ci: rework Dockerfile image + buildx dep added

.gitea/workflows/ci-image.yml

@@ -18,7 +18,7 @@ jobs:
               uses: actions/checkout@v4
 
             - name: Install Docker CLI
-              run: apk add --no-cache docker-cli
+              run: apk add --no-cache docker-cli docker-cli-buildx
 
             - name: Login to registry
               run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.aramjonghu.dev --username aramjonghu --password-stdin

.gitea/workflows/cpp.yml

@@ -20,28 +20,10 @@ jobs:
                     -exec clang-format -i --style=file {} +
                   git diff --exit-code && echo "clang-format: passed"
 
-    build:
+    build & lint:
         runs-on: alpine
         container:
             image: git.aramjonghu.dev/aramjonghu/zshell-ci:latest
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-              with:
-                  fetch-depth: 0
-
-            - name: Configure
-              run: cmake -B build -G Ninja -DENABLE_MODULES=plugin -DCMAKE_BUILD_TYPE=Release
-
-            - name: Build
-              run: ninja -C build
-
-    clang-tidy:
-        runs-on: alpine
-        container:
-            image: git.aramjonghu.dev/aramjonghu/zshell-ci:latest
-
         steps:
             - name: Checkout
               uses: actions/checkout@v4

.gitea/workflows/js-ts.yml

@@ -4,7 +4,7 @@ on:
     pull_request:
 
 jobs:
-    fmt:
+    fmt & lint:
         runs-on: alpine
         container: node:26-alpine
 
@@ -24,20 +24,6 @@ jobs:
                   else
                     echo "No JS/TS files found"
                   fi
-
-    lint:
-        runs-on: alpine
-        container: node:26-alpine
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Install tools
-              run: |
-                  apk add --no-cache \
-                    git
-
             - name: ESLint
               run: |
                   if [ -n "$(find . \( -iname "*.js" -o -iname "*.jsx" -o -iname "*.ts" -o -iname "*.tsx" -o -iname "*.mjs" -o -iname "*.cjs" \) -print -quit)" ]; then

.gitea/workflows/python.yml

@@ -7,7 +7,7 @@ on:
     pull_request:
 
 jobs:
-    static:
+    fmt & lint:
         runs-on: debian
         container: node:26-trixie-slim
 
@@ -33,7 +33,7 @@ jobs:
                   . .venv/bin/activate
                   ruff check .
 
-    verify:
+    test & nuitka build:
         if: always()
         runs-on: debian
         container: node:26-trixie-slim
@@ -64,4 +64,4 @@ jobs:
             - name: Nuitka module check
               run: |
                   . .venv/bin/activate
-                  nuitka --module --include-package=zshell cli/src/zshell/
+                  nuitka --module --include-package=zshell cli/src/zshell/

.gitea/workflows/rust.yml

@@ -3,8 +3,9 @@ name: Rust
 on:
     pull_request:
 
+# jobs can be separated if we integrate tests
 jobs:
-    build:
+    build, clippy & fmt:
         runs-on: alpine
         container: node:26-alpine
         env:
@@ -34,7 +35,9 @@ jobs:
                   apk add --no-cache \
                     git \
                     cargo \
-                    rust
+                    rust \
+                    rust-clippy \
+                    rustfmt
 
