Restore GitHub's ghcr.io publish path; revert Dashboard v2 test change (v0.16.78)

2026-09-21 16:16:41 -04:00
parent 00ec6ff0d9
commit 557670a78b
5 changed files with 47 additions and 10 deletions
@@ -278,3 +278,5 @@ Roughly in priority order:
 `v0.16.76` fixes the Gitea Actions container-publish pipeline, which failed twice after the earlier GitHub-to-Gitea migration -- first at registry sign-in (missing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` repo secrets, added directly in Gitea's Actions settings, no workflow change needed) and then at the "Scan image for vulnerabilities" step, which used `aquasecurity/trivy-action@0.35.0`. That action installs Trivy at runtime via a `git clone`-based installer script against GitHub, a dependency separate from the registry sign-in fix and one that doesn't reliably resolve from a Gitea Actions runner. Replaced with two plain shell steps: a pinned `curl` of Trivy 0.56.2's release tarball directly from GitHub's release CDN (a single static HTTPS download, not a git checkout) followed by `trivy image` run directly, keeping the same severity/exit-code/format settings. Scanning behavior is unchanged; only the installation mechanism moved off the flaky git-based installer.

 `v0.16.77` fixes a follow-on to v0.16.76's Trivy-installer replacement: the pinned version, `0.56.2`, no longer exists on GitHub's release list (current is `v0.74.0`), so the `curl -sfL` request 404'd and failed fast with exit code 22 instead of installing anything. `TRIVY_VERSION` is now `0.74.0`, verified against the actual release assets before pushing. No other change to the install/scan steps from v0.16.76.
+
+`v0.16.78` restores GitHub's half of the dual-publish pipeline without touching Gitea's: the earlier migration commits had rewritten `container.yml`'s registry login, tag, and publish steps to target only `git.us2plus2.com` using Gitea-only secrets, so every push to GitHub since then failed in ~30 seconds at "Sign in to Gitea Container Registry" with "Username and password required" -- GitHub's repo never had `REGISTRY_USERNAME`/`REGISTRY_TOKEN`. The login, tag-generation, and publish steps are now duplicated, one set per registry, each gated with `if: github.server_url == 'https://github.com'` (or `!=`) so the workflow self-selects which registry to sign into and push to depending on which host is actually running it -- Gitea Actions keeps using the existing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets against `git.us2plus2.com` exactly as before, GitHub Actions goes back to `ghcr.io` using `github.actor`/`GITHUB_TOKEN` as it did pre-migration. The shared build/scan steps (smoke-test image, SQLite check, Trivy install/scan) are unconditional and run identically on both. Also reverts the v0.16.75 smoke-test change: the Dashboard heading text is back to "Dashboard" now that the Gitea pipeline is confirmed working end to end.