refactor(ci): split checks into visible jobs

.gitea/runner/README.md

@@ -1,7 +1,9 @@
 # Homelab CI/CD
 
 The native Gitea runner runs on **vps**; production runs on **workstation**.
-Jobs run on `homelab:host`, one at a time. No job images or Kubernetes credentials
+Compose, workflow, shell, Python, formatting, YAML, Dockerfile and Kubernetes
+checks appear as separate jobs. Jobs run on `homelab:host`, one at a time; the
+build waits for every check to pass. No job images or Kubernetes credentials
 are needed on the VPS. Builds use one pinned BuildKit helper container. CI and deploy are separate workflows.
 
 ## Runner installation

.gitea/workflows/ci.yaml

@@ -12,18 +12,13 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 jobs:
-  checks:
+  compose:
+    name: Compose
     runs-on: homelab
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
-      - name: Prepare pinned tools
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh)"
-          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Validate Compose files
         shell: bash
         run: |
@@ -52,11 +47,37 @@ jobs:
             exit 1
           fi
           echo "checked ${#files[@]} Compose file(s)"
+  workflows:
+    name: Workflows
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh actionlint shellcheck)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Lint Gitea Actions workflows with actionlint
         shell: bash
         run: |
           set -euo pipefail
           actionlint -config-file .gitea/actionlint.yaml -color .gitea/workflows/*.yaml
+  shell:
+    name: Shell
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck jq)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Lint shell scripts with ShellCheck
         shell: bash
         run: |
@@ -70,6 +91,19 @@ jobs:
           fi
           shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
           bash .gitea/tests/deploy-validation.sh
+  formatting:
+    name: Formatting
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh prettier)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Check formatting with Prettier
         shell: bash
         run: |
@@ -87,6 +121,19 @@ jobs:
           fi
 
           prettier --check --ignore-unknown "${prettier_files[@]}"
+  python:
+    name: Python and tests
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh ruff jq)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Lint and format-check Python with Ruff
         shell: bash
         run: |
@@ -94,6 +141,19 @@ jobs:
           ruff check . .gitea/workflows
           ruff format --check . .gitea/workflows
           python3 -m unittest discover -s tests -v
+  yaml:
+    name: YAML
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh yamllint)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Lint YAML syntax
         shell: bash
         run: |
@@ -111,6 +171,19 @@ jobs:
           fi
 
           yamllint -c .yamllint "${yaml_files[@]}"
+  dockerfiles:
+    name: Dockerfiles
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh hadolint)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Lint Dockerfiles
         shell: bash
         run: |
@@ -126,6 +199,19 @@ jobs:
           fi
 
           hadolint -c .hadolint.yaml "${dockerfiles[@]}"
+  kubernetes:
+    name: Kubernetes
+    runs-on: homelab
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Prepare pinned tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh kubeconform)"
+          echo "$tools_dir" >> "$GITHUB_PATH"
       - name: Validate Kubernetes manifests against JSON schemas
         shell: bash
         run: |
@@ -148,7 +234,14 @@ jobs:
             "${manifests[@]}"
   build:
     needs:
-      - checks
+      - compose
+      - workflows
+      - shell
+      - formatting
+      - python
+      - yaml
+      - dockerfiles
+      - kubernetes
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     runs-on: homelab
     timeout-minutes: 60

.gitea/workflows/tool-versions.env

@@ -14,7 +14,7 @@ ACTIONLINT_VERSION="1.7.7"
 SHELLCHECK_VERSION="0.11.0"
 KUBECONFORM_VERSION="0.8.0"
 PRETTIER_VERSION="3.8.1"
-RUFF_VERSION="0.16.10"
+RUFF_VERSION="0.16.8"
 YAMLLINT_VERSION="1.38.0"
 HADOLINT_VERSION="2.14.0"
 # pip-audit reads the advisory database over the network, so a floating version

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.43.1
+    image: docker.n8n.io/n8nio/n8n:2.43.0
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.43.1
+          image: docker.n8n.io/n8nio/n8n:2.43.0
           envFrom:
             - configMapRef:
                 name: n8n-config

traefik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   traefik:
-    image: traefik:v3.7.14
+    image: traefik:v3.7.13
     container_name: traefik
     restart: unless-stopped
     command:

traefik/k8s/traefik-values.yaml

@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.14
+  tag: v3.7.13
 
 securityContext:
   capabilities: