zola 0.23 changes config.toml ([markdown.highlighting] no longer takes
`enabled`) and moved its binary in the image, while the flake that
runs the tests and local serve still has 0.22.1. Bumping only the
image split the two and broke the build (runs 411, 412). Go back to
0.22.1 and have Renovate leave the image pin alone: bump both together
by hand, with the config migration.
Assisted-by: Claude:opus-5-5
zola's image moved the binary from /bin/zola to /zola, outside PATH,
so the build stage failed with "zola: executable file not found"
after the Renovate bump to 0.23.6 (deploy run 411).
Assisted-by: Claude:opus-5-5
Forgejo reserves names starting with FORGEJO_, and since runner v13
secrets.FORGEJO_TOKEN, _USER and _REGISTRY no longer reach the job as
the values set on the repository: Kaniko logged in with the wrong
credentials and every image push failed with UNAUTHORIZED.
The registry host and user are not secret (they are in every image
name), so write them in the workflow; the token comes from FJ_TOKEN,
as in datacenterbingo.
Assisted-by: Claude:opus-5-5
The runner mounts a persistent nix-store volume over /nix, and the
nixos/nix image makes /etc/nix/nix.conf a symlink into /nix/store. When
the volume and image versions differ, the link dangles and appending to
it fails before checkout. That broke asxpio and datacenterbingo CI on
2026-10-18.
Pass the settings in NIX_CONFIG instead, with build-users-group empty
and the sandbox off as the image config has them.
Assisted-by: Claude:opus-5-5
