ci: make the backend job work on the local Forgejo runner

minio/minio is gone from Docker Hub (use the bitnami image that starts without a command), install psql/protoc/socat in the bare job container (no sudo), forward the services to localhost, and fetch non-mirrored actions from github.com.

.github/workflows/ci.yml

@@ -28,34 +28,38 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
+      # minio/minio left Docker Hub and needs a `server /data` command that
+      # service containers cannot pass; the bitnami image starts on its own.
       s3:
-        image: minio/minio:latest
+        image: bitnamilegacy/minio:latest
         env:
           MINIO_ROOT_USER: minioadmin
           MINIO_ROOT_PASSWORD: minioadmin
-        ports:
-          - 9000:9000
-        options: >-
-          --health-cmd "mc ready local || curl -sf http://localhost:9000/minio/health/live"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 20
     env:
       DATABASE_URL: postgres://lovisual:lovisual@localhost:5432/accounts_db
       CONFIGS_DATABASE_URL: postgres://lovisual:lovisual@localhost:5432/configs_db
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install protoc (prost-build requirement)
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+      # Jobs run in a bare container as root: no sudo, no psql. The services
+      # are reachable by name, so socat forwards them to the localhost URLs the
+      # tests and env use.
+      - name: Install protoc, psql and socat
+        run: apt-get update && apt-get install -y protobuf-compiler postgresql-client socat
+
+      - name: Expose services on localhost
+        run: |
+          socat TCP-LISTEN:5432,fork,reuseaddr TCP:postgres:5432 &
+          socat TCP-LISTEN:9000,fork,reuseaddr TCP:s3:9000 &
+          sleep 1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: https://github.com/dtolnay/rust-toolchain@stable
         with:
           components: clippy, rustfmt
 
       - name: Cache cargo build
-        uses: Swatinem/rust-cache@v2
+        uses: https://github.com/Swatinem/rust-cache@v2
         with:
           workspaces: backend
 
@@ -86,7 +90,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        uses: https://github.com/oven-sh/setup-bun@v2
 
       - name: Cache bun install
         uses: actions/cache@v4