🔀 Merge chore/remove-toolcache-diagnostics into main

📝 Check off the CI Node-baking task
All steps confirmed green in CI ('Found in cache @ /opt/hostedtoolcache/node/ 26.8.2/x64', no download). The runner-side force-pull item moves to its own task, since a changed image under an unchanged tag is still silently ignored.
2026-09-14 16:07:52 +00:00 · 2026-09-14 16:04:03 +00:00 · 2026-09-14 16:04:01 +00:00
2 changed files with 13 additions and 19 deletions
@@ -63,24 +63,13 @@ jobs:
                - /data/gitea-pages:/data/gitea-pages
        steps:
            - uses: actions/checkout@v4
-            # TEMPORARY (remove once understood): the image provably carries
-            # the tool-cache entry (verified with `docker run --rm <image> ls
-            # /opt/hostedtoolcache/node/26.8.2/x64/bin`), yet setup-node still
-            # downloads. Print what the job container actually sees at
-            # runtime, mounts first — a mount over /opt/hostedtoolcache would
-            # hide the baked directory from the probe.
-            - name: Tool cache diagnostics
+            # Fail fast when the job container is not the baked image: a stale
+            # tag on the runner (`forcePull=false` in its pull log) silently
+            # reintroduces the per-job download. Mirrors the publish job's
+            # NPM_TOKEN assert — cheap, and it names the invariant.
+            - name: Assert the baked tool cache is present
              run: |
-                  id
-                  grep -E 'hostedtoolcache|workspace|overlay' /proc/mounts || true
-                  ls -la /opt/hostedtoolcache || true
-                  ls -la /opt/hostedtoolcache/node || true
-                  ls -la "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/" || true
-                  test -f "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/x64.complete" && echo MARKER-PRESENT || echo MARKER-MISSING
-                  ls -la "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/x64/bin" || true
-                  "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/x64/bin/node" -v || true
-                  env | grep -iE 'RUNNER|TOOL|CACHE' || true
-                  head -2 /etc/os-release
+                  test -f "/opt/hostedtoolcache/node/$(tr -d '[:space:]' < .node-version)/x64.complete"
            - uses: actions/setup-node@v4
              with:
                  node-version-file: .node-version
@@ -45,7 +45,12 @@ Maintenance:
    ☐ Add a minimal dir-listing webserver to the gitea docker setup for serving landing page (reuse existing reverse proxy)
    ☐ CI writes landing page to a shared volume keyed by project + tag (e.g. `/landing/tiny-pattern-ts/<tag>/`)
    ☐ Browse to `…/tiny-pattern-ts/index.html` in the browser
-☐ Stop Gitea CI re-downloading Node on every job (branch chore/fix-ci)
+✔ Stop Gitea CI re-downloading Node on every job @done
    ✔ Share the warm npm cache with the publish job @done
    ✔ Bake Node into the CI job image (docker/Dockerfile, container.image in ci.yml) @done
-    ☐ Build/push gitea.e1nsnull.de/tmu/act-ci:26.8.2 and confirm setup-node skips the download (first run on the branch = acceptance test) @high
+    ✔ Build/push gitea.e1nsnull.de/tmu/act-ci:26.8.2 and confirm setup-node skips the download @done
+    ✔ Write the `<version>/x64.complete` marker — actions/tool-cache ignores a bare directory, so the probe missed and the download continued @done
+    ✔ Log tool-cache state from the job container to find it (temporary, removed once understood) @done
+    ✔ Guard the invariant in CI (`Assert the baked tool cache is present`) @done
+☐ Enable force-pull for the runner so a changed act-ci image is never missed @low
+    → the tag encodes only the Node version, so a Dockerfile change yields new content under an unchanged tag; with `forcePull=false` the runner keeps the old image (see CONTRIBUTING § CI runner image)