fix(ci): kyverno CLI arch x86_64 in install-tools; wait for dind certs

- install-tools.sh: the kyverno CLI release tarball is named _linux_x86_64, not
  _linux_amd64 (mirrors infra/devcontainer/Containerfile). The gate job's kyverno
  install 404'd on amd64; map amd64 -> x86_64 for kyverno only.
- act-runner: wait for /certs/client/ca.pem (published by the DinD sidecar) before
  exec-ing the entrypoint, eliminating the startup crash-loop race.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/scripts/install-tools.sh

@@ -24,7 +24,11 @@ install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${
 install_kyverno() {
   have kyverno && return 0
   log "kyverno CLI ${KYVERNO_VERSION}"
-  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
+  # Arch strings differ per tool: the kyverno CLI tarball uses x86_64 (uname -m style),
+  # NOT amd64 — map it here (mirrors infra/devcontainer/Containerfile). chainsaw/kubectl
+  # below use the amd64/arm64 form, so only kyverno needs this.
+  local karch="$arch"; case "$arch" in amd64) karch=x86_64 ;; esac
+  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${karch}.tar.gz"
   curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
 }
 

apps/gitea-actions.yaml

@@ -103,6 +103,22 @@ spec:
         # ---- act_runner: registers with Gitea, dispatches jobs to the DinD daemon ----
         - name: runner
           image: gitea/act_runner:0.2.11
+          # Wait for the DinD sidecar to publish its TLS client certs into the shared
+          # emptyDir before starting the daemon — act_runner reads /certs/client/ca.pem at
+          # startup and hard-exits if it is missing (a startup race against the sidecar).
+          # Then exec the image's normal entrypoint (/sbin/tini -- /opt/act/run.sh), which
+          # registers-from-env on first boot and runs `act_runner daemon`.
+          command:
+            - /bin/sh
+            - -c
+            - |
+              i=0
+              until [ -f /certs/client/ca.pem ]; do
+                i=$((i + 1))
+                [ "$i" -ge 60 ] && { echo "dind certs never appeared" >&2; exit 1; }
+                echo "waiting for dind TLS certs ($i)"; sleep 1
+              done
+              exec /sbin/tini -- /opt/act/run.sh
           env:
             - name: GITEA_INSTANCE_URL
               value: https://gitea.home.keithjackson.dev