From 508834633e18c8f93bc836ee029b0174ece2bd83 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 18 Apr 2026 15:01:24 -0500 Subject: [PATCH] ci: install docker CLI from static tarball, not apt The runner image's bookworm apt repos have been failing GPG verification with "At least one invalid signature was encountered" on every job. Clearing lists and reinstalling debian-archive-keyring on the host doesn't help because the runner spins up a fresh container per job. Dodge apt entirely by grabbing the static Docker 27.5.1 client binary from download.docker.com. The binary talks to the host's /var/run/docker.sock that act_runner mounts into the job container, which is all we need for build + push. --- .forgejo/workflows/build.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml index d6207139..d165efb3 100644 --- a/.forgejo/workflows/build.yaml +++ b/.forgejo/workflows/build.yaml @@ -24,7 +24,17 @@ jobs: - name: Install Docker CLI run: | - apt-get update && apt-get install -y docker.io + # Dodge apt entirely — the runner image's bookworm repos have been + # failing GPG verification with "At least one invalid signature". + # The static Docker client binary talks to the host's daemon socket + # that act_runner mounts into the job container, which is all we + # need for `docker build` / `docker push`. + curl -fsSL -o /tmp/docker.tgz \ + https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz + tar xzf /tmp/docker.tgz -C /tmp + install -m 0755 /tmp/docker/docker /usr/local/bin/docker + rm -rf /tmp/docker /tmp/docker.tgz + docker --version - name: Generate image tag id: tag