.gitea/workflows/ci.yml

@@ -84,19 +84,16 @@ jobs:
     needs: skip-ci-check
     runs-on: ubuntu-latest
     if: needs.skip-ci-check.outputs.should-skip != '1' && (github.event_name == 'pull_request' || github.ref == 'refs/heads/master')
+    env:
+      PIP_NO_CACHE_DIR: "1"
     container:
-      image: node:20-bullseye
+      image: python:3.11-slim-bookworm
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Bootstrap pip (no apt — act runner hits bullseye GPG errors)
-        run: |
-          python3 --version
-          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
-          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
-          python3 /tmp/get-pip.py --disable-pip-version-check
-          python3 -m pip --version
+      - name: Show disk space (runner may be full)
+        run: df -h / /tmp || true
 
       - name: Configure CI Ansible (no vault, localhost inventory)
         run: |
@@ -124,11 +121,10 @@ jobs:
           echo "ANSIBLE_INVENTORY=/tmp/ci-inventory.ini" >> "$GITHUB_ENV"
 
       - name: Install Ansible and linting tools
-        run: python3 -m pip install --no-cache-dir ansible ansible-lint yamllint pyyaml
-
-      - name: Install Ansible collections
         run: |
+          python3 -m pip install --no-cache-dir ansible-core ansible-lint yamllint pyyaml
           ansible-galaxy collection install -r collections/requirements.yml
+          rm -rf /root/.cache/pip /tmp/pip-* 2>/dev/null || true
 
       - name: Validate YAML syntax
         run: |
@@ -255,21 +251,16 @@ jobs:
     needs: skip-ci-check
     if: needs.skip-ci-check.outputs.should-skip != '1'
     runs-on: ubuntu-latest
+    env:
+      PIP_NO_CACHE_DIR: "1"
     container:
-      image: node:20-bullseye
+      image: python:3.11-slim-bookworm
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Bootstrap pip (no apt)
-        run: |
-          python3 --version
-          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
-          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
-          python3 /tmp/get-pip.py --disable-pip-version-check
-
       - name: Install Ansible
-        run: python3 -m pip install --no-cache-dir ansible
+        run: python3 -m pip install --no-cache-dir ansible-core
 
       - name: Validate vault files are encrypted
         run: |
@@ -306,19 +297,14 @@ jobs:
     needs: skip-ci-check
     if: needs.skip-ci-check.outputs.should-skip != '1'
     runs-on: ubuntu-latest
+    env:
+      PIP_NO_CACHE_DIR: "1"
     container:
-      image: node:20-bullseye
+      image: python:3.11-slim-bookworm
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Bootstrap pip (no apt)
-        run: |
-          python3 --version
-          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
-          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
-          python3 /tmp/get-pip.py --disable-pip-version-check
-
       - name: Configure CI Ansible (no vault, localhost inventory)
         run: |
           set -e
@@ -375,11 +361,10 @@ jobs:
           echo "ANSIBLE_INVENTORY=/tmp/ci-inventory.ini" >> "$GITHUB_ENV"
 
       - name: Install Ansible
-        run: python3 -m pip install --no-cache-dir ansible
-
-      - name: Install Ansible collections
         run: |
+          python3 -m pip install --no-cache-dir ansible-core
           ansible-galaxy collection install -r collections/requirements.yml
+          rm -rf /root/.cache/pip /tmp/pip-* 2>/dev/null || true
 
       - name: Validate playbooks (CI inventory, no vault)
         run: |