ci: route trusted Docker gates through isolated DinD

.gitea/workflows/release-gates.yml

@@ -15,8 +15,31 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  source-trust:
+    name: Trusted workflow source
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Accept trusted push and manual runs
+        if: ${{ gitea.event_name != 'pull_request' }}
+        run: echo "Trusted non-PR workflow source."
+      - name: Require a same-repository pull request
+        if: ${{ gitea.event_name == 'pull_request' }}
+        env:
+          HEAD_REPOSITORY: ${{ gitea.event.pull_request.head.repo.full_name }}
+          TARGET_REPOSITORY: ${{ gitea.repository }}
+        run: |
+          set -euo pipefail
+          test -n "$HEAD_REPOSITORY"
+          if [ "$HEAD_REPOSITORY" != "$TARGET_REPOSITORY" ]; then
+            echo "Docker-capable release validation refuses forked pull requests." >&2
+            exit 1
+          fi
+          echo "Trusted same-repository pull request."
+
   quality:
     name: Compile, test, contracts and builds
+    needs: source-trust
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
@@ -24,7 +47,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Verified secret scan
-        run: bash scripts/scan_secrets.sh
+        env:
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
+        run: |
+          docker info >/dev/null
+          bash scripts/scan_secrets.sh
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.11"
@@ -68,6 +96,7 @@ jobs:
 
   dependency-audit:
     name: Python and npm vulnerability policy
+    needs: source-trust
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -114,6 +143,7 @@ jobs:
 
   container-gis:
     name: GIS image, SBOM and container scan
+    needs: source-trust
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -123,7 +153,10 @@ jobs:
       - name: Build GIS release image
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: |
+          docker info >/dev/null
           mkdir -p artifacts
           BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           docker build \
@@ -137,11 +170,22 @@ jobs:
       - name: Generate GIS SPDX SBOM
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-gis"
       - name: Enforce GIS container vulnerability policy
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis"
+      - name: Cleanup GIS CI image
+        if: always()
+        env:
+          RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
+        run: docker image rm -f "geointel-ci:$RELEASE_SHA-gis" >/dev/null 2>&1 || true
       - name: Publish GIS container evidence
         if: always()
         uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
@@ -156,6 +200,7 @@ jobs:
 
   container-ai:
     name: AI image, SBOM and container scan
+    needs: source-trust
     if: ${{ gitea.event_name == 'pull_request' || gitea.ref == 'refs/heads/main' || gitea.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
@@ -166,7 +211,10 @@ jobs:
       - name: Build AI release image
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: |
+          docker info >/dev/null
           mkdir -p artifacts
           BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           docker build \
@@ -180,11 +228,22 @@ jobs:
       - name: Generate AI SPDX SBOM
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-ai"
       - name: Enforce AI container vulnerability policy
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
         run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-ai"
+      - name: Cleanup AI CI image
+        if: always()
+        env:
+          RELEASE_SHA: ${{ gitea.sha }}
+          DOCKER_HOST: tcp://gitea-runner-dind:2375
+          DOCKER_TLS_CERTDIR: ""
+        run: docker image rm -f "geointel-ci:$RELEASE_SHA-ai" >/dev/null 2>&1 || true
       - name: Publish AI container evidence
         if: always()
         uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de

.gitea/workflows/runner-docker-diagnostic.yml

@@ -1,47 +0,0 @@
-name: Runner Docker diagnostic
-
-on:
-  push:
-    branches:
-      - chatgpt/geointel-hardening-20260826
-
-permissions:
-  contents: read
-
-jobs:
-  diagnostic:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    env:
-      DOCKER_HOST: tcp://gitea-runner-dind:2375
-      DOCKER_TLS_CERTDIR: ""
-    steps:
-      - name: Verify isolated shared runner daemon
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker info >/tmp/docker-info.txt
-          docker version
-
-          mapfile -t visible_names < <(docker ps -a --format '{{.Names}}')
-          echo "visible-container-count=${#visible_names[@]}"
-          for name in "${visible_names[@]}"; do
-            case "$name" in
-              GITEA-ACTIONS-TASK-*) ;;
-              *)
-                echo "Unexpected non-Actions container visible: $name" >&2
-                exit 1
-                ;;
-            esac
-          done
-
-          workdir="$(mktemp -d)"
-          printf 'geo-intel-ci\n' > "${workdir}/proof.txt"
-          cat > "${workdir}/Dockerfile" <<'EOF'
-          FROM scratch
-          COPY proof.txt /proof.txt
-          EOF
-          tag="geointel-runner-diagnostic:${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}"
-          docker build --pull=false -t "$tag" "${workdir}"
-          docker image inspect "$tag" --format '{{.Id}}'
-          docker image rm "$tag" >/dev/null