Use Gitea-hosted Node base image

README.md

@@ -73,6 +73,13 @@ It contains Node for the checkout action plus Python, Git, timezone data,
 application dependencies, pytest, and Ruff. Scheduled jobs therefore do not
 install Python or download Python packages.
 
+The Node base image is also mirrored in Gitea, so image builds do not contact
+Docker Hub:
+
+```text
+mahgit.ir/meghdadfadaee/daily-blackout-check-base:node-20-bookworm
+```
+
 ### Registry credentials
 
 Create a Gitea personal access token for `MeghdadFadaee` with package permission
@@ -114,7 +121,8 @@ requests.
 
 The **Build runner image** workflow:
 
-1. Starts in `node:20-bookworm` and installs the Docker client.
+1. Starts in the Gitea-hosted `daily-blackout-check-base:node-20-bookworm`
+   image and installs the Docker client.
 2. Builds using only `runner-image/` as context, so `.env` and outage state are
    never included.
 3. Runs import, pytest, and Ruff smoke checks inside the candidate image.
@@ -122,9 +130,10 @@ The **Build runner image** workflow:
 5. Updates `latest` only after the candidate passes verification.
 
 It runs automatically when `runner-image/**` changes on `main` and can also be
-started manually. Image builds require Debian mirrors, Docker Hub, PyPI, Gitea,
-and access to the Docker socket. Normal test and hourly runs only need Gitea,
-`gitea.com`, SAAPA, and EitaaYar.
+started manually. Image builds require Debian mirrors, PyPI, Gitea, and access
+to the Docker socket. Normal test and hourly runs only need Gitea, `gitea.com`,
+SAAPA, and EitaaYar. The mirrored Node image is intentionally static; refresh it
+from the upstream `node:20-bookworm` image when adopting Node security updates.
 
 Deployment order: