ci: drop container: for Godot jobs, install via composite action

The first Gitea Actions runs failed at actions/checkout@v4 because
barichello/godot-ci:4.6 ships without Node.js, which the JS-based
checkout action requires. Rather than chase a Godot CI image that
bundles Node, drop the container: blocks entirely: the default
catthehacker/ubuntu:act-latest runner image already has Node /
Python / git / JDK, and Godot is installed per-job from the
official GitHub release.

Pulled the install logic into a local composite action at
.gitea/actions/setup-godot/ to avoid duplicating 15 lines of wget +
unzip across the three Godot-using jobs. Inputs:
  - version  (default 4.6)
  - templates (default false — export jobs flip to true)

Other tweaks:
- export-android now puts $ANDROID_HOME under $GITHUB_WORKSPACE so
  no sudo is needed; editor_settings-4.tres interpolates that path.
- export-android writes the keystore under /tmp instead of /root
  (catthehacker runners don't run as root).

README updated: jobs table reflects the new "Tooling installed by the
job" column, prerequisites no longer mention the Docker image, and
known-issue #1 is closed out with the dated fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/actions/setup-godot/action.yml

@@ -0,0 +1,43 @@
+name: Setup Godot
+description: Download a Godot headless Linux binary and (optionally) export templates.
+
+inputs:
+  version:
+    description: Godot version (e.g. 4.6). Templates land under <version>.stable.
+    required: false
+    default: "4.6"
+  templates:
+    description: Install export templates too. "true" / "false".
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install Godot ${{ inputs.version }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        VER="${{ inputs.version }}"
+        URL="https://github.com/godotengine/godot/releases/download/${VER}-stable/Godot_v${VER}-stable_linux.x86_64.zip"
+        wget -q "$URL" -O /tmp/godot.zip
+        mkdir -p "$HOME/bin"
+        unzip -q /tmp/godot.zip -d /tmp
+        mv "/tmp/Godot_v${VER}-stable_linux.x86_64" "$HOME/bin/godot"
+        chmod +x "$HOME/bin/godot"
+        echo "$HOME/bin" >> "$GITHUB_PATH"
+        "$HOME/bin/godot" --version
+
+    - name: Install export templates
+      if: inputs.templates == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        VER="${{ inputs.version }}"
+        URL="https://github.com/godotengine/godot/releases/download/${VER}-stable/Godot_v${VER}-stable_export_templates.tpz"
+        wget -q "$URL" -O /tmp/templates.tpz
+        DEST="$HOME/.local/share/godot/export_templates/${VER}.stable"
+        mkdir -p "$DEST"
+        unzip -q /tmp/templates.tpz -d /tmp/templates_extracted
+        mv /tmp/templates_extracted/templates/* "$DEST/"
+        ls "$DEST" | head

.gitea/workflows/README.md

@@ -5,19 +5,26 @@ Workflow defined in [`build.yml`](./build.yml). Triggered on push / PR to
 
 ## Jobs
 
-| Job                  | Image                       | Role                                                                                     |
-|----------------------|-----------------------------|------------------------------------------------------------------------------------------|
-| `validate`           | `barichello/godot-ci:4.6`   | `godot --headless --import` then grep for `SCRIPT ERROR` / `Parse Error`. Uploads `.godot/` cache. |
-| `lint`               | `ubuntu-latest` (Python)    | `gdlint scripts db scenes` via `gdtoolkit==4.*` (Scony). Parallel to `validate`; does not gate exports yet. |
-| `export-desktop`     | `barichello/godot-ci:4.6`   | Matrix: Windows / Linux / macOS. Reuses the import cache, uploads each binary as artifact. |
-| `export-android`     | `barichello/godot-ci:4.6` + JDK 17 + Android SDK installed at runtime | Provisions keystore, writes `editor_settings-4.tres` with SDK / JDK paths, exports APK. |
+All jobs run on the default `ubuntu-latest` runner image (which already
+ships Node, Python, git, wget, unzip, etc.). Godot is installed per-job
+via the local composite action [`.gitea/actions/setup-godot`](../actions/setup-godot/action.yml),
+which downloads the official Linux binary from the godotengine GitHub
+release and (optionally) export templates into `$HOME`.
+
+| Job              | Tooling installed by the job                                              | Role                                                                                     |
+|------------------|---------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
+| `validate`       | Godot binary (no templates)                                               | `godot --headless --import` then grep for `SCRIPT ERROR` / `Parse Error`. Uploads `.godot/` cache. |
+| `lint`           | `gdtoolkit==4.*` via `pip`                                                | `gdlint scripts db scenes`. Parallel to `validate`; does not gate exports yet.           |
+| `export-desktop` | Godot binary + export templates                                           | Matrix: Windows / Linux / macOS. Reuses the import cache, uploads each binary as artifact. |
+| `export-android` | Godot binary + export templates + JDK 17 + Android SDK (under `$GITHUB_WORKSPACE/.android-sdk`) | Provisions keystore, writes `editor_settings-4.tres` with SDK / JDK paths, exports APK. |
 
 Artifacts are kept 14 days, accessible from the Gitea run page.
 
