ci: CUDA CI builder image via Scaleway CR

- Push ci-builder to rg.fr-par.scw.cloud/foxhunt-ci (Kapsule nodes can pull natively)
- Add SCR + GitLab imagePullSecrets to runner config
- Dockerfile.ci-builder unchanged (CUDA 12.4 + Rust 1.89 + protoc + sccache)

.gitlab-ci.yml

@@ -1,6 +1,7 @@
 # GitLab CI/CD — Foxhunt
 # Runs on ci-build pool (GP1-XS, scale-to-zero)
-# Uses pre-baked CI builder image with CUDA, Rust, protoc, sccache
+# CI builder image: CUDA 12.4 + Rust 1.89 + protoc + sccache (hosted on Scaleway CR)
+# Service images: pushed to internal GitLab registry (Kaniko)
 
 stages:
   - prepare
@@ -18,13 +19,14 @@ variables:
   AWS_ACCESS_KEY_ID: $SCW_ACCESS_KEY
   AWS_SECRET_ACCESS_KEY: $SCW_SECRET_KEY
   RUSTC_WRAPPER: /usr/local/bin/sccache
-  # External: git.fxhnt.ai:5050/root/foxhunt (via Tailscale — not reachable from pods)
-  # Internal: gitlab-registry.foxhunt.svc.cluster.local:5000 (HTTP, reachable from pods)
+  # CI builder image on Scaleway Container Registry (reachable by Kapsule nodes)
+  CI_BUILDER_IMAGE: rg.fr-par.scw.cloud/foxhunt-ci/ci-builder:latest
+  # Internal GitLab registry (HTTP, reachable from pods only — for service images)
   INTERNAL_REGISTRY: gitlab-registry.foxhunt.svc.cluster.local:5000
   REGISTRY: ${INTERNAL_REGISTRY}/root/foxhunt
 
 # --------------------------------------------------------------------------
-# Stage 0: Build CI builder image (auto when Dockerfile changes, manual otherwise)
+# Stage 0: Build CI builder image → push to Scaleway CR
 # --------------------------------------------------------------------------
 build-ci-builder:
   stage: prepare
@@ -42,18 +44,16 @@ build-ci-builder:
       allow_failure: true
   before_script:
     - mkdir -p /kaniko/.docker
-    - AUTH=$(echo -n "${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')
-    - echo "{\"auths\":{\"${INTERNAL_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"}}}" > /kaniko/.docker/config.json
+    - echo "{\"auths\":{\"rg.fr-par.scw.cloud\":{\"username\":\"nologin\",\"password\":\"${SCW_SECRET_KEY}\"}}}" > /kaniko/.docker/config.json
   script:
     - /kaniko/executor
       --context "${CI_PROJECT_DIR}"
       --dockerfile "${CI_PROJECT_DIR}/infra/docker/Dockerfile.ci-builder"
-      --insecure-registry "${INTERNAL_REGISTRY}"
-      --destination "${REGISTRY}/ci-builder:latest"
+      --destination "${CI_BUILDER_IMAGE}"
 
-# Base template for Rust jobs — uses pre-baked CI builder image
+# Base template for Rust jobs — pre-baked CI builder from Scaleway CR
 .rust-base:
-  image: ${REGISTRY}/ci-builder:latest
+  image: ${CI_BUILDER_IMAGE}
   tags:
     - kapsule
     - rust
@@ -87,7 +87,7 @@ test:
     - cargo test --workspace --lib
 
 # --------------------------------------------------------------------------
-# Stage 3: Build + push images (main only, Kaniko)
+# Stage 3: Build + push service images (main only, Kaniko → GitLab registry)
 # --------------------------------------------------------------------------
 .kaniko-base:
   stage: build
@@ -102,7 +102,6 @@ test:
     - if: $CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"
   before_script:
     - mkdir -p /kaniko/.docker
-    - AUTH=$(echo -n "${CI_REGISTRY_USER}:${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')
     - echo "{\"auths\":{\"${INTERNAL_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"}}}" > /kaniko/.docker/config.json
 
 build-trading-service:

infra/k8s/gitlab/runner-values.yaml

@@ -47,10 +47,14 @@ runners:
         helper_memory_request = "128Mi"
         helper_memory_limit = "512Mi"
 
+        # Image pull secrets (SCR for ci-builder, GitLab for service images)
+        image_pull_secrets = ["scw-registry", "gitlab-registry"]
+
         # Service containers (for kaniko sidecar)
         [runners.kubernetes.pod_labels]
           "app.kubernetes.io/part-of" = "foxhunt-ci"
 
+
   # Runner tags for job matching
   tags: "kapsule,rust,docker"