fix(ci): wrap kaniko in act-compatible image

act starts job containers with entrypoint /bin/sleep, which kaniko's
scratch-based image lacks (busybox lives under /busybox). kaniko-act
adds the single missing symlink; bootstrap build is manual, documented
in the Dockerfile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -11,9 +11,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      # Daemonless image builder; :debug variant ships a busybox shell so
+      # Daemonless image builder: kaniko :debug plus the /bin/sleep symlink
-      # act can exec steps inside it. No docker socket, no privileges.
+      # act needs for job-container PID 1 (see ci/Dockerfile.kaniko-act).
-      image: gcr.io/kaniko-project/executor:v1.23.2-debug
+      # No docker socket, no privileges.
+      image: pi5-16.local:3005/mikkeli/kaniko-act:v1.23.2
 
     steps:
       - name: Fetch source, build, push

ci/Dockerfile.kaniko-act

@@ -0,0 +1,13 @@
+# Kaniko executor adapted for Gitea act_runner job containers.
+#
+# act starts job containers with entrypoint /bin/sleep; kaniko's image
+# already symlinks /bin/sh -> /busybox/sh but ships no /bin/sleep.
+# This wrapper adds that one symlink. Nothing else changes.
+#
+# Bootstrap: the first build of this image is done manually on the host
+# (docker build -f ci/Dockerfile.kaniko-act -t <registry>/mikkeli/kaniko-act:<ver> .)
+# because no builder image exists yet. Later version bumps can be built by
+# the build-image workflow itself, using the previous kaniko-act.
+FROM gcr.io/kaniko-project/executor:v1.23.2-debug
+SHELL ["/busybox/sh", "-c"]
+RUN ln -sf /busybox/sleep /bin/sleep