fix CI

.gitea/workflows/ci.yaml

@@ -21,6 +21,10 @@ jobs:
   # Detect which parts of the repo changed in this push/PR.
   changes:
     runs-on: linux/amd64
+    # Runs in the builder image because the host has no Node, which the
+    # JS-based checkout/paths-filter actions require.
+    container:
+      image: gitea.tourolle.paris/dtourolle/kpnpp-builder:latest
     outputs:
       dockerfile: ${{ steps.filter.outputs.dockerfile }}
       code: ${{ steps.filter.outputs.code }}

.gitea/workflows/docker.yaml

@@ -22,8 +22,17 @@ jobs:
   build:
     runs-on: linux/amd64
     steps:
+      # This job runs on the host (not in a container) so it can reach the
+      # host Docker daemon and reuse the cached registry credentials. The host
+      # has no Node, so the JS-based actions/checkout can't run here; do a
+      # minimal shallow fetch of this commit with plain git instead.
       - name: Checkout repository
-        uses: actions/checkout@v4
+        run: |
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git -c http.extraheader="AUTHORIZATION: basic $(printf '%s' '${{ github.actor }}:${{ github.token }}' | base64 -w0)" \
+            fetch --depth 1 origin "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
 
       # No docker login step: the host runner was authenticated to
       # gitea.tourolle.paris with `docker login` during setup, so its cached