             - name: Cargo check
               run: |
@@ -50,90 +53,6 @@ jobs:
                   else
                     echo "No Rust project found"
                   fi
-
-    fmt:
-        runs-on: alpine
-        container: node:26-alpine
-        env:
-            CARGO_HOME: ${{ github.workspace }}/.cargo
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Cache cargo packages
-              uses: actions/cache@v4
-              env:
-                  cache-name: cache-cargo-packages
-              with:
-                  path: |
-                      .cargo/registry
-                      .cargo/git
-                      target
-                  key: rust-fmt-${{ runner.os }}-${{ env.cache-name }}-${{ hashFiles('**/Cargo.lock') }}
-                  restore-keys: |
-                      rust-${{ runner.os }}-build-${{ env.cache-name }}-
-                      rust-${{ runner.os }}-build-
-                      rust-
-
-            - name: Install tools
-              run: |
-                  apk add --no-cache \
-                    git \
-                    cargo \
-                    rust \
-                    rustfmt
-
-            - name: Format check
-              run: |
-                  if [ -n "$(find . -name "Cargo.toml" -print -quit)" ]; then
-                    status=0
-                    for manifest in $(find . -name "Cargo.toml"); do
-                      cargo fmt --manifest-path "$manifest" --check && \
-                        echo "$manifest: formatting OK" || \
-                        { echo "$manifest: needs formatting"; status=1; }
-                    done
-                    exit $status
-                  elif [ -n "$(find . -name "*.rs" -print -quit)" ]; then
-                    echo "Rust files found but no Cargo.toml"
-                    exit 1
-                  else
-                    echo "No Rust project found"
-                  fi
-
-    clippy:
-        runs-on: alpine
-        container: node:26-alpine
-        env:
-            CARGO_HOME: ${{ github.workspace }}/.cargo
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Cache cargo packages
-              uses: actions/cache@v4
-              env:
-                  cache-name: cache-cargo-packages
-              with:
-                  path: |
-                      .cargo/registry
-                      .cargo/git
-                      target
-                  key: rust-clippy-${{ runner.os }}-${{ env.cache-name }}-${{ hashFiles('**/Cargo.lock') }}
-                  restore-keys: |
-                      rust-${{ runner.os }}-build-${{ env.cache-name }}-
-                      rust-${{ runner.os }}-build-
-                      rust-
-
-            - name: Install tools
-              run: |
-                  apk add --no-cache \
-                    git \
-                    cargo \
-                    rust \
-                    rust-clippy
-
             - name: Clippy
               run: |
                   if [ -n "$(find . -name "Cargo.toml" -print -quit)" ]; then
@@ -150,3 +69,19 @@ jobs:
                   else
                     echo "No Rust project found"
                   fi
+            - name: Format check
+              run: |
+                  if [ -n "$(find . -name "Cargo.toml" -print -quit)" ]; then
+                    status=0
+                    for manifest in $(find . -name "Cargo.toml"); do
+                      cargo fmt --manifest-path "$manifest" --check && \
+                        echo "$manifest: formatting OK" || \
+                        { echo "$manifest: needs formatting"; status=1; }
+                    done
+                    exit $status
+                  elif [ -n "$(find . -name "*.rs" -print -quit)" ]; then
+                    echo "Rust files found but no Cargo.toml"
+                    exit 1
+                  else
+                    echo "No Rust project found"
+                  fi

ci/Dockerfile

@@ -1,56 +1,28 @@
 FROM archlinux:latest
 
-RUN pacman -Syyu --noconfirm
+RUN pacman -Syu --noconfirm \
+ && pacman -S --needed --noconfirm \
+      base-devel cmake ninja clang lld nodejs tree-sitter \
+      jkqtplotter cmark-gfm git \
+      qt6-base qt6-declarative qt6-shadertools qt6-5compat \
+      qt6-canvaspainter qt6-wayland \
+      libqalculate pipewire aubio cava lm_sensors glib2 \
+ && pacman -Scc --noconfirm
 
-# Build toolchain
-RUN pacman -S --noconfirm \
-    base-devel \
-    cmake \
-    ninja \
-    clang \
-    lld \
-    nodejs \
-    tree-sitter \
-    jkqtplotter \
-    cmark-gfm \
-    git
-
-# Qt6
-RUN pacman -S --noconfirm \
-    qt6-base \
-    qt6-declarative \
-    qt6-shadertools \
-    qt6-5compat \
-    qt6-canvaspainter
-
-# Project-specific dependencies
-RUN pacman -S --noconfirm \
-    libqalculate \
-    pipewire \
-    aubio \
-    cava \
-    lm_sensors \
-    glib2
-
-# AUR: libcava (provides development headers for cava)
-RUN pacman -Syu --noconfirm && \
-    pacman -S --needed --noconfirm \
-        sudo \
-        meson \
-        autoconf-archive \
-        python-tqdm && \
-    useradd -m builder && \
-    echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
-
-RUN for i in 1 2 3 4 5; do \
-        rm -rf /tmp/libcava && \
-        git clone --depth 1 https://aur.archlinux.org/libcava.git /tmp/libcava && \
-        break || sleep 5; \
-    done && \
-    test -d /tmp/libcava/.git && \
-    chown -R builder /tmp/libcava
-
-RUN su builder -c "cd /tmp/libcava && makepkg -si --noconfirm" && \
-    rm -rf /tmp/libcava && \
-    userdel -r builder && \
-    sed -i '/^builder/d' /etc/sudoers
+RUN pacman -Syu --noconfirm \
+ && pacman -S --needed --noconfirm \
+      sudo meson autoconf-archive python-tqdm \
+ && useradd -m builder \
+ && printf '%s\n' 'builder ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builder \
+ && chmod 0440 /etc/sudoers.d/builder \
+ && for i in 1 2 3 4 5; do \
+      rm -rf /tmp/libcava; \
+      if git clone --depth 1 https://aur.archlinux.org/libcava.git /tmp/libcava; then break; fi; \
+      sleep 5; \
+    done \
+ && test -d /tmp/libcava/.git \
+ && chown -R builder:builder /tmp/libcava \
+ && su builder -c "cd /tmp/libcava && makepkg -si --noconfirm" \
+ && rm -rf /tmp/libcava /etc/sudoers.d/builder \
+ && userdel -r builder \
+ && pacman -Scc --noconfirm