diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 0ad6977..d9cdde5 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -24,14 +24,24 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Sign in to Gitea Container Registry + if: ${{ github.server_url != 'https://github.com' }} uses: docker/login-action@v3 with: registry: git.us2plus2.com username: ${{ secrets.REGISTRY_USERNAME }} password: ${{ secrets.REGISTRY_TOKEN }} - - name: Generate image tags - id: meta + - name: Sign in to GitHub Container Registry + if: ${{ github.server_url == 'https://github.com' }} + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Generate image tags (Gitea) + id: meta-gitea + if: ${{ github.server_url != 'https://github.com' }} uses: docker/metadata-action@v5 with: images: git.us2plus2.com/marvin/site-gateway @@ -41,6 +51,18 @@ jobs: type=raw,value=alpha,enable=${{ startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-alpha.') }} type=sha + - name: Generate image tags (GitHub) + id: meta-github + if: ${{ github.server_url == 'https://github.com' }} + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository }} + tags: | + type=raw,value=latest,enable={{is_default_branch}} + type=semver,pattern={{version}} + type=raw,value=alpha,enable=${{ startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-alpha.') }} + type=sha + - name: Build local smoke-test image uses: docker/build-push-action@v6 with: @@ -64,13 +86,26 @@ jobs: - name: Scan image for vulnerabilities run: trivy image --severity CRITICAL,HIGH --exit-code 0 --format table site-gateway:smoke-test - - name: Build and publish + - name: Build and publish (Gitea) + if: ${{ github.server_url != 'https://github.com' }} uses: docker/build-push-action@v6 with: context: . platforms: linux/amd64,linux/arm64 push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} + tags: ${{ steps.meta-gitea.outputs.tags }} + labels: ${{ steps.meta-gitea.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Build and publish (GitHub) + if: ${{ github.server_url == 'https://github.com' }} + uses: docker/build-push-action@v6 + with: + context: . + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ steps.meta-github.outputs.tags }} + labels: ${{ steps.meta-github.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max diff --git a/ROADMAP.md b/ROADMAP.md index 99dc69b..2f0121e 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -278,3 +278,5 @@ Roughly in priority order: `v0.16.76` fixes the Gitea Actions container-publish pipeline, which failed twice after the earlier GitHub-to-Gitea migration -- first at registry sign-in (missing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` repo secrets, added directly in Gitea's Actions settings, no workflow change needed) and then at the "Scan image for vulnerabilities" step, which used `aquasecurity/trivy-action@0.35.0`. That action installs Trivy at runtime via a `git clone`-based installer script against GitHub, a dependency separate from the registry sign-in fix and one that doesn't reliably resolve from a Gitea Actions runner. Replaced with two plain shell steps: a pinned `curl` of Trivy 0.56.2's release tarball directly from GitHub's release CDN (a single static HTTPS download, not a git checkout) followed by `trivy image` run directly, keeping the same severity/exit-code/format settings. Scanning behavior is unchanged; only the installation mechanism moved off the flaky git-based installer. `v0.16.77` fixes a follow-on to v0.16.76's Trivy-installer replacement: the pinned version, `0.56.2`, no longer exists on GitHub's release list (current is `v0.74.0`), so the `curl -sfL` request 404'd and failed fast with exit code 22 instead of installing anything. `TRIVY_VERSION` is now `0.74.0`, verified against the actual release assets before pushing. No other change to the install/scan steps from v0.16.76. + +`v0.16.78` restores GitHub's half of the dual-publish pipeline without touching Gitea's: the earlier migration commits had rewritten `container.yml`'s registry login, tag, and publish steps to target only `git.us2plus2.com` using Gitea-only secrets, so every push to GitHub since then failed in ~30 seconds at "Sign in to Gitea Container Registry" with "Username and password required" -- GitHub's repo never had `REGISTRY_USERNAME`/`REGISTRY_TOKEN`. The login, tag-generation, and publish steps are now duplicated, one set per registry, each gated with `if: github.server_url == 'https://github.com'` (or `!=`) so the workflow self-selects which registry to sign into and push to depending on which host is actually running it -- Gitea Actions keeps using the existing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets against `git.us2plus2.com` exactly as before, GitHub Actions goes back to `ghcr.io` using `github.actor`/`GITHUB_TOKEN` as it did pre-migration. The shared build/scan steps (smoke-test image, SQLite check, Trivy install/scan) are unconditional and run identically on both. Also reverts the v0.16.75 smoke-test change: the Dashboard heading text is back to "Dashboard" now that the Gitea pipeline is confirmed working end to end. diff --git a/package.json b/package.json index 7600048..858b7bb 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "site-gateway", - "version": "0.16.77", + "version": "0.16.78", "private": true, "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.", "type": "module", diff --git a/src/public/app.js b/src/public/app.js index 4b23b46..3dc2636 100644 --- a/src/public/app.js +++ b/src/public/app.js @@ -511,7 +511,7 @@ function render() { const adminUsersActive = activeAdminTab === "users", adminGroupsActive = activeAdminTab === "groups", adminApiActive = activeAdminTab === "api"; $("#open-create").classList.toggle("hidden", !(management || adminUsersActive || adminGroupsActive || adminApiActive || ["streaming","redirects","access"].includes(state.view)) || !canManage()); $("#check-health").classList.toggle("hidden", state.view !== "certificates" || !canAdmin()); $("#refresh-logs").classList.toggle("hidden", state.view !== "logs"); if (overview) { - $("#page-title").textContent = "Dashboard v2"; + $("#page-title").textContent = "Dashboard"; $("#page-subtitle").textContent = "Health, activity, and system status at a glance."; renderDashboard(); return; diff --git a/src/public/index.html b/src/public/index.html index 958ceea..41eaa2b 100644 --- a/src/public/index.html +++ b/src/public/index.html @@ -11,7 +11,7 @@ - + - +