Enable pinned BuildKit support on the Railiance CI runner

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

.forgejo/workflows/application-tests.yaml

@@ -2,7 +2,7 @@ name: Application acceptance
 
 on:
   push:
-    branches: [main, 'factory/**']
+    branches: [main]
   pull_request:
     branches: [main]
   workflow_dispatch:
@@ -17,11 +17,9 @@ jobs:
         run: |
           set -eu
           REF="${GITHUB_SHA:?exact source revision required}"
-          mkdir -p buildctx /tmp/factory-docker-bin
+          mkdir -p buildctx
           wget -qO /tmp/repo.tar.gz \
             "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
           tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
-          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
-            | tar xz --strip-components=1 -C /tmp/factory-docker-bin docker/docker
-          export PATH="/tmp/factory-docker-bin:${PATH}"
+          . buildctx/scripts/ci-docker.sh
           docker build --target application-tests buildctx

.forgejo/workflows/image.yaml

@@ -17,6 +17,7 @@ on:
       - "static/**"
       - "templates/**"
       - "conftest.py"
+      - "scripts/ci-docker.sh"
   workflow_dispatch:
 
 env:
@@ -35,13 +36,11 @@ jobs:
         run: |
           set -eu
           REF="${GITHUB_SHA:-main}"
-          mkdir -p buildctx "${HOME}/bin"
+          mkdir -p buildctx
           wget -qO /tmp/repo.tar.gz \
             "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
           tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
-          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
-            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
-          export PATH="${HOME}/bin:${PATH}"
+          . buildctx/scripts/ci-docker.sh
           docker version
           # Test the exact source before registry login or image publication.
           docker build --target application-tests buildctx

docs/delivery.md

@@ -33,7 +33,15 @@ The target carries no production database connection or release credential.
 SQLite proves this application acceptance suite; target PostgreSQL and live
 storage/recovery behavior remain release admission checks.
 
-The Forgejo application workflow checks proposed changes. The image workflow
+The Forgejo application workflow checks proposed changes. The shared
+`scripts/ci-docker.sh` installs Docker 27.3.1 and a checksum-pinned Buildx 0.19.3
+plugin into temporary per-job state and enables BuildKit. The Railiance runner
+otherwise falls back to the legacy builder, which rejects this Dockerfile’s
+existing secret mounts. Temporary tool and registry-login state is cleaned at exit.
+See [Docker’s BuildKit documentation](https://docs.docker.com/build/buildkit/).
+
+The workflow runs once per PR update; it does not duplicate that run on the
+feature-branch push. The image workflow
 runs the same target on the same archive revision **before** registry login and
 publication. Test dependencies and test settings are isolated from the runtime
 image. The existing optional BuildKit package secrets remain supported, but the

scripts/ci-docker.sh

@@ -0,0 +1,19 @@
+# Source from a CI step after archive checkout. Isolate tool and login state
+# for this invocation; do not modify the runner's persistent Docker config.
+set -eu
+VERGABE_DOCKER_TOOLS="$(mktemp -d)"
+export DOCKER_CONFIG="${VERGABE_DOCKER_TOOLS}/config"
+trap 'rm -rf "${VERGABE_DOCKER_TOOLS}"' EXIT
+mkdir -p "${VERGABE_DOCKER_TOOLS}/bin" "${DOCKER_CONFIG}/cli-plugins"
+wget -qO "${VERGABE_DOCKER_TOOLS}/docker.tgz" \
+  https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz
+tar xzf "${VERGABE_DOCKER_TOOLS}/docker.tgz" --strip-components=1 \
+  -C "${VERGABE_DOCKER_TOOLS}/bin" docker/docker
+wget -qO "${DOCKER_CONFIG}/cli-plugins/docker-buildx" \
+  https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64
+# Pinned from the upstream v0.19.3 checksums.txt release asset.
+echo "32ed111e941e385c2fb8261eba06a4056915718fd606f8278834ac1931d261a2  ${DOCKER_CONFIG}/cli-plugins/docker-buildx" | sha256sum -c -
+chmod +x "${DOCKER_CONFIG}/cli-plugins/docker-buildx"
+export PATH="${VERGABE_DOCKER_TOOLS}/bin:${PATH}"
+export DOCKER_BUILDKIT=1
+docker buildx version

workplans/VERGABE-WP-0018-customer-factory-delivery.md

@@ -87,3 +87,8 @@ Return the release and consumer evidence to HFACT-WP-0001-T06/T07.
 T02 remains in progress until the published exact revision has its CI return.
 T03 retains the concrete deployment/data/access/recovery gates. Attended Codex
 source work is not a natural governed worker claim/heartbeat/close trace.
+
+Live CI runs 15/16 exposed the runner's missing Buildx/BuildKit support, despite
+local acceptance. Added pinned temporary CLI setup shared by application and
+image workflows, and removed duplicate feature-push test scheduling. The next
+exact PR revision must pass on the actual runner before T02 closes.