Pin Trivy to an existing release version (v0.74.0) (v0.16.77)

.github/workflows/container.yml

@@ -23,18 +23,18 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Sign in to GitHub Container Registry
+      - name: Sign in to Gitea Container Registry
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.us2plus2.com
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Generate image tags
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }}
+          images: git.us2plus2.com/marvin/site-gateway
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
             type=semver,pattern={{version}}
@@ -52,13 +52,17 @@ jobs:
       - name: Verify Node and built-in SQLite
         run: docker run --rm --entrypoint node site-gateway:smoke-test --input-type=module -e "import { DatabaseSync } from 'node:sqlite'; const db = new DatabaseSync(':memory:'); db.exec('CREATE TABLE smoke (id INTEGER)'); db.close();"
 
+      - name: Install Trivy
+        run: |
+          set -e
+          TRIVY_VERSION=0.74.0
+          curl -sfL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o /tmp/trivy.tar.gz
+          tar -xzf /tmp/trivy.tar.gz -C /tmp trivy
+          sudo mv /tmp/trivy /usr/local/bin/trivy
+          trivy --version
+
       - name: Scan image for vulnerabilities
-        uses: aquasecurity/trivy-action@0.35.0
-        with:
-          image-ref: site-gateway:smoke-test
-          severity: CRITICAL,HIGH
-          exit-code: "0"
-          format: table
+        run: trivy image --severity CRITICAL,HIGH --exit-code 0 --format table site-gateway:smoke-test
 
       - name: Build and publish
         uses: docker/build-push-action@v6

README.md

@@ -103,7 +103,7 @@ At startup, the container creates the complete `/data` hierarchy, applies `PUID`
 
 ## Unraid
 
-1. Add the container from **Docker → Add Container** using the image `ghcr.io/mfwadejr/site-gateway2:latest`, or search Community Applications once a template is published.
+1. Add the container from **Docker → Add Container** using the image `git.us2plus2.com/marvin/site-gateway:latest`, or search Community Applications once a template is published.
 2. Map ports `80`, `443` (TCP+UDP), `8080`, and `9000-9099` as above, plus any Streaming Host ports you plan to use.
 3. Map one path, e.g. `/mnt/user/appdata/site-gateway:/data`.
 4. Set `PUID=99` and `PGID=100` so the container writes to `/data` as the `nobody`/`users` account Unraid expects.

ROADMAP.md

@@ -272,3 +272,9 @@ Roughly in priority order:
 `v0.16.73` makes the Dashboard's System panel top accent bar reflect resource state, instead of always showing green -- pointed out after a screenshot showed CPU pinned at 100% (its own stat correctly shown in red) while the panel's top bar stayed the hardcoded `var(--green)` it always had. `renderHeroPanel()` now tracks the worst tone across CPU/memory/swap/disk (the same "warning" at 75%+ / "critical" at 90%+ thresholds each stat's own value and fill bar already used) and applies a `tone-warning`/`tone-critical` class to the panel, which `.system-panel::before` now reads instead of a fixed color. Network, uptime, and throughput don't carry a tone and are excluded from the calculation, same as before. Applies to the Dashboard's System panel only -- the Administration > System tab's equivalent hero grid has no top accent bar to react.
 
 `v0.16.74` fixes an inaccurate status label on Hosted Site, Proxy Host, and Streaming Host cards, and the Certificates table's Upstream column: a route with monitoring intentionally turned off via "Monitor this site/upstream" in Advanced options -- while the route itself stays enabled and running -- read "Monitoring paused", the same text used for a route that's fully disabled. "Paused" implies a temporary interruption; deliberately unchecking the monitor box is an ongoing, intentional setting. The backend already distinguished the two cases (`status: "disabled"` when the route itself is off vs. `status: "unmonitored"` when only health checks are off, in `checkProxy()`), the frontend just collapsed them into one string in four places. Disabled routes keep "Monitoring paused"; a running route with health checks off now reads "Monitoring disabled". No backend or status-logic changes, text only.
+
+`v0.16.75` is a one-line smoke test to confirm the Gitea remote (`git.us2plus2.com/marvin/site-gateway`) actually receives pushes end-to-end after the GitHub-to-Gitea migration: the Dashboard heading text reads "Dashboard v2" instead of "Dashboard" (both the static HTML fallback and the JS that sets it on render), with no other functional change. Pushed to both `origin` (Gitea) and `github` remotes per the dual-push arrangement while GitHub CI still builds the published container image.
+
+`v0.16.76` fixes the Gitea Actions container-publish pipeline, which failed twice after the earlier GitHub-to-Gitea migration -- first at registry sign-in (missing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` repo secrets, added directly in Gitea's Actions settings, no workflow change needed) and then at the "Scan image for vulnerabilities" step, which used `aquasecurity/trivy-action@0.35.0`. That action installs Trivy at runtime via a `git clone`-based installer script against GitHub, a dependency separate from the registry sign-in fix and one that doesn't reliably resolve from a Gitea Actions runner. Replaced with two plain shell steps: a pinned `curl` of Trivy 0.56.2's release tarball directly from GitHub's release CDN (a single static HTTPS download, not a git checkout) followed by `trivy image` run directly, keeping the same severity/exit-code/format settings. Scanning behavior is unchanged; only the installation mechanism moved off the flaky git-based installer.
+
+`v0.16.77` fixes a follow-on to v0.16.76's Trivy-installer replacement: the pinned version, `0.56.2`, no longer exists on GitHub's release list (current is `v0.74.0`), so the `curl -sfL` request 404'd and failed fast with exit code 22 instead of installing anything. `TRIVY_VERSION` is now `0.74.0`, verified against the actual release assets before pushing. No other change to the install/scan steps from v0.16.76.