 ## Prerequisites before the first successful run
 
-1. **Docker image tag** — verify `barichello/godot-ci:4.6` exists on Docker
-   Hub. Otherwise adjust `GODOT_IMAGE` (common alternatives: `4.3`, `4.4`).
+1. **Godot version** — `GODOT_VERSION` is set at the top of the workflow
+   (currently `4.6`). The setup action expects a stable release on the
+   godotengine GitHub releases page; bump in lockstep with the project.
 2. **macOS preset missing** — add it in Godot Editor → Project → Export →
    Add → macOS, name it exactly `macOS` (or change the matrix entry). The
    `.zip` will be unsigned; on Mac it needs
@@ -25,9 +32,11 @@ Artifacts are kept 14 days, accessible from the Gitea run page.
 3. **`Linux/X11Debug` preset** — Godot-3-era name. Reopen the project in
    Godot 4 once and re-save the preset (the editor may rename it). Update
    the matrix `preset:` field accordingly if it does.
-4. **Gitea runner** — must support Docker containers (`act_runner` in
-   `docker` mode, or `host` mode with Docker installed). Check
-   `act_runner exec` access to Docker Hub.
+4. **Gitea runner** — `act_runner` with the default
+   `catthehacker/ubuntu:act-latest` image is enough; no Docker-in-Docker
+   needed now that no job uses `container:`. The runner must reach
+   `github.com` (for actions + Godot release downloads) and
+   `dl.google.com` (for the Android SDK).
 5. **Optional secret** `ANDROID_KEYSTORE_BASE64` — `base64 -w0 debug.keystore`,
    stored as a Gitea repo secret. Without it, a throwaway keystore is
    generated per run, so the APK signature changes every build.
@@ -47,6 +56,48 @@ Suppress specific rules per-line with `# gdlint: disable=<rule>` or
 project-wide with a `gdlintrc` file at the repo root (see
 [gdtoolkit docs](https://github.com/Scony/godot-gdscript-toolkit/wiki)).
 
+## Known issues from first runs
+
+Captured from the first triggered runs on `feature/godot-migration`
+(2026-05-17). Both must be resolved before the workflow can pass.
+
+### 1. Container jobs failed with `node: not found` (resolved 2026-05-17)
+
+The first runs used `container: barichello/godot-ci:4.6` for the Godot
+jobs. That image does not ship Node.js, so `actions/checkout@v4` (a JS
+action) crashed at startup with
+`OCI runtime exec failed: exec: "node": executable file not found`.
+
+Resolved by removing every `container:` block. The runner's default
+`catthehacker/ubuntu:act-latest` image already has Node / Python / git /
+JDK, and Godot is now installed at the start of each job via the local
+composite action `.gitea/actions/setup-godot/`.
+
+### 2. `actions/checkout` clones the wrong URL (resolved 2026-05-17)
+
+The first runs failed at clone time because the runner asked for
+`https://dev.stilobique.com/darknight/puzzle-quest/info/refs` while
+Gitea was mounted under `/gitea/` behind YunoHost — the request was
+intercepted by the YunoHost SSO at the root and redirected before
+reaching Gitea.
+
+Resolved by relocating Gitea to the root: it now serves at
+`https://dev.stilobique.com/` directly (API at `/api/v1/...`,
+`clone_url` at `/<owner>/<repo>.git`). The runner-injected
+`GITHUB_SERVER_URL` and the actual Gitea base URL now agree.
+
+If Gitea is ever moved back under a sub-path, the fix is `ROOT_URL` in
+`app.ini` (`[server] ROOT_URL = https://<host>/<prefix>/`) or
+re-registering `act_runner` with the full instance URL.
+
+### 3. Default-branch mismatch
+
+The Gitea API reports `default_branch: main` for the repo, but
+`CLAUDE.md` describes `dev` as the default. The workflow listens to both,
+so jobs trigger correctly either way, but the "Workflows" sidebar in the
+Gitea UI reads from whatever the actual default branch is. If you intend
+`dev` to be the default, update it under repo Settings → Branches.
+
 ## Differences from the old `.drone.yml`
 
