx4zlJH97hmXR63z/q9n5c5dN7MzA==",
            "cpu": [
                "arm64"
            ],
@@ -1803,9 +1803,9 @@
            }
        },
        "node_modules/@oxfmt/binding-win32-arm64-msvc": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.66.0.tgz",
-            "integrity": "sha512-soV+0vESv7e5ntCHWC61x4gg8OSak6IHHnWsZmHrJFlvMj2AK+kmldErCNkVkrvc1Ts2/++rJXn+IuAb2WMXhw==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.67.0.tgz",
+            "integrity": "sha512-YIMvb+sGNYN2uc6+QK2HLPeEKM2vl7QZ5onQzpAJRb6pnf0DwUFP5R8tdS9R0l8hdUil2gu4Uxd0Yxrop0iT4w==",
            "cpu": [
                "arm64"
            ],
@@ -1820,9 +1820,9 @@
            }
        },
        "node_modules/@oxfmt/binding-win32-ia32-msvc": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.66.0.tgz",
-            "integrity": "sha512-YCPi23uRIEYuIKTZohAkKbPFpujQ5QBuUM5iDv+UqbCmTPAkaFsxjsSuB8xlBpRT0G7eP/4HMF+cPDSqHtOD9A==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.67.0.tgz",
+            "integrity": "sha512-LzmU9MyACPzwNDIK0ItMedHPz735Ug7ELWguxo4/kuy6zWuDoeglOAEFCY8jLg0PzRpFO3hDyLFe2Gu2eFDeGA==",
            "cpu": [
                "ia32"
            ],
@@ -1837,9 +1837,9 @@
            }
        },
        "node_modules/@oxfmt/binding-win32-x64-msvc": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.66.0.tgz",
-            "integrity": "sha512-bwTQcv/JVRPkOqQtMF0X7vpvpncDQiBcXHxZ9S2hR12Hlo8bvBdUR5x5XnxzDZ3kM0qoZw1rv7KaD66Ly+pFWA==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/@oxfmt/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.67.0.tgz",
+            "integrity": "sha512-sbQOIDNLUEeVZcAJcSL5VURn7kfjvilPviody4Yl5n8lQCDtUm+C9oHTTwZS/m4d/Z6Vv3jNEiAofH932NPPCg==",
            "cpu": [
                "x64"
            ],
@@ -4171,13 +4171,13 @@
            }
        },
        "node_modules/oxfmt": {
-            "version": "0.66.0",
-            "resolved": "https://registry.npmjs.org/oxfmt/-/oxfmt-0.66.0.tgz",
-            "integrity": "sha512-FfvqR8RFtV6JJpRrpkfqyVCQ7HDvZ/VriWFx7veftCgL1B5ZO9qNr+1rvPieycMQnNfVG0PWyJQiy7p0hq1I5w==",
+            "version": "0.67.0",
+            "resolved": "https://registry.npmjs.org/oxfmt/-/oxfmt-0.67.0.tgz",
+            "integrity": "sha512-vV7sSiPsaO0mSxdoUdayipVDFPzW/UQ+hrezEHa20+Tx1dnMdZLSRHMT0PdS67FFbhd74M1n08asW21aLGeCrA==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
-                "tinypool": "2.1.0"
+                "tinypool": "2.1.2"
            },
            "bin": {
                "oxfmt": "bin/oxfmt"
@@ -4189,25 +4189,25 @@
                "url": "https://github.com/sponsors/oxc-project"
            },
            "optionalDependencies": {
-                "@oxfmt/binding-android-arm-eabi": "0.66.0",
-                "@oxfmt/binding-android-arm64": "0.66.0",
-                "@oxfmt/binding-darwin-arm64": "0.66.0",
-                "@oxfmt/binding-darwin-x64": "0.66.0",
-                "@oxfmt/binding-freebsd-x64": "0.66.0",
-                "@oxfmt/binding-linux-arm-gnueabihf": "0.66.0",
-                "@oxfmt/binding-linux-arm-musleabihf": "0.66.0",
-                "@oxfmt/binding-linux-arm64-gnu": "0.66.0",
-                "@oxfmt/binding-linux-arm64-musl": "0.66.0",
-                "@oxfmt/binding-linux-ppc64-gnu": "0.66.0",
-                "@oxfmt/binding-linux-riscv64-gnu": "0.66.0",
-                "@oxfmt/binding-linux-riscv64-musl": "0.66.0",
-                "@oxfmt/binding-linux-s390x-gnu": "0.66.0",
-                "@oxfmt/binding-linux-x64-gnu": "0.66.0",
-                "@oxfmt/binding-linux-x64-musl": "0.66.0",
-                "@oxfmt/binding-openharmony-arm64": "0.66.0",
-                "@oxfmt/binding-win32-arm64-msvc": "0.66.0",
-                "@oxfmt/binding-win32-ia32-msvc": "0.66.0",
-                "@oxfmt/binding-win32-x64-msvc": "0.66.0"
+                "@oxfmt/binding-android-arm-eabi": "0.67.0",
+                "@oxfmt/binding-android-arm64": "0.67.0",
+                "@oxfmt/binding-darwin-arm64": "0.67.0",
+                "@oxfmt/binding-darwin-x64": "0.67.0",
+                "@oxfmt/binding-freebsd-x64": "0.67.0",
+                "@oxfmt/binding-linux-arm-gnueabihf": "0.67.0",
+                "@oxfmt/binding-linux-arm-musleabihf": "0.67.0",
+                "@oxfmt/binding-linux-arm64-gnu": "0.67.0",
+                "@oxfmt/binding-linux-arm64-musl": "0.67.0",
+                "@oxfmt/binding-linux-ppc64-gnu": "0.67.0",
+                "@oxfmt/binding-linux-riscv64-gnu": "0.67.0",
+                "@oxfmt/binding-linux-riscv64-musl": "0.67.0",
+                "@oxfmt/binding-linux-s390x-gnu": "0.67.0",
+                "@oxfmt/binding-linux-x64-gnu": "0.67.0",
+                "@oxfmt/binding-linux-x64-musl": "0.67.0",
+                "@oxfmt/binding-openharmony-arm64": "0.67.0",
+                "@oxfmt/binding-win32-arm64-msvc": "0.67.0",
+                "@oxfmt/binding-win32-ia32-msvc": "0.67.0",
+                "@oxfmt/binding-win32-x64-msvc": "0.67.0"
            },
            "peerDependencies": {
                "svelte": "^5.0.0",
@@ -4696,9 +4696,9 @@
            }
        },
        "node_modules/tinypool": {
-            "version": "2.1.0",
-            "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-2.1.0.tgz",
-            "integrity": "sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==",
+            "version": "2.1.2",
+            "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-2.1.2.tgz",
+            "integrity": "sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==",
            "dev": true,
            "license": "MIT",
            "engines": {
@@ -1,6 +1,6 @@
 {
    "name": "tiny-pattern-ts",
-    "version": "0.1.1",
+    "version": "0.1.3",
    "description": "Pattern matching for TypeScript/ESM environments (F#-style, not regex)",
    "keywords": [
        "adt",
@@ -77,7 +77,7 @@
        "expect-type": "1.4.0",
        "knip": "^6.34.0",
        "lefthook": "^2.1.12",
-        "oxfmt": "^0.66.0",
+        "oxfmt": "^0.67.0",
        "oxlint": "^1.81.0",
        "oxlint-tsgolint": "^7.0.2001",
        "publint": "^0.3.24",
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build (and optionally push) the CI job image from docker/Dockerfile.
+# Run wherever docker + registry credentials live (the runner host, or any
+# machine that can reach the registry). The registry/repo below MUST match
+# the `container.image` references in .gitea/workflows/ci.yml — the runner
+# pulls the image by name.
+#
+# Usage: scripts/runner-image.sh [--push]
+
+IMAGE_REPO="gitea.e1nsnull.de/tmu/act-ci"
+
+NODE_VERSION="$(tr -d '[:space:]' < .node-version)"
+if [[ ! "${NODE_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    echo "error: .node-version must be pinned to an exact x.y.z, got '${NODE_VERSION}'." >&2
+    echo "       setup-node resolves floats like '26' to the latest patch at runtime," >&2
+    echo "       which silently busts the tool-cache entry baked into the image." >&2
+    exit 1
+fi
+
+IMAGE="${IMAGE_REPO}:${NODE_VERSION}"
+
+# --pull: refresh the act base layer so the derivative does not float on an
+# aging default image forever (layer dedup keeps this cheap).
+docker build --pull --build-arg "NODE_VERSION=${NODE_VERSION}" -t "${IMAGE}" -f docker/Dockerfile .
+
+if [[ "${1:-}" == "--push" ]]; then
+    docker push "${IMAGE}"
+fi
+
+echo "built ${IMAGE}"
+echo "reminder: bump container.image in .gitea/workflows/ci.yml to this tag"
Author	SHA1	Message	Date
tmu	1dfb979ebb	🚀 Release 0.1.3 CI / release-gate (push) Successful in 2s Details CI / build (push) Successful in 43s Details CI / maintain (push) Failing after 33s Details CI / publish (push) Failing after 3s Details	2026-09-14 15:45:11 +00:00
tmu	f04ad3d5bc	🔀 Merge chore/fix-ci into main	2026-09-14 15:43:57 +00:00
tmu	93cbfcf6b1	🐛 Expand the node base image through a named stage CI / release-gate (pull_request) Successful in 2s Details CI / build (pull_request) Successful in 37s Details CI / publish (pull_request) Skipped Details CI / maintain (pull_request) Failing after 34s Details COPY --from= resolves its value as a stage name at parse time, before build args exist, so COPY --from=node:${NODE_VERSION} collapsed to the invalid 'node:' and docker failed with 'failed to parse stage name'. ARGs in global scope are expanded in FROM, so route through a named nodebase stage; the per-stage ARG redeclaration keeps the tool-cache paths expanding.	2026-09-14 13:28:29 +00:00
tmu	3e33b51d1b	📝 Document CI runner-image bump ritual build:runner-image broke the script prefix convention: build is a bare single-tool command, and no tier fits a docker-daemon + registry-cred action, so the script leaves package.json and is invoked directly. CONTRIBUTING gains a 'CI runner image' section recording where the image pushes (gitea.e1nsnull.de/tmu/act-ci:<version>), the .node-version coupling, and the three-step Node-bump ritual.	2026-09-14 12:51:34 +00:00
tmu	abbdf4410e	📝 Track CI Node-baking work in backlog Record chore/fix-ci's two done steps and the remaining ops step (build/push the image; first CI run is the acceptance test). Glyph/tag coupling honoured: every ✔ line carries @done, open parent stays ☐.	2026-09-14 12:40:22 +00:00
tmu	245dfaf198	💚 Bake Node into the CI job image setup-node never consults `node` on PATH; its only fast path is a probe of /opt/hostedtoolcache, which the ephemeral act_runner job containers always miss, so every job paid a ~50 MB Node download. docker/Dockerfile extends the runner's default catthehacker/act image with the Node distribution overlaid at the exact tool-cache layout, so setup-node finds 26.8.2 and skips the fetch while node-version-file, cache: npm and registry-url keep working unchanged. Image layers dedupe against the base the host already pulled and prune via normal docker hygiene — the cleanup story a host bind of /opt/hostedtoolcache lacks. To make the bake deterministic, .node-version is pinned to the exact 26.8.2 the image carries; scripts/runner-image.sh guards that coupling and builds/pushes the tag the three node jobs now reference via container.image. Ops follow-up (outside the repo): build once with `npm run build:runner-image -- --push` on a machine with registry creds. If the package is private, the runner needs container registry credentials in its config.	2026-09-14 12:37:58 +00:00
tmu	b9fe21175f	💚 Reuse npm cache in publish job The publish job ran npm ci against a cold cache on every release while build/maintain already share a warm node-cache key off the same lockfile. Tag runs can read caches saved on main, so wiring cache: npm here is free.	2026-09-14 12:13:38 +00:00
tmu	5292455dbc	🚀 Release 0.1.2 CI / release-gate (push) Successful in 2s Details CI / build (push) Successful in 36s Details CI / maintain (push) Successful in 27s Details CI / publish (push) Failing after 3s Details	2026-09-14 12:03:32 +00:00
tmu	d1ef039688	🔀 Merge chore/dependency-updates into main	2026-09-14 12:02:51 +00:00
tmu	c65f86e5d5	⬆️ Upgrade dependencies	2026-09-14 12:02:27 +00:00
@@ -1 +1 @@
 
 .8.2