docs: fix double-encoded AGENTS.md, replace Jenkins with Gitea Actions

AGENTS.md

@@ -1 +1,74 @@
-IyBBR0VOVFMubWQKCiMjIFByb2plY3Qgb3ZlcnZpZXcKClRoaXMgcmVwb3NpdG9yeSBidWlsZHMgYW5kIHB1Ymxpc2hlcyBhIERvY2tlciBpbWFnZSBmb3IgW09wZW5Db2RlXShodHRwczovL29wZW5jb2RlLmFpKSwgdGhlIG9wZW4gc291cmNlIEFJIGNvZGluZyBhZ2VudC4gVGhlIGltYWdlIHJ1bnMgT3BlbkNvZGUgaW4gaGVhZGxlc3Mgc2VydmVyIG1vZGUgKGBvcGVuY29kZSBzZXJ2ZWApIGFuZCBpcyBhdXRvbWF0aWNhbGx5IHJlYnVpbHQgYW5kIHB1c2hlZCB0byBEb2NrZXIgSHViIChgamNhYmlsbG90L29wZW5jb2RlYCkgZXZlcnkgbmlnaHQgYnkgYSBHaXRlYSBBY3Rpb25zIHBpcGVsaW5lLgoKIyMgUmVwb3NpdG9yeSBzdHJ1Y3R1cmUKCmBgYAouCuKUnOKUgOKUgCBEb2NrZXJmaWxlICAgICAgICAgICAgICAgICAgICAgICAgIyBJbWFnZSBkZWZpbml0aW9uCuKUnOKUgOKUgCAuZ2l0ZWEvd29ya2Zsb3dzL2RvY2tlci1idWlsZC55YW1sICAjIENJL0NEIHBpcGVsaW5lIChHZXRlYSBBY3Rpb25zKQrilJzilIDilIAgcmVub3ZhdGUuanNvbiAgICAgICAgICAgICAgICAgICAgICMgRGVwZW5kZW5jeSB1cGRhdGUgYXV0b21hdGlvbiAoUmVub3ZhdGVib3QpCuKUnOKUgOKUgCBvcGVuY29kZS1hdHRhY2ggICAgICAgICAgICAgICAgICAgIyBIZWxwZXIgc2NyaXB0IGZvciBhdHRhY2hpbmcgdG8gYSBydW5uaW5nIHNlcnZlcgripZzilIDilIAgUkVBRE1FLm1kICAgICAgICAgICAgICAgICAgICAgICAjIFVzYWdlIGRvY3VtZW50YXRpb24KYGBgCgojIyBEZXBlbmRlbmN5IG1hbmFnZW1lbnQKCi0gKipBbHdheXMgcGluIHZlcnNpb25zKiogaW4gdGhlIERvY2tlcmZpbGUgYG5wbSBpbnN0YWxsYCBjb21tYW5kIChlLmcuIGBvcGVuY29kZS1haUAxLjE2LjIgbjItc291bEA5LjAuOWApLiBOZXZlciBsZWF2ZSBwYWNrYWdlcyB1bnBpbm5lZC4KLSAqKlVwZGF0ZSByZW5vdmF0ZSBjdXN0b21NYW5hZ2VycyoqIHdoZW4gYWRkaW5nLCByZW1vdmluZywgb3IgcmVuYW1pbmcgYSBkZXBlbmRlbmN5IHRyYWNrZWQgaW4gdGhlIERvY2tlcmZpbGUuIEVhY2ggcGlubmVkIHBhY2thZ2UgbXVzdCBoYXZlIGEgY29ycmVzcG9uZGluZyBgY3VzdG9tTWFuYWdlcmAgZW50cnkgaW4gYHJlbm92YXRlLmpzb25gIHdpdGggYSByZWdleCBgbWF0Y2hTdHJpbmdzYCBwYXR0ZXJuIHRoYXQgY2FwdHVyZXMgdGhlIHZlcnNpb24uIElmIGEgZGVwZW5kZW5jeSBpcyBhZGRlZCB3aXRob3V0IGEgcmVub3ZhdGUgZW50cnksIFJlbm92YXRlYm90IHdpbGwgbm90IG9wZW4gYXV0b21hdGVkIFBScwogIGZvciBpdC4KLSAqKmFwdCBwYWNrYWdlcyoqIChhcHQtZ2V0IGluc3RhbGwgbGluZXMgaW4gRG9ja2VyZmlsZSkgYW5kICoqQ09QWSAtLWZyb20qKiBpbWFnZSByZWZlcmVuY2VzIGFyZSBub3QgY3VycmVudGx5IHRyYWNrZWQgYnkgUmVub3ZhdGUuIFBpbm5pbmcgdGhlc2UgbWFudWFsbHkgaXMgYWNjZXB0YWJsZSBmb3Igbm93IGJ1dCBhZGRpbmcgcmVub3ZhdGUgbWFuYWdlcnMgZm9yIHRoZW0gaXMgZW5jb3VyYWdlZC4KCiMjIERvY2tlcmZpbGUgY29udmVudGlvbnMKCi0gKipCYXNlIGltYWdlKio6IGBub2RlOjI0YCDigJQgRGViaWFuLWJhc2VkIE5vZGUuanMgaW1hZ2UgKG5vdCBBbHBpbmUsIG5lZWRlZCBmb3IgYXB0IHBhY2thZ2VzKS4KLSAqKkluc3RhbGwqKjogYG5wbSBpIC1nIG9wZW5jb2RlLWFpQDx2ZXJzaW9uPiBuMi1zb3VsQDx2ZXJzaW9uPmAg4oCUIGluc3RhbGxzIE9wZW5Db2RlIGFuZCBTb3VsIGdsb2JhbGx5LCBib3RoIHBpbm5lZC4KLSAqKlZlcnNpb24gY2hlY2sqKjogYFJVTiBvcGVuY29kZSAtLXZlcnNpb25gIGFmdGVyIGluc3RhbGwgdG8gdmFsaWRhdGUgdGhlIGJ1aWxkIGFuZCByZWNvcmQgdGhlIGluc3RhbGxlZCB2ZXJzaW9uIGluIGJ1aWxkIGxvZ3MuCi0gKipEZWRpY2F0ZWQgdXNlcioqOiBhIG5vbi1yb290IGBvcGVuY29kZWAgdXNlciBhbmQgZ3JvdXAgYXJlIGNyZWF0ZWQgd2l0aCBgZ3JvdXBhZGRgL2B1c2VyYWRkYCAoVUlEL0dJRCAxMDAwKS4gQWxsIHJ1bnRpbWUgc3RlcHMgcnVuIGFzIHRoaXMgdXNlci4KLSAqKkNsdXN0ZXIgdG9vbGluZyoqOiBga3ViZWN0bGAgaXMgY29waWVkIGZyb20gdGhlIG9mZmljaWFsIGByZWdpc3RyeS5rOHMuaW8va3ViZWN0bGAgaW1hZ2UgKG11bHRpLXN0YWdlIENPUFkpLgotICoqRW50cnlwb2ludCoqOiBgWyJvcGVuY29kZSJdYCDigJQgYXJndW1lbnRzIGFyZSBwYXNzZWQgYXQgcnVudGltZSAoZS5nLiBgc2VydmVgKS4KCiMjIENJL0NEIGNvbnZlbnRpb25zIChHaXRlYSBBY3Rpb25zKQoKLSBQaXBlbGluZSB0cmlnZ2VycyBvbiBwdXNoIHRvIGBtYWluYCwgUFJzIHRhcmdldGluZyBgbWFpbmAsIGFuZCBhIG5pZ2h0bHkgY3JvbiAoYGByb246ICcwIDAgKiAqIConYGApLgotIEltYWdlIGlzIHB1c2hlZCB0byBEb2NrZXIgSHViIG9ubHkgb24gbm9uLVBSIGV2ZW50cyAobWFpbiBicmFuY2ggcHVzaGVzIGFuZCBjcm9uIHJ1bnMpLgotIERvY2tlciBIdWIgY3JlZGVudGlhbHMgYXJlIHN0b3JlZCBpbiBHaXRlYSBBY3Rpb25zIHNlY3JldHMgKGBET0NLRVJIVUJfVVNFUk5BTUVgLCBgRE9DS0VSSFVCX1RPS0VOYCkuCi0gVGhlIGltYWdlIGlzIHB1Ymxpc2hlZCBhcyBgamNhYmlsbG90L29wZW5jb2RlOmxhdGVzdGAgd2l0aCBkaWdlc3QgYW5kIGJyYW5jaCB0YWdzLgoKIyMgVXNlZnVsIGNvbW1hbmRzCgpgYGBiYXNoCiMgQnVpbGQgdGhlIGltYWdlIGxvY2FsbHkKZG9ja2VyIGJ1aWxkIC10IG9wZW5jb2RlIC4KCiMgUnVuIHRoZSBzZXJ2ZXIgb24gYWxsIGludGVyZmFjZXMKZG9ja2VyIHJ1biAtaXQgLXAgNDA5Njo0MDk2IG9wZW5jb2RlIC0taG9zdG5hbWUgMC4wLjAuMAoKIyBSdW4gd2l0aCBhIHByb2plY3QgbW91bnRlZApkb2NrZXIgcnVuIC1pdCAtcCA0MDk2OjQwOTYgXAogIC12ICQocHdkKTovaG9tZS9vcGVuY29kZS9wcm9qZWN0IFwKICBvcGVuY29kZSAtLWhvc3RuYW1lIDAuMC4wLjAKCiMgUHJvdGVjdCB3aXRoIGEgcGFzc3dvcmQKZG9ja2VyIHJ1biAtaXQgLXAgNDA5Njo0MDk2IFwKICAtZSBPUEVOQ09ERV9TRVJWRVJfUEFTU1dPUkQ9c2VjcmV0IFwKICBvcGVuY29kZSAtLWhvc3RuYW1lIDAuMC4wLjAKYGBgCgojIyBvcGVuY29kZSBzZXJ2ZSBvcHRpb25zCgp8IEZsYWcgfCBEZWZhdWx0IHwgRGVzY3JpcHRpb24gfAp8LS0tLS0tfC0tLS0tLS0tLXwtLS0tLS0tLS0tLS0tfAp8IGAtLXBvcnRgIHwgYDQwOTZgIHwgUG9ydCB0byBsaXN0ZW4gb24gfAp8IGAtLWhvc3RuYW1lYCB8IGAxMjcuMC4wLjFgIHwgSG9zdG5hbWUgdG8gYmluZCB8CnwgYC0tbWRuc2AgfCBgZmFsc2VgIHwgRW5hYmxlIG1ETlMgZGlzY292ZXJ5IHwKfCBgLS1jb3JzYCB8IGBbXWAgfCBBZGRpdGlvbmFsIGFsbG93ZWQgYnJvd3NlciBvcmlnaW5zIHwKCiMjIEVudmlyb25tZW50IHZhcmlhYmxlcwoKfCBWYXJpYWJsZSB8IERlc2NyaXB0aW9uIHwKfC0tLS0tLS0tLS18LS0tLS0tLS0tLS0tLXwKfCBgT1BFTkNPREVfU0VSVkVSX1BBU1NXT1JEYCB8IEVuYWJsZXMgSFRUUCBiYXNpYyBhdXRoIHwKfCBgT1BFTkNPREVfU0VSVkVSX1VTRVJOQU1FYCB8IE92ZXJyaWRlcyB0aGUgZGVmYXVsdCB1c2VybmFtZSAoYG9wZW5jb2RlYCkgfAo=
+# AGENTS.md
+
+## Project overview
+
+This repository builds and publishes a Docker image for [OpenCode](https://opencode.ai), the open source AI coding agent. The image runs OpenCode in headless server mode (`opencode serve`) and is automatically rebuilt and pushed to Docker Hub (`jcabillot/opencode`) every night by a Gitea Actions pipeline.
+
+## Repository structure
+
+```
+.
+├── Dockerfile                            # Image definition
+├── .gitea/workflows/docker-build.yaml    # CI/CD pipeline (Gitea Actions)
+├── renovate.json                         # Dependency update automation (Renovatebot)
+├── opencode-attach                       # Helper script for attaching to a running server
+└── README.md                             # Usage documentation
+```
+
+## Dependency management
+
