fix(ci): sync workflow files with master to use internal Harbor registry

Update all .forgejo/workflows/*.yml files to match master branch,
adding the vars.docker_prefix pointing to harbor.cleverthis.com/docker/
so CI jobs pull images from the internal registry instead of Docker Hub.
This resolves the "Failing after 1s" pattern on quality, unit_tests,
build, integration_tests, e2e_tests, helm, push-validation, and
status-check jobs.

.forgejo/workflows/benchmark-scheduled.yml

@@ -15,6 +15,9 @@ on:
                 required: false
                 default: "false"
 
+vars:
+    docker_prefix: "http://harbor.cleverthis.com/docker/"
+
 env:
     UV_VERSION: "0.8.0"
     PYTHON_VERSION: "3.13"
@@ -26,7 +29,7 @@ jobs:
         runs-on: docker
         timeout-minutes: 120
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies
               run: |
@@ -111,7 +114,7 @@ jobs:
         runs-on: docker
         timeout-minutes: 180
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies
               run: |

.forgejo/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     pull_request:
         branches: [master, develop*]
 
+vars:
+    docker_prefix: "http://harbor.cleverthis.com/docker/"
+
 env:
     UV_VERSION: "0.8.0"
     PYTHON_VERSION: "3.13"
@@ -15,7 +18,7 @@ jobs:
     lint:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -59,7 +62,7 @@ jobs:
     typecheck:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -97,7 +100,7 @@ jobs:
     security:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -141,7 +144,7 @@ jobs:
     quality:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -179,7 +182,7 @@ jobs:
     unit_tests:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for merge tests, curl/tar for Helm)
               run: |
@@ -230,7 +233,7 @@ jobs:
     integration_tests:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for integration tests, curl/tar for Helm)
               run: |
@@ -289,7 +292,7 @@ jobs:
         runs-on: docker
         timeout-minutes: 45
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for E2E tests)
               run: |
@@ -334,8 +337,10 @@ jobs:
     coverage:
         runs-on: docker
         container:
-            image: python:3.13-slim
-        needs: [lint, typecheck, security, quality]
+            image: ${{vars.docker_prefix}}python:3.13-slim
+        # unit_tests is included so coverage only runs after tests pass,
+        # preventing misleading results when tests are still in-flight or failing.
+        needs: [lint, typecheck, security, quality, unit_tests]
         steps:
             - name: Install system dependencies (nodejs for checkout, git for merge tests)
               run: |
@@ -409,7 +414,7 @@ jobs:
     build:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -439,7 +444,7 @@ jobs:
         needs: [lint, typecheck, security, quality, unit_tests]
         runs-on: docker
         container:
-            image: docker:dind
+            image: ${{vars.docker_prefix}}docker:dind
             options: --privileged
         steps:
             - name: Start Docker daemon and install dependencies
@@ -465,7 +470,7 @@ jobs:
     helm:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, curl for Helm and kubeconform)
               run: |
@@ -530,7 +535,7 @@ jobs:
         # config (name/email) was set — both are required for any push operation.
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for push validation)
               run: |
@@ -606,7 +611,7 @@ jobs:
         needs: [lint, typecheck, security, quality, unit_tests, integration_tests, e2e_tests, coverage, build, docker, helm, push-validation]
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Check required job results
               run: |

.forgejo/workflows/master.yml

@@ -6,73 +6,19 @@ on:
     pull_request:
         branches: [master, develop]
 
+vars:
+    docker_prefix: "http://harbor.cleverthis.com/docker/"
+
 env:
     UV_VERSION: "0.8.0"
     PYTHON_VERSION: "3.13"
     NOX_DEFAULT_VENV_BACKEND: "uv"
 
