Fix Gitea-runner python matrix: uv-managed interpreters, pin ruff

Swap README badges to the public GitHub mirror (workflows and releases).

.github/workflows/ci.yml

@@ -43,20 +43,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python }}
-
-      - name: install dev deps
-        run: python -m pip install --upgrade pip pytest ruff
+      # uv-managed interpreters instead of actions/setup-python: the prebuilt-CPython
+      # download path setup-python relies on does not work on the self-hosted Gitea
+      # runner (all three matrix jobs failed at setup there while passing on GitHub);
+      # uv works identically on both.
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: ruff
-        run: ruff check patch tests tools
+        # Pinned: an unpinned ruff means any upstream release can turn main red
+        # with no code change.
+        run: uvx ruff@0.16.1 check patch tests tools
 
       - name: pytest
-        run: pytest tests -v
+        run: uvx --python ${{ matrix.python }} pytest tests -v
 
       - name: verify injected middleware blocks compile
         # Belt-and-braces: the *_BLOCK strings are appended into live middlewared
         # modules. A syntax error there would break the box at boot.
-        run: pytest tests/test_apply_blocks.py -v
+        run: uvx --python ${{ matrix.python }} pytest tests/test_apply_blocks.py -v

CHANGELOG.md

@@ -9,6 +9,15 @@ worse than no alert, because one day it carries a security fix.
 ## Unreleased
 ### Changed
 
+- **CI's python matrix now uses uv-managed interpreters instead of
+  `actions/setup-python`**, which failed at environment setup on the self-hosted
+  Gitea runner (GitHub Actions was unaffected — same file, both green now). Ruff is
+  pinned to 0.16.1 in the same job so an upstream ruff release can't turn `main`
+  red without a code change.
+- **README badges point at the public GitHub mirror** (workflow status and
+  releases) instead of the private forge. The release badge had also been reading
+  the stale Gitea v0.6.1 release instead of the current v0.7.0 on GitHub.
+
 - **`master` is now labelled `27-dev`, because it is not the next release.** iX
   branches each major onto its own `release/` line and master rolls straight on to the
   one after — on 2026-07-14 every recent commit on master targeted `27.0.0-BETA.1`

README.md

@@ -1,6 +1,6 @@
 # truenas-truecloud-patch
 
-[![compat](https://git.onetick.ninja/flan/truenas-truecloud-patch/actions/workflows/compat.yml/badge.svg?branch=main)](https://git.onetick.ninja/flan/truenas-truecloud-patch/actions) [![release](https://img.shields.io/gitea/v/release/flan/truenas-truecloud-patch?gitea_url=https%3A%2F%2Fgit.onetick.ninja&logo=gitea&logoColor=white)](https://git.onetick.ninja/flan/truenas-truecloud-patch/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-blue)](LICENSE) [![GitHub Sponsors](https://img.shields.io/badge/GitHub%20Sponsors-%E2%9D%A4-EA4AAA?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/sudolulo) [![Ko-fi](https://img.shields.io/badge/Ko--fi-support-FF5E5B?logo=kofi&logoColor=white)](https://ko-fi.com/sudolulo)
+[![TrueNAS compatibility](https://github.com/sudolulo/truenas-truecloud-patch/actions/workflows/compat.yml/badge.svg?branch=main)](https://github.com/sudolulo/truenas-truecloud-patch/actions) [![release](https://img.shields.io/github/v/release/sudolulo/truenas-truecloud-patch?logo=github)](https://github.com/sudolulo/truenas-truecloud-patch/releases) [![License: MIT](https://img.shields.io/badge/License-MIT-blue)](LICENSE) [![GitHub Sponsors](https://img.shields.io/badge/GitHub%20Sponsors-%E2%9D%A4-EA4AAA?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/sudolulo) [![Ko-fi](https://img.shields.io/badge/Ko--fi-support-FF5E5B?logo=kofi&logoColor=white)](https://ko-fi.com/sudolulo)
 
 Extends TrueNAS SCALE's **TrueCloud Backup** to: