fix(ci): remove container dependency causing stalls + fix release.yml hardcoded token

.gitea/workflows/ci.yml

@@ -2,10 +2,8 @@
 # Triggers on push and pull_request
 # Stages: lint -> test -> build (Android + iOS)
 #
-# NOTE: Both runners (Linux x86_64 + Magrathea ARM64 Mac via Docker emulation)
+# NOTE: Both runners share identical labels [self-hosted, linux, x64].
-# share identical labels [self-hosted, linux, x64]. Gitea assigns randomly.
+# Lint/test use continue-on-error so failures on one runner don't block.
-# Lint/test use continue-on-error: true so Magrathea failures don't block.
-# Android build detects wrong platform and exits 0 gracefully.
 #
 # IMPORTANT: $GITHUB_PATH does NOT persist between steps in Gitea Actions/act.
 # Each step is a separate shell. We export PATH="$PWD/flutter/bin:$PATH" in
@@ -43,7 +41,6 @@ jobs:
       - name: Setup Flutter
         run: |
           set -e
-          # Skip download if Flutter is already available
           if command -v flutter &> /dev/null; then
             echo "Flutter already installed, skipping download."
             flutter --version
@@ -114,19 +111,14 @@ jobs:
           flutter test --reporter=expanded
 
 
-  # ── Stage 2: Android build (uses pre-built container image) ──────
+  # ── Stage 2: Android build (inline setup - no container dependency) ──
-  # The kryz-ci:latest image contains Flutter, JDK 17, Android SDK, and
+  # Removed container: kryz-ci:latest because the image may not exist on
-  # flutter precache --android baked in — eliminating ~3-5 GB of downloads.
+  # the runner host, causing the job to stall indefinitely on docker pull.
-  # Build once on the runner host:
-  #   docker build -f .devcontainer/ci.Dockerfile -t kryz-ci:latest .devcontainer
   build-android:
     name: Build Android
     runs-on: [self-hosted, linux, x64]
     needs: [lint, test]
     if: always()
-    container:
-      image: kryz-ci:latest
-      options: --user vscode
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -140,30 +132,81 @@ jobs:
             exit 0
           fi
 
-      - name: Verify environment
+      - name: Setup Java
         run: |
-          echo "=== Environment check ==="
+          set -e
-          echo "Flutter: $(flutter --version | head -1)"
+          if command -v java &> /dev/null; then
-          echo "Java: $(java -version 2>&1 | head -1)"
+            echo "Java already available: $(java -version 2>&1 | head -1)"
-          echo "SDK tools: $(sdkmanager --version)"
+            export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
-          echo "Android SDK: $ANDROID_HOME"
+            echo "JAVA_HOME=$JAVA_HOME"
-          echo "JAVA_HOME: $JAVA_HOME"
+            exit 0
+          fi
+          apt-get update && apt-get install -y openjdk-17-jre-headless
+          export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+          echo "JAVA_HOME=$JAVA_HOME"
+
+      - name: Setup Flutter
+        run: |
+          set -e
+          if command -v flutter &> /dev/null; then
+            echo "Flutter already installed, skipping download."
+            flutter --version
+            exit 0
+          fi
+          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
+          tar -xf /tmp/flutter.tar.xz -C "$PWD"
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter --version
+
+      - name: Setup Android SDK
+        run: |
+          set -e
+          if [ -d "$ANDROID_HOME/cmdline-tools" ]; then
+            echo "Android SDK already present at $ANDROID_HOME"
+            exit 0
+          fi
+          # Install Android SDK from scratch
+          export ANDROID_HOME=$PWD/android-sdk
+          mkdir -p $ANDROID_HOME/cmdline-tools
+          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d $ANDROID_HOME/cmdline-tools
+          mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest
+          rm /tmp/cmdline-tools.zip
+          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
+          yes | sdkmanager --licenses
+          sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
+          echo "Android SDK setup complete"
+
+      - name: Flutter precache Android
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter precache --android
 
       - name: Install dependencies
-        run: flutter pub get
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter pub get
 
       - name: Generate stubs (lint gate support)
-        run: python3 ci_stub_gen.py
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          python3 ci_stub_gen.py
 
       - name: Run whitelabel build script
         if: hashFiles('theme.json') != ''
-        run: python3 build_whitelabel.py
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          python3 build_whitelabel.py
 
       - name: Build APK (release)
-        run: flutter build apk --release
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter build apk --release
 
       - name: Build App Bundle (release)
-        run: flutter build appbundle --release
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter build appbundle --release
 
       - name: List build outputs
         run: |
@@ -195,5 +238,5 @@ jobs:
           OS=$(uname -s)
           echo "INFO: iOS builds require macOS host with Xcode."
           echo "Detected OS: $OS"
-          echo "Skipping iOS build — it will succeed as a no-op."
+          echo "Skipping iOS build - it will succeed as a no-op."
           echo "To enable iOS builds, configure a native macOS runner with Xcode."

.gitea/workflows/release.yml

@@ -1,11 +1,6 @@
 # kryz-go-flutter Release Pipeline
 # Triggers on version tags (v1.0.0, v1.0.1, etc.)
 # Produces signed artifacts and attaches them to a Gitea Release
-#
-# CONTAINER IMAGE: The build-android job uses a pre-built Docker image
-# (kryz-ci:latest) that includes Flutter, JDK 17, and Android SDK baked in.
-# Build once on the runner host:
-#   docker build -f .devcontainer/ci.Dockerfile -t kryz-ci:latest .devcontainer
 
 name: Release
 
@@ -101,26 +96,74 @@ jobs:
           flutter test --reporter=expanded
 
 
-  # ── Android release build (uses pre-built container image) ──────
+  # ── Android release build (inline setup - no container dependency) ──
+  # Removed container: kryz-ci:latest because the image may not exist on
+  # the runner host, causing the job to stall indefinitely on docker pull.
   build-android:
     name: Build Android Release
     runs-on: [self-hosted, linux, x64]
     needs: [test]
-    container:
-      image: kryz-ci:latest
-      options: --user vscode
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Verify environment
+      - name: Check platform for Android build
         run: |
-          echo "=== Environment check ==="
+          OS=$(uname -s)
-          echo "Flutter: $(flutter --version | head -1)"
+          echo "Detected OS: $OS"
-          echo "Java: $(java -version 2>&1 | head -1)"
+          if [ "$OS" != "Linux" ]; then
-          echo "SDK tools: $(sdkmanager --version)"
+            echo "SKIPPED: Android build requires Linux. Detected $OS."
-          echo "Android SDK: $ANDROID_HOME"
+            exit 0
-          echo "JAVA_HOME: $JAVA_HOME"
+          fi
+
+      - name: Setup Java
+        run: |
+          set -e
+          if command -v java &> /dev/null; then
+            echo "Java already available: $(java -version 2>&1 | head -1)"
+            export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
+            echo "JAVA_HOME=$JAVA_HOME"
+            exit 0
+          fi
+          apt-get update && apt-get install -y openjdk-17-jre-headless
+          export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+          echo "JAVA_HOME=$JAVA_HOME"
+
+      - name: Setup Flutter
+        run: |
+          set -e
+          if command -v flutter &> /dev/null; then
+            echo "Flutter already installed, skipping download."
+            flutter --version
+            exit 0
+          fi
+          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
+          tar -xf /tmp/flutter.tar.xz -C "$PWD"
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter --version
+
+      - name: Setup Android SDK
+        run: |
+          set -e
+          if [ -d "$ANDROID_HOME/cmdline-tools" ]; then
+            echo "Android SDK already present at $ANDROID_HOME"
+            exit 0
+          fi
+          export ANDROID_HOME=$PWD/android-sdk
+          mkdir -p $ANDROID_HOME/cmdline-tools
+          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d $ANDROID_HOME/cmdline-tools
+          mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest
+          rm /tmp/cmdline-tools.zip
+          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
+          yes | sdkmanager --licenses
+          sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
+          echo "Android SDK setup complete"
+
+      - name: Flutter precache Android
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter precache --android
 
       - name: Install Python dependencies
         run: |
@@ -128,14 +171,21 @@ jobs:
           pip install -r requirements.txt || true
 
       - name: Install Flutter dependencies
-        run: flutter pub get
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter pub get
 
       - name: Generate stubs (lint gate support)
-        run: python3 ci_stub_gen.py
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          python3 ci_stub_gen.py
+
+      - name: Run whitelabel build script
+        if: hashFiles('theme.json') != ''
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          python3 build_whitelabel.py
 
-      # If release signing secrets are available, write keystore
-      # and update build.gradle.kts to use a release signing config.
-      # Otherwise fall back to debug keys (current state of the repo).
       - name: Configure release signing
         if: env.ANDROID_KEYSTORE_BASE64 != ''
         env:
@@ -153,10 +203,14 @@ jobs:
           EOF
 
       - name: Build APK (release)
-        run: flutter build apk --release
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter build apk --release
 
       - name: Build App Bundle (release)
-        run: flutter build appbundle --release
+        run: |
+          export PATH="$PWD/flutter/bin:$PATH"
+          flutter build appbundle --release
 
       - name: List build outputs
         run: |
@@ -174,8 +228,6 @@ jobs:
 
 
   # ── iOS release build ───────────────────────────────────────
-  # Note: iOS builds require macOS with Xcode. We skip as a no-op
-  # on Linux runners. To enable, configure a macOS runner.
   build-ios:
     name: Build iOS Release
     runs-on: [self-hosted, linux, x64]
@@ -188,7 +240,7 @@ jobs:
         run: |
           echo "INFO: iOS builds require macOS host with Xcode."
           echo "Our self-hosted runner runs Linux containers via act."
-          echo "Skipping iOS build — it will succeed as a no-op."
+          echo "Skipping iOS build - it will succeed as a no-op."
           echo "To enable iOS builds, configure a native macOS runner."