From 07e92a87093389cf03c96062e7e01d8f94cb3213 Mon Sep 17 00:00:00 2001
From: Michael Schiemer <kontakt@michaelschiemer.de>
Date: Sat, 8 Nov 2025 13:54:01 +0100
Subject: [PATCH] fix: Install Ansible in docker-build image instead of runtime

---
 .gitea/workflows/build-image.yml   | 10 ----------
 .gitea/workflows/manual-deploy.yml | 10 ----------
 docker/ci/Dockerfile.build         | 12 ++++++++++--
 3 files changed, 10 insertions(+), 22 deletions(-)

diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
index e2b2f739..ab2bb98b 100644
--- a/.gitea/workflows/build-image.yml
+++ b/.gitea/workflows/build-image.yml
@@ -963,11 +963,6 @@ jobs:
           chmod 600 ~/.ssh/production
           ssh-keyscan -H ${{ env.DEPLOYMENT_HOST }} >> ~/.ssh/known_hosts
 
-      - name: Install Ansible
-        run: |
-          apk add --no-cache python3 py3-pip
-          pip3 install --user ansible-core docker
-
       - name: Create Ansible Vault password file
         run: |
           if [ -n "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" ]; then
@@ -1117,11 +1112,6 @@ jobs:
           chmod 600 ~/.ssh/production
           ssh-keyscan -H ${{ env.DEPLOYMENT_HOST }} >> ~/.ssh/known_hosts
 
-      - name: Install Ansible
-        run: |
-          apk add --no-cache python3 py3-pip
-          pip3 install --user ansible-core docker
-
       - name: Create Ansible Vault password file
         run: |
           if [ -n "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" ]; then
diff --git a/.gitea/workflows/manual-deploy.yml b/.gitea/workflows/manual-deploy.yml
index 183e0b97..bb56b775 100644
--- a/.gitea/workflows/manual-deploy.yml
+++ b/.gitea/workflows/manual-deploy.yml
@@ -112,11 +112,6 @@ jobs:
           chmod 600 ~/.ssh/production
           ssh-keyscan -H ${{ env.DEPLOYMENT_HOST }} >> ~/.ssh/known_hosts
 
-      - name: Install Ansible
-        run: |
-          apk add --no-cache python3 py3-pip
-          pip3 install --user ansible-core docker
-
       - name: Create Ansible Vault password file
         run: |
           if [ -n "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" ]; then
@@ -236,11 +231,6 @@ jobs:
           chmod 600 ~/.ssh/production
           ssh-keyscan -H ${{ env.DEPLOYMENT_HOST }} >> ~/.ssh/known_hosts
 
-      - name: Install Ansible
-        run: |
-          apk add --no-cache python3 py3-pip
-          pip3 install --user ansible-core docker
-
       - name: Create Ansible Vault password file
         run: |
           if [ -n "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" ]; then
diff --git a/docker/ci/Dockerfile.build b/docker/ci/Dockerfile.build
index be17c339..462d5bae 100644
--- a/docker/ci/Dockerfile.build
+++ b/docker/ci/Dockerfile.build
@@ -8,7 +8,9 @@ RUN apk add --no-cache \
     bash \
     curl \
     openssh-client \
-    ca-certificates
+    ca-certificates \
+    python3 \
+    py3-pip
 
 # Installiere Docker Buildx (global für alle User)
 RUN mkdir -p /usr/local/lib/docker/cli-plugins && \
@@ -25,11 +27,17 @@ RUN mkdir -p /usr/local/lib/docker/cli-plugins && \
     mkdir -p /root/.docker/cli-plugins && \
     cp /usr/local/lib/docker/cli-plugins/docker-buildx /root/.docker/cli-plugins/docker-buildx
 
+# Installiere Ansible (global für alle User)
+# --break-system-packages ist nötig in Alpine, da pip PEP 668 befolgt
+RUN pip3 install --no-cache-dir --break-system-packages ansible-core docker
+
 # Verifiziere Installation
 RUN docker --version && \
     git --version && \
     bash --version && \
-    docker buildx version
+    docker buildx version && \
+    python3 --version && \
+    ansible --version
 
 # Arbeitsverzeichnis
 WORKDIR /workspace