ci: build under a per-run local tag, untag registry refs only, gate the image push on every test job

tests/security/test_ci_workflows.py

@@ -275,19 +275,25 @@ def run_cleanup(tmp_path: Path, *refs: str) -> list[str]:
 
 def test_cleanup_removes_containers_only_for_per_run_refs(tmp_path: Path) -> None:
     registry = "git.hiddenden.cafe/hiddenden/aegisgitea-mcp"
-    per_run = f"{registry}:sha-0123456789ab"
-    shared = [f"{registry}:latest", f"{registry}:main", f"{registry}:dev"]
+    per_run = "aegis-ci-4242-build:0123456789abcdef"
+    shared = [
+        f"{registry}:sha-0123456789ab",
+        f"{registry}:latest",
+        f"{registry}:main",
+        f"{registry}:dev",
+    ]
 
-    calls = run_cleanup(tmp_path, per_run, *shared)
+    calls = run_cleanup(tmp_path, *shared, per_run)
 
     removed = [call for call in calls if call.startswith("rm -f")]
     assert removed == [f"rm -f -v cid-of-{per_run}"]
     queried = [call for call in calls if call.startswith("ps ")]
-    assert all("sha-0123456789ab" in call for call in queried) and len(queried) == 1
-    # Shared tags are only untagged.
+    assert len(queried) == 1 and per_run in queried[0]
+    # Registry tags (the immutable sha tag included) are only untagged.
     for ref in shared:
         assert f"image rm {ref}" in calls
         assert f"rmi {ref}" not in calls
+    assert f"rmi {per_run}" in calls
 
 
 def test_cleanup_treats_names_with_the_run_prefix_as_per_run(tmp_path: Path) -> None:
@@ -324,3 +330,27 @@ def test_scripts_are_executable_and_parse() -> None:
     for script in (ROOT / "scripts" / "ci").glob("*.sh"):
         assert os.access(script, os.X_OK), script.name
         subprocess.run(["bash", "-n", str(script)], check=True, timeout=30)  # noqa: S603, S607
+
+
+def test_build_and_push_builds_under_a_per_run_tag_and_gates_on_every_test_job() -> None:
+    jobs = {job.name: job for job in jobs_of(ROOT / ".gitea" / "workflows" / "ci.yml")}
+    build = jobs["build-and-push"]
+
+    assert {"lint", "test-unit", "test-integration", "test-mcp", "security"} <= set(build.needs)
+    text = build.text
+    assert 'BUILD_TAG="aegis-ci-${GITHUB_RUN_ID}-build:${GITHUB_SHA}"' in text
+    # Nothing is built, scanned or smoke-tested under a registry tag.
+    assert '-t "${{ steps.meta.outputs.build_tag }}"' in text
+    assert 'scan_image.sh "${{ steps.meta.outputs.build_tag }}"' in text
+    assert '-t "${{ steps.meta.outputs.sha_tag }}"' not in text
+    # Registry tags are applied only in the push step, and cleanup removes the build tag last.
+    assert text.index("docker build") < text.index("docker tag") < text.index("docker push")
+    assert text.count("docker tag") == 1
+    cleanup = text[text.index("scripts/ci/cleanup_job_resources.sh") :]
+    assert cleanup.index("sha_tag") < cleanup.index("build_tag")
+
+
+def test_the_integration_job_requires_the_actions_runner() -> None:
+    jobs = {job.name: job for job in jobs_of(ROOT / ".gitea" / "workflows" / "ci.yml")}
+
+    assert 'AEGIS_IT_REQUIRE_RUNNER: "1"' in jobs["test-integration"].text