- Pin all jobs to ubuntu-22.04 runner
- Use curl -sfL with secrets.GITEATOKEN for checkout
- Switch checkout URL to https://gitea-lxc.moon-dragon.us
- Install rustup with --default-toolchain stable --profile minimal
- Add cargo bin to GITHUB_PATH instead of sourcing per-step
- Enforce clippy -D warnings
- Ignore RUSTSEC-2025-0134 in cargo audit
- Pass GITEA_TOKEN via env for release step
- Docker-in-Docker fails with SIGKILL in LXC (even --privileged)
- Native act_runner binary with systemd is the correct approach
- No GitHub action dependencies in Gitea workflows
- Dig deeper on infrastructure issues (cascading problems)
- Don't remove SSH keys without verifying current access
- CI/CD First: set up pipeline before manual builds
- Verify runner before creating workflows
- Dig deeper on infrastructure issues (cascading problems)
- Don't remove SSH keys without verifying current access path