ci(forgejo): use python containers and pip

.forgejo/workflows/ci.yml

@@ -2,8 +2,6 @@
 # Copyright (c) 2026 Rug Munch Media LLC
 # Part of Pry — https://git.rugmunch.io/RugMunchMedia/pryscraper
 # Licensed under MIT. See LICENSE.
-#
-# Force workflow re-parse: bump cache key 2026-07-03-a
 name: CI
 
 on:
@@ -22,70 +20,120 @@ env:
 jobs:
   lint:
     runs-on: docker-x64
+    container:
+      image: python:3.12-slim
     steps:
+      - name: Install Node.js for actions/checkout
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates git
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          rm -rf /var/lib/apt/lists/*
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Install ruff
-        with:
+        run: pip install ruff
-          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Lint
-          cache: pip
+        run: ruff check .
-          cache-dependency-path: pyproject.toml
+      - name: Format check
-      - run: pip install ruff
+        run: ruff format --check .
-      - run: ruff check .
-      - run: ruff format --check .
 
   typecheck:
     runs-on: docker-x64
+    container:
+      image: python:3.12-slim
     steps:
+      - name: Install Node.js for actions/checkout
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates git
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          rm -rf /var/lib/apt/lists/*
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Install dependencies
-        with:
+        run: |
-          python-version: ${{ env.PYTHON_VERSION }}
+          apt-get update
-          cache: pip
+          apt-get install -y --no-install-recommends gcc libpq-dev
-          cache-dependency-path: pyproject.toml
+          rm -rf /var/lib/apt/lists/*
-      - run: pip install -e ".[dev]"
+          pip install -e ".[dev]"
-      - run: mypy --python-version 3.12 --strict --ignore-missing-imports --exclude 'build/|dist/|.git/|__pycache__/' *.py
+      - name: Type check
+        run: mypy --python-version 3.12 --strict --ignore-missing-imports --exclude 'build/|dist/|.git/|__pycache__/' *.py
 
   test:
     runs-on: docker-x64
+    container:
+      image: python:3.12-slim
     steps:
+      - name: Install Node.js for actions/checkout
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates git
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          rm -rf /var/lib/apt/lists/*
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Install dependencies
-        with:
+        run: |
-          python-version: ${{ env.PYTHON_VERSION }}
+          apt-get update
-          cache: pip
+          apt-get install -y --no-install-recommends gcc libpq-dev
-          cache-dependency-path: pyproject.toml
+          rm -rf /var/lib/apt/lists/*
-      - run: pip install -e ".[dev]"
+          pip install -e ".[dev]"
-      - run: pytest tests/ -v --cov=. --cov-report=term-missing --cov-fail-under=40
+      - name: Test
+        run: pytest tests/ -v --cov=. --cov-report=term-missing --cov-fail-under=40
 
   security:
     runs-on: docker-x64
+    container:
+      image: python:3.12-slim
     steps:
+      - name: Install Node.js for actions/checkout
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates git
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          rm -rf /var/lib/apt/lists/*
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Install bandit
-        with:
+        run: pip install bandit
-          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Bandit
-          cache: pip
+        run: bandit -r . -x tests/,.venv,__pycache__
-          cache-dependency-path: pyproject.toml
-      - run: pip install bandit
-      - run: bandit -r . -x tests/,.venv,__pycache__
 
   gitleaks:
     runs-on: docker-x64
+    container:
+      image: python:3.12-slim
     steps:
+      - name: Install Node.js for actions/checkout
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends curl ca-certificates git
+          curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          rm -rf /var/lib/apt/lists/*
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@v2
+      - name: Install gitleaks
-        env:
+        run: |
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          apt-get update
+          apt-get install -y --no-install-recommends wget git ca-certificates
+          rm -rf /var/lib/apt/lists/*
+          wget -qO- https://github.com/gitleaks/gitleaks/releases/download/v8.24.0/gitleaks_8.24.0_linux_x64.tar.gz | tar -xz -C /usr/local/bin gitleaks
+      - name: Run gitleaks
+        run: gitleaks detect --source . --redact --no-banner --no-git
 
   commitlint:
     if: github.event_name == 'pull_request'
     runs-on: docker-x64
+    container:
+      image: node:22-slim
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v6
+      - name: Install commitlint
-        with:
+        run: npm install -g @commitlint/cli @commitlint/config-conventional
-          configFile: .commitlintrc.yml
+      - name: Run commitlint
+        run: commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose