chore(ci): fire Blacksmith (my wallet screamed)

[s0up4200]

Blacksmith costs more than my moral support budget.

Switched workflows back to ubuntu-latest + standard Docker Buildx actions, with GHA layer cache so builds don’t crawl.

Summary by CodeRabbit

• Chores
  • Switched CI/CD to use standard GitHub-hosted runners instead of custom self-hosted hosts.
  • Updated release and build workflows to newer action versions, added Docker build caching for faster builds and adjusted provenance/credentials handling.
  • Improved automated formatting flow with more robust branch management, staged-change guards, and clearer PR creation/updating behavior.

[coderabbitai]

Walkthrough

GitHub Actions workflows switch runners from a custom self-hosted label to ubuntu-latest. The format workflow refactors commit/PR handling into an inline script. The release workflow updates Docker build steps to Buildx and docker/build-push-action@v6, adds caching and adjusts build-arg/env handling.

Changes

Cohort / File(s)	Summary
Runner Migration .github/workflows/claude.yml.disabled, .github/workflows/license-update.yml	Changed runs-on from blacksmith-2vcpu-ubuntu-2404 to ubuntu-latest; whitespace/formatting only otherwise.
Format Workflow Enhancement .github/workflows/format.yml	Switched runner to ubuntu-latest and refactored commit/PR flow into an inline shell script: branch handling (chore/auto-format), staged-change guard, gh pr create usage, and forced push/update behavior.
Release Workflow Modernization .github/workflows/release.yml	Replaced custom runners with ubuntu-latest, added top-level permissions, swapped Blacksmith builder steps for Docker Buildx, upgraded to docker/build-push-action@v6, introduced cache-from/cache-to, and adjusted build-arg/env usage (POLAR_ORG_ID moved to env in places).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• chore(workflows): update runners from 4vcpu to 2vcpu for all jobs #859: Updates GitHub Actions workflow runner configurations; this PR replaces blacksmith runners with GitHub-hosted alternatives while the related PR involved custom runner version adjustments.

Poem

🐰 From forge to cloud I hop and cheer,
New runners hum, the paths are clear,
Buildx stacks the blocks with care,
Caches saved in cozy lair,
I nibble commits and PRs near 🌿

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main objective: removing the Blacksmith CI service and replacing it with standard GitHub-hosted runners, which aligns with all modified workflow files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/ci-fire-blacksmith

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

.github/workflows/release.yml (2)

265-271: ⚠️ Potential issue | 🟠 Major

Move secrets from build-args to BuildKit secrets to prevent exposure in image history.

Passing GITHUB_TOKEN and POLAR_ORG_ID as build-args persists them in image layers. Use the secrets: parameter with BuildKit secret mounts instead:

Suggested workflow and Dockerfile changes

Workflow (.github/workflows/release.yml):

          build-args: |
            BUILDTIME=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
            VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
            BUILDER=${{ github.actor }}@github-actions
-           GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
-           POLAR_ORG_ID=${{ secrets.POLAR_ORG_ID }}
+         secrets: |
+           POLAR_ORG_ID=${{ secrets.POLAR_ORG_ID }}

Dockerfile (./distrib/docker/ci.Dockerfile):
Replace the ARG POLAR_ORG_ID="" line and the build step with:

- ARG POLAR_ORG_ID=""
  ...
- RUN CGO_ENABLED=0 go build -trimpath -ldflags="..." -o qui ./cmd/qui
+ RUN --mount=type=secret,id=POLAR_ORG_ID \
+     CGO_ENABLED=0 go build -trimpath -ldflags="\
      -s -w \
      -X github.com/autobrr/qui/internal/buildinfo.Version=${VERSION} \
      -X github.com/autobrr/qui/internal/buildinfo.Date=${BUILDTIME} \
      -X github.com/autobrr/qui/internal/buildinfo.Commit=${REVISION} \
-     -X main.PolarOrgID=${POLAR_ORG_ID}" \
+     -X main.PolarOrgID=$(cat /run/secrets/POLAR_ORG_ID)" \
      -o qui ./cmd/qui

(Note: GITHUB_TOKEN does not appear to be used in the Dockerfile; remove it unless needed elsewhere.)

---

303-334: ⚠️ Potential issue | 🟡 Minor

Add --dry-run validation and consider using --raw flag for more robust manifest verification.

While the basic approach is correct, the manifest creation should validate before pushing. Add --dry-run to the imagetools create command to verify the manifest list before committing it, and enhance the inspect step to use --raw for machine-readable output (e.g., docker buildx imagetools inspect --raw ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} | jq .) for robust verification in CI.

🤖 Fix all issues with AI agents

In @.github/workflows/format.yml:
- Around line 64-68: After unstaging web/pnpm-lock.yaml with git reset HEAD
web/pnpm-lock.yaml you must check whether any staged changes remain before
running git commit; replace the unconditional git commit -m "chore(fmt):
auto-format code" with a conditional that inspects staged changes (e.g., via git
diff --staged --quiet or git diff --cached --name-only) and only commits when
changes exist, otherwise skip the commit/PR creation steps. Update the workflow
around the commands git add ., git reset HEAD web/pnpm-lock.yaml, and git commit
to perform this staged-change check and abort the PR creation path when there is
nothing to commit.

In @.github/workflows/release.yml:
- Around line 251-264: The workflow uses GitHub Actions GHA cache export via
"cache-to: type=gha,mode=max" in the "Build and publish image" step (id:
docker_build) which requires the repository permissions to include actions:
write; update the workflow's permissions block in release.yml to add actions:
write (alongside existing contents: write and packages: write) so the
docker/build-push-action@v6 can successfully export the GHA cache.