fix(ci): single RUN for deps + uv install on legacy DinD

Legacy docker cannot chain shell after heredoc and does not persist
/tmp between RUN steps. Use python -c and one RUN for requirements
generation and venv install.

.forgejo/workflows/image.yaml

@@ -65,7 +65,7 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build --build-arg DEPS_LOCK_ID=4 -f buildctx/Dockerfile.ci \
+          docker build --build-arg DEPS_LOCK_ID=5 -f buildctx/Dockerfile.ci \
             -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"

Dockerfile

@@ -14,36 +14,12 @@ RUN apt-get update \
 COPY pyproject.toml ./
 
 # Bump DEPS_LOCK_ID when dependency wiring changes (busts DinD layer cache).
-ARG DEPS_LOCK_ID=4
+ARG DEPS_LOCK_ID=5
-RUN echo "deps-lock=${DEPS_LOCK_ID}" && python - <<'PY'
+RUN echo "deps-lock=${DEPS_LOCK_ID}" \
-import sys
+    && python -c "import tomllib,sys; from pathlib import Path; project=tomllib.load(open('pyproject.toml','rb'))['project']; deps=[d for d in (project.get('dependencies') or []) if d not in {'llm-connect','hub-core'}]; \
-import tomllib
+sys.exit('no installable dependencies') if not deps else None; Path('/app/requirements.txt').write_text('\\n'.join(deps)+'\\n'); print(f'wrote {len(deps)} requirements')" \
-from pathlib import Path
+    && test -s /app/requirements.txt \
-
+    && uv venv /app/.venv \
-with open("pyproject.toml", "rb") as f:
-    project = tomllib.load(f)["project"]
-
-deps = project.get("dependencies") or []
-if not deps:
-    sys.exit("pyproject.toml has no dependencies")
-
-skip = {"llm-connect", "hub-core"}
-lines = [
-    dep
-    for dep in deps
-    if dep not in skip
-]
-if not lines:
-    sys.exit("no installable dependencies after filter")
-
-req_path = Path("/app/requirements.txt")
-req_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-if req_path.stat().st_size == 0:
-    sys.exit("requirements.txt is empty")
-print(f"wrote {len(lines)} requirements to {req_path}")
-PY
-
-RUN uv venv /app/.venv \
     && uv pip install --python /app/.venv/bin/python --no-cache -r /app/requirements.txt
 
 COPY --from=hub_core_src pyproject.toml /tmp/hub-core/pyproject.toml