ci: use static matrices with change-based guards

Gitea does not expand a dynamic fromJson matrix (the job name stayed literal
and it queued with no matching runner). Instead, compute cosmic/remote booleans
in a changes job and gate static-matrix build jobs with job-level if.

.gitea/workflows/build.yaml

@@ -13,17 +13,18 @@ on:
 jobs:
   # Work out which images actually changed, so a push only rebuilds those.
   changes:
-    name: Compute build matrix
+    name: Compute changes
     runs-on: job-v2
     outputs:
-      matrix: ${{ steps.matrix.outputs.matrix }}
+      cosmic: ${{ steps.changes.outputs.cosmic }}
+      remote: ${{ steps.changes.outputs.remote }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Compute matrix
-        id: matrix
+      - name: Detect changed images
+        id: changes
         shell: bash
         run: |
           set -euo pipefail
@@ -36,17 +37,28 @@ jobs:
           else
             changed=""
           fi
-          matrix="$(printf '%s\n' "${changed}" | ./ci-matrix.sh)"
-          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+          eval "$(printf '%s\n' "${changed}" | ./ci-changes.sh)"
+          echo "cosmic=${cosmic}" >> "$GITHUB_OUTPUT"
+          echo "remote=${remote}" >> "$GITHUB_OUTPUT"
 
-  build:
+  build-cosmic:
     name: ${{ matrix.image }} (${{ matrix.distro }})
     needs: changes
+    if: needs.changes.outputs.cosmic == 'true'
     runs-on: ${{ matrix.runner }}
 
     strategy:
       fail-fast: false
-      matrix: ${{ fromJson(needs.changes.outputs.matrix) }}
+      matrix:
+        include:
+          - image: fedora-cosmic
+            distro: "44"
+            arch: x86_64
+            runner: job-v2
+          - image: fedora-cosmic
+            distro: rawhide
+            arch: x86_64
+            runner: job-v2
 
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:${{ matrix.distro }}"
@@ -60,7 +72,7 @@ jobs:
       GITEA_URL: https://git.plabble.org
       GITEA_REPO: Misthios/bootc-images
 
-    steps:
+    steps: &build_steps
       - name: Install build tools
         run: |
           set -xeuo pipefail
@@ -138,11 +150,31 @@ jobs:
           pkgs="build/${IMAGE}-${DISTRO}-${ARCH}/packages-current.txt"
           ./release.sh "${IMAGE}" "${DISTRO}" "${buildid}" "${pkgs}"
 
+  build-remote:
+    name: fedora-remote (44)
+    needs: changes
+    if: needs.changes.outputs.remote == 'true'
+    runs-on: job-v2
+
+    container:
+      image: "quay.io/fedora-ostree-desktops/buildroot:44"
+      options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
+
+    env:
+      IMAGE: fedora-remote
+      DISTRO: "44"
+      ARCH: x86_64
+      REGISTRY: git.plabble.org/misthios
+      GITEA_URL: https://git.plabble.org
+      GITEA_REPO: Misthios/bootc-images
+
+    steps: *build_steps
+
   prune:
     name: Prune old releases and tags
     runs-on: job-v2
-    needs: [changes, build]
-    # Run even if some matrix builds failed (e.g. rawhide churn).
+    needs: [changes, build-cosmic, build-remote]
+    # Run even if some builds were skipped or failed.
     if: ${{ always() && github.event_name != 'pull_request' }}
     container:
       image: "quay.io/fedora-ostree-desktops/buildroot:44"