 jobs:
-    benchmark-regression:
-        if: forgejo.event_name == 'pull_request'
-        runs-on: docker-benchmark
-        container:
-            image: python:3.13-slim
-
-        steps:
-            - name: Install system dependencies (nodejs for checkout, git for merge tests)
-              run: |
-                  apt-get update && apt-get install -y -qq nodejs git && rm -rf /var/lib/apt/lists/*
-
-            - name: Checkout full history
-              uses: actions/checkout@v4
-              with:
-                  fetch-depth: 0
-
-            - name: Compute base commit
-              id: hash
-              run: |
-                  git fetch origin "${{ forgejo.base_ref }}" --depth=200
-                  BASE_SHA=$(git merge-base HEAD "origin/${{ forgejo.base_ref }}")
-                  echo "ASV_BASE_SHA=${BASE_SHA}" >> $FORGEJO_OUTPUT
-
-            - name: Install dependencies
-              run: |
-                  python -m pip install -U pip
-                  python -m pip install asv virtualenv uv==${{ env.UV_VERSION }} nox
-
-            - name: Restore prior ASV benchmarks
-              env:
-                  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-                  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-                  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-                  ASV_S3_BUCKET: ${{ secrets.ASV_S3_BUCKET }}
-              run: |
-                  python -m pip install awscli
-                  mkdir -p build/asv/results
-                  aws s3 sync "s3://${ASV_S3_BUCKET}/asv/results" build/asv/results --delete || true
-
-            - name: Run asv continuous via nox
-              env:
-                  ASV_BASE_SHA:  ${{ steps.hash.outputs.ASV_BASE_SHA }}
-              run: |
-                  nox -s benchmark_regression
-
-            - name: Archive the results
-              run: |
-                  tar cf /tmp/asv-results.tar build/asv/results build/asv/html
-
-            - name: Upload benchmark artifacts
-              if: always()
-              uses: actions/upload-artifact@v3
-              with:
-                  name: asv-results-pr
-                  path: /tmp/asv-results.tar
-                  retention-days: 30
-
     benchmark-publish:
         if: forgejo.event_name == 'push'
         runs-on: docker-benchmark
-        container: python:3.13-slim
+        container: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install system dependencies (nodejs for checkout, git for merge tests)
               run: |
@@ -126,3 +72,55 @@ jobs:
                   path: /tmp/asv-results.tar
                   retention-days: 30
 
+    benchmark-regression:
+        # Runs benchmark regression on pull requests to detect performance regressions.
+        # This job is informational only — it is NOT listed in status-check's required
+        # needs, so a benchmark regression does not block PR merges.
+        if: forgejo.event_name == 'pull_request'
+        runs-on: docker-benchmark
+        container: ${{vars.docker_prefix}}python:3.13-slim
+        steps:
+            - name: Install system dependencies (nodejs for checkout, git for ASV)
+              run: |
+                  apt-get update && apt-get install -y -qq nodejs git curl && rm -rf /var/lib/apt/lists/*
+
+            - name: Checkout full history
+              uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Install dependencies
+              run: |
+                  python -m pip install -U pip
+                  python -m pip install asv virtualenv uv=${{ env.UV_VERSION }} nox
+
+            - name: Sync prior benchmark results from S3
+              env:
+                  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+                  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+                  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+                  ASV_S3_BUCKET: ${{ secrets.ASV_S3_BUCKET }}
+              run: |
+                  if [ -n "${AWS_ACCESS_KEY_ID}" ] && [ -n "${ASV_S3_BUCKET}" ]; then
+                    python -m pip install awscli
+                    mkdir -p build/asv/results
+                    aws s3 sync "s3://${ASV_S3_BUCKET}/asv/results/" build/asv/results/ || echo "No existing results to sync"
+                  else
+                    echo "Skipping S3 sync - AWS credentials not configured"
+                  fi
+
+            - name: Run benchmark regression via nox
+              env:
+                  NOX_DEFAULT_VENV_BACKEND: uv
+                  ASV_BASE_SHA: master
+              run: |
+                  mkdir -p build
+                  nox -s benchmark_regression 2>&1 | tee build/nox-benchmark-regression-output.log
+
+            - name: Upload benchmark regression log artifact
+              if: always()
+              uses: actions/upload-artifact@v3
+              with:
+                  name: benchmark-regression-logs
+                  path: build/nox-benchmark-regression-output.log
+                  retention-days: 30

.forgejo/workflows/nightly-quality.yml

@@ -7,6 +7,9 @@ on:
   workflow_dispatch:
     # Allow manual trigger for testing
 
+vars:
+  docker_prefix: "http://harbor.cleverthis.com/docker/"
+
 env:
   UV_VERSION: "0.8.0"
   PYTHON_VERSION: "3.13"
@@ -16,7 +19,7 @@ jobs:
   full-quality-suite:
     runs-on: docker
     container:
-      image: python:3.13-slim
+      image: ${{vars.docker_prefix}}python:3.13-slim
     steps:
       - name: Install system dependencies (git for merge tests)
         run: |

.forgejo/workflows/release.yml

@@ -5,6 +5,9 @@ on:
         tags:
             - "v*"
 
+vars:
+    docker_prefix: "http://harbor.cleverthis.com/docker/"
+
 env:
     UV_VERSION: "0.8.0"
     PYTHON_VERSION: "3.13"
@@ -14,7 +17,7 @@ jobs:
     build-wheel:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         steps:
             - name: Install Node.js (required by actions/checkout)
               run: |
@@ -42,7 +45,7 @@ jobs:
     build-docker:
         runs-on: docker
         container:
-            image: docker:dind
+            image: ${{vars.docker_prefix}}docker:dind
             options: --privileged
         needs: [build-wheel]
         steps:
@@ -85,7 +88,7 @@ jobs:
     create-release:
         runs-on: docker
         container:
-            image: python:3.13-slim
+            image: ${{vars.docker_prefix}}python:3.13-slim
         needs: [build-wheel, build-docker]
         steps:
             - name: Install system dependencies