 - No more Drone, no more Butler — build only, artifacts downloadable from

.gitea/workflows/build.yml

@@ -9,7 +9,6 @@ on:
 
 env:
   GODOT_VERSION: "4.6"
-  GODOT_IMAGE: "barichello/godot-ci:4.6"
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -18,11 +17,13 @@ jobs:
   validate:
     name: Validate GDScript
     runs-on: ubuntu-latest
-    container:
-      image: barichello/godot-ci:4.6
     steps:
       - uses: actions/checkout@v4
 
+      - uses: ./.gitea/actions/setup-godot
+        with:
+          version: ${{ env.GODOT_VERSION }}
+
       - name: Import project (parses every .gd / .tscn)
         run: |
           godot --headless --import 2>&1 | tee /tmp/godot-import.log || true
@@ -72,8 +73,6 @@ jobs:
     name: Export ${{ matrix.platform }}
     needs: validate
     runs-on: ubuntu-latest
-    container:
-      image: barichello/godot-ci:4.6
     strategy:
       fail-fast: false
       matrix:
@@ -93,6 +92,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: ./.gitea/actions/setup-godot
+        with:
+          version: ${{ env.GODOT_VERSION }}
+          templates: "true"
+
       - name: Restore import cache
         uses: actions/download-artifact@v3
         with:
@@ -114,7 +118,7 @@ jobs:
           retention-days: 14
 
   # ---------------------------------------------------------------------------
-  # 4. Android export — needs JDK + Android SDK on top of the Godot image.
+  # 4. Android export — Godot + JDK 17 + Android SDK installed in $HOME.
   #    Provide ANDROID_KEYSTORE_BASE64 as a Gitea secret for a stable signature;
   #    otherwise a fresh debug keystore is generated on each run.
   # ---------------------------------------------------------------------------
@@ -122,21 +126,25 @@ jobs:
     name: Export Android
     needs: validate
     runs-on: ubuntu-latest
-    container:
-      image: barichello/godot-ci:4.6
     env:
-      ANDROID_HOME: /opt/android-sdk
-      JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
+      ANDROID_HOME: ${{ github.workspace }}/.android-sdk
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install JDK 17 + unzip
+      - uses: ./.gitea/actions/setup-godot
+        with:
+          version: ${{ env.GODOT_VERSION }}
+          templates: "true"
+
+      - name: Install JDK 17
         run: |
-          apt-get update
-          apt-get install -y --no-install-recommends openjdk-17-jdk wget unzip
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends openjdk-17-jdk
+          echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
 
       - name: Install Android command-line tools + SDK
         run: |
+          set -euo pipefail
           mkdir -p "$ANDROID_HOME/cmdline-tools"
           wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline.zip
           unzip -q /tmp/cmdline.zip -d "$ANDROID_HOME/cmdline-tools"
@@ -149,14 +157,14 @@ jobs:
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
         run: |
-          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
-            echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > /root/debug.keystore
+          if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ]; then
+            echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/debug.keystore
           else
             keytool -keyalg RSA -genkeypair -alias androiddebugkey -keypass android \
-              -keystore /root/debug.keystore -storepass android \
+              -keystore /tmp/debug.keystore -storepass android \
               -dname "CN=Android Debug,O=Android,C=US" -validity 9999
           fi
-          sed -i 's@keystore/debug=".*"@keystore/debug="/root/debug.keystore"@g' export_presets.cfg
+          sed -i 's@keystore/debug=".*"@keystore/debug="/tmp/debug.keystore"@g' export_presets.cfg
 
       - name: Write Godot editor settings (Android SDK / JDK paths)
         run: |
@@ -164,9 +172,9 @@ jobs:
           cat > ~/.config/godot/editor_settings-4.tres <<EOF
           [gd_resource type="EditorSettings" format=3]
           [resource]
-          export/android/android_sdk_path = "/opt/android-sdk"
+          export/android/android_sdk_path = "${ANDROID_HOME}"
           export/android/java_sdk_path = "/usr/lib/jvm/java-17-openjdk-amd64"
-          export/android/debug_keystore = "/root/debug.keystore"
+          export/android/debug_keystore = "/tmp/debug.keystore"
           export/android/debug_keystore_user = "androiddebugkey"
           export/android/debug_keystore_pass = "android"
           EOF