Same fix as nxtgauge-frontend-solid: registry_prune.py sorted candidate
tags by the manifest GET response's Date header (the moment of the
request, not the image's actual build time), making the "keep newest N"
sort effectively random whenever multiple tags are touched in the same
prune run - which happens on every single run, since the tag just
pushed by this same build is always one of the candidates. That let the
prune step delete the image a run had just built, before gitops even
got a chance to reference it.
Now reads the real "created" timestamp from the image's config blob and
always protects the current run's own SHA from deletion regardless of
sort order.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GITOPS_PAT auth was failing against Forgejo. GitHub is the source of
truth for nxtgauge-gitops; push there and let sync-to-forgejo.yml
relay to Forgejo, which Flux actually watches.
Same fix as nxtgauge-frontend-solid: GITEOPS_REPO/GITEOPS_SSH_KEY were
never configured as repo secrets. Switch to an HTTPS clone with
GITOPS_PAT, matching nxtgauge-backend-rust's already-working workflow.
Same fix as nxtgauge-frontend-solid: buildx writes its metadata file
pretty-printed, so the compact ":"-only grep pattern never matched,
failing the build-and-push step right after a successful push and
skipping the GitOps-release step. Match backend-rust's
whitespace-tolerant pattern.
Same fix as nxtgauge-backend-rust and nxtgauge-frontend-solid: every
build here has been failing with "Cannot connect to the Docker daemon
at tcp://127.0.0.1:2375" since the job container is nested inside the
runner pod's dind sidecar. Detect the real gateway from
/proc/net/route instead of hardcoding loopback.