compose.release.yaml

@@ -5,7 +5,7 @@
 #   docker compose -f compose.release.yaml up -d
 services:
   site-gateway:
-    image: ${SITE_GATEWAY_IMAGE:-ghcr.io/mfwadejr/site-gateway2:latest}
+    image: ${SITE_GATEWAY_IMAGE:-git.us2plus2.com/marvin/site-gateway:latest}
     container_name: site-gateway
     restart: unless-stopped
     environment:

compose.zimaos.yaml

@@ -13,7 +13,7 @@ name: site-gateway
 
 services:
   site-gateway:
-    image: ghcr.io/mfwadejr/site-gateway2:latest
+    image: git.us2plus2.com/marvin/site-gateway:latest
     container_name: site-gateway
     restart: unless-stopped
     environment:
@@ -77,7 +77,7 @@ x-casaos:
   index: /
   port_map: "8080"
   scheme: http
-  icon: https://raw.githubusercontent.com/mfwadejr/site-gateway2/main/src/public/site-gateway-icon-approved.png
+  icon: https://git.us2plus2.com/marvin/site-gateway/raw/branch/main/src/public/site-gateway-icon-approved.png
   title:
     en_US: Site Gateway
   tagline:
@@ -93,6 +93,6 @@ x-casaos:
   architectures: ["amd64", "arm64"]
   version: "0.16.58"
   update_at: "2026-09-20"
-  website: https://github.com/mfwadejr/site-gateway2
-  repo: https://github.com/mfwadejr/site-gateway2
-  support: https://github.com/mfwadejr/site-gateway2/issues
+  website: https://git.us2plus2.com/marvin/site-gateway
+  repo: https://git.us2plus2.com/marvin/site-gateway
+  support: https://git.us2plus2.com/marvin/site-gateway/issues

package.json

@@ -1,6 +1,6 @@
 {
   "name": "site-gateway",
-  "version": "0.16.74",
+  "version": "0.16.77",
   "private": true,
   "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.",
   "type": "module",

src/public/app.js

@@ -511,7 +511,7 @@ function render() {
   const adminUsersActive = activeAdminTab === "users", adminGroupsActive = activeAdminTab === "groups", adminApiActive = activeAdminTab === "api";
   $("#open-create").classList.toggle("hidden", !(management || adminUsersActive || adminGroupsActive || adminApiActive || ["streaming","redirects","access"].includes(state.view)) || !canManage()); $("#check-health").classList.toggle("hidden", state.view !== "certificates" || !canAdmin()); $("#refresh-logs").classList.toggle("hidden", state.view !== "logs");
   if (overview) {
-    $("#page-title").textContent = "Dashboard";
+    $("#page-title").textContent = "Dashboard v2";
     $("#page-subtitle").textContent = "Health, activity, and system status at a glance.";
     renderDashboard();
     return;

src/public/index.html

@@ -11,7 +11,7 @@
   <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png">
   <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png">
   <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
-  <link rel="stylesheet" href="/styles.css?v=0.16.74">
+  <link rel="stylesheet" href="/styles.css?v=0.16.77">
 </head>
 
 <!-- ================================================================
@@ -103,7 +103,7 @@
         <button class="admin-only" data-view="administration">Admin</button><button data-view="account">Account</button><button data-view="documentation">Docs</button>
       </nav>
       <header>
-        <div><p class="eyebrow">Gateway control</p><h1 id="page-title">Dashboard</h1><p id="page-subtitle" class="muted">Health, activity, and system status at a glance.</p></div>
+        <div><p class="eyebrow">Gateway control</p><h1 id="page-title">Dashboard v2</h1><p id="page-subtitle" class="muted">Health, activity, and system status at a glance.</p></div>
         <div class="header-actions"><button id="open-create" class="button primary">＋ New hosted site</button><button id="check-health" class="button primary hidden">Run certificate check</button><button id="refresh-logs" class="button primary hidden">Refresh logs</button><button id="refresh-view" class="icon-button page-refresh" aria-label="Refresh this page" title="Refresh this page">↻</button></div>
       </header>
 
@@ -454,6 +454,6 @@
   <div id="toast" class="toast" role="status"></div>
   <div id="update-banner" class="update-banner hidden" role="status"><span>A new version of Site Gateway is available.</span><div class="update-banner-actions"><button id="update-banner-refresh" class="button primary">Refresh</button><button id="update-banner-dismiss" class="text-button">Dismiss</button></div></div>
   <!-- App scripts: core (app.js) then extended views/admin (features.js) -->
-  <script src="/app.js?v=0.16.74" defer></script><script src="/features.js?v=0.16.74" defer></script><script src="/select-enhance.js?v=0.16.74" defer></script>
+  <script src="/app.js?v=0.16.77" defer></script><script src="/features.js?v=0.16.77" defer></script><script src="/select-enhance.js?v=0.16.77" defer></script>
 </body>
 </html>