[chore](trx-rs): run the frontend job in the SDK image

The frontend job was added while CI still targeted host-executor runners,
so it never gained the `container:` key the lint and test jobs use.  On
the Docker executor it lands on a bare job container and fails the same
way the Rust jobs did before this branch: `npm` is missing, the Chromium
install shells out to `sudo apt-get`, and `npm run verify-generated`
regenerates the Rust wire contracts, so it needs `cargo` too.

Run it in the SDK image, which already ships Node.js, Chromium at the
path the browser smoke test defaults to, and the pinned Rust toolchain.
Installing Chromium per run is then redundant.

Drop the job's trailing `reuse lint`.  The SDK image deliberately carries
nothing REUSE-related, and the separate `reuse` job lints the whole
repository with the upstream action, generated assets included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdyUjuXejCEfiub675z6cz
Signed-off-by: Stan Grams <sjg@haxx.space>

.gitea/workflows/ci.yml

@@ -2,10 +2,11 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-# CI for the Docker-executor runner (VM). The lint/test jobs run inside the
+# CI for the Docker-executor runner (VM). The lint, test and frontend jobs run
-# shared trx-rs SDK image (container/Containerfile), which bakes in the pinned
+# inside the shared trx-rs SDK image (container/Containerfile), which bakes in
-# Rust toolchain and all build dependencies. The reuse job uses the upstream
+# the pinned Rust toolchain, Node.js, Chromium and all build dependencies. The
-# Docker action, which the Docker executor launches as a sibling container.
+# reuse job uses the upstream Docker action, which the Docker executor launches
+# as a sibling container.
 
 name: CI
 
@@ -53,6 +54,7 @@ jobs:
 
   frontend:
     runs-on: ubuntu-latest
+    container: git.haxx.space/sjg/trx-rs/sdk:latest
     defaults:
       run:
         working-directory: src/trx-client/trx-frontend/trx-frontend-http/frontend
@@ -73,15 +75,12 @@ jobs:
         run: npm run lint
       - name: Test
         run: npm test
-      - name: Install browser smoke dependency
+      # Chromium comes from the SDK image at the path the smoke test defaults
-        run: command -v chromium >/dev/null || (sudo apt-get update && sudo apt-get install -y --no-install-recommends chromium)
+      # to, so there is nothing to install here.
       - name: Browser smoke test
         run: npm run test:browser
       - name: Verify generated assets
         run: npm run verify-generated
-      - name: Verify generated-file licensing
-        working-directory: .
-        run: reuse lint
 
   reuse:
     runs-on: ubuntu-latest

container/README.md

@@ -48,11 +48,17 @@ Building outside the container? `rust-toolchain.toml` pins the same rustc, so
 
 ## CI use
 
-`.gitea/workflows/ci.yml` runs the `lint` and `test` jobs *inside* this image
+`.gitea/workflows/ci.yml` runs the `lint`, `test` and `frontend` jobs *inside*
-via the `container:` key, so they skip all setup and go straight to `cargo`.
+this image via the `container:` key, so they skip all setup and go straight to
+`cargo` and `npm`. The frontend job needs three things from the image beyond
+Rust: Node.js for the toolchain, Chromium at `/usr/bin/chromium` for the
+browser smoke test, and `cargo` — `npm run verify-generated` regenerates the
+Rust wire contracts before checking for drift.
+
 The `reuse` job stays on the upstream `fsfe/reuse-action` (a Docker action the
 Docker executor launches as a sibling container) — nothing REUSE-related is
-baked into the SDK.
+baked into the SDK, and it lints the whole repository, so no job runs its own
+licence check.
 
 ## Compilation cache (sccache)