+- **Always pin versions** in the Dockerfile `npm install` command (e.g. `opencode-ai@1.16.2 n2-soul@9.0.9`). Never leave packages unpinned.
+- **Update renovate customManagers** when adding, removing, or renaming a dependency tracked in the Dockerfile. Each pinned package must have a corresponding `customManager` entry in `renovate.json` with a regex `matchStrings` pattern that captures the version. If a dependency is added without a renovate entry, Renovatebot will not open automated PRs for it.
+- **apt packages** (apt-get install lines in Dockerfile) and **COPY --from** image references are not currently tracked by Renovate. Pinning these manually is acceptable for now but adding renovate managers for them is encouraged.
+
+## Dockerfile conventions
+
+- **Base image**: `node:24` — Debian-based Node.js image (not Alpine, needed for apt packages).
+- **Install**: `npm i -g opencode-ai@<version> n2-soul@<version>` — installs OpenCode and Soul globally, both pinned.
+- **Version check**: `RUN opencode --version` after install to validate the build and record the installed version in build logs.
+- **Dedicated user**: a non-root `opencode` user and group are created with `groupadd`/`useradd` (UID/GID 1000). All runtime steps run as this user.
+- **Cluster tooling**: `kubectl` is copied from the official `registry.k8s.io/kubectl` image (multi-stage COPY).
+- **Entrypoint**: `["opencode"]` — arguments are passed at runtime (e.g. `serve`).
+
+## CI/CD conventions (Gitea Actions)
+
+- Pipeline triggers on push to `main`, PRs targeting `main`, and a nightly cron (`cron: '0 0 * * *'`).
+- Image is pushed to Docker Hub only on non-PR events (main branch pushes and cron runs).
+- Docker Hub credentials are stored in Gitea Actions secrets (`DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`).
+- The image is published as `jcabillot/opencode:latest` with digest and branch tags.
+
+## Useful commands
+
+```bash
+# Build the image locally
+docker build -t opencode .
+
+# Run the server on all interfaces
+docker run -it -p 4096:4096 opencode --hostname 0.0.0.0
+
+# Run with a project mounted
+docker run -it -p 4096:4096 \
+  -v $(pwd):/home/opencode/project \
+  opencode --hostname 0.0.0.0
+
+# Protect with a password
+docker run -it -p 4096:4096 \
+  -e OPENCODE_SERVER_PASSWORD=secret \
+  opencode --hostname 0.0.0.0
+```
+
+## opencode serve options
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--port` | `4096` | Port to listen on |
+| `--hostname` | `127.0.0.1` | Hostname to bind |
+| `--mdns` | `false` | Enable mDNS discovery |
+| `--cors` | `[]` | Additional allowed browser origins |
+
+## Environment variables
+
+| Variable | Description |
+|----------|-------------|
+| `OPENCODE_SERVER_PASSWORD` | Enables HTTP basic auth |
+| `OPENCODE_SERVER_USERNAME` | Overrides the default username (`opencode`) |