Restore GitHub's ghcr.io publish path; revert Dashboard v2 test change (v0.16.78)

.github/workflows/container.yml

@@ -24,14 +24,24 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Sign in to Gitea Container Registry
+        if: ${{ github.server_url != 'https://github.com' }}
         uses: docker/login-action@v3
         with:
           registry: git.us2plus2.com
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Generate image tags
+      - name: Sign in to GitHub Container Registry
-        id: meta
+        if: ${{ github.server_url == 'https://github.com' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image tags (Gitea)
+        id: meta-gitea
+        if: ${{ github.server_url != 'https://github.com' }}
         uses: docker/metadata-action@v5
         with:
           images: git.us2plus2.com/marvin/site-gateway
@@ -41,6 +51,18 @@ jobs:
             type=raw,value=alpha,enable=${{ startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-alpha.') }}
             type=sha
 
+      - name: Generate image tags (GitHub)
+        id: meta-github
+        if: ${{ github.server_url == 'https://github.com' }}
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=raw,value=alpha,enable=${{ startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '-alpha.') }}
+            type=sha
+
       - name: Build local smoke-test image
         uses: docker/build-push-action@v6
         with:
@@ -55,7 +77,7 @@ jobs:
       - name: Install Trivy
         run: |
           set -e
-          TRIVY_VERSION=0.56.2
+          TRIVY_VERSION=0.74.0
           curl -sfL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o /tmp/trivy.tar.gz
           tar -xzf /tmp/trivy.tar.gz -C /tmp trivy
           sudo mv /tmp/trivy /usr/local/bin/trivy
@@ -64,13 +86,26 @@ jobs:
       - name: Scan image for vulnerabilities
         run: trivy image --severity CRITICAL,HIGH --exit-code 0 --format table site-gateway:smoke-test
 
-      - name: Build and publish
+      - name: Build and publish (Gitea)
+        if: ${{ github.server_url != 'https://github.com' }}
         uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          tags: ${{ steps.meta-gitea.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          labels: ${{ steps.meta-gitea.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and publish (GitHub)
+        if: ${{ github.server_url == 'https://github.com' }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta-github.outputs.tags }}
+          labels: ${{ steps.meta-github.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

ROADMAP.md

@@ -276,3 +276,7 @@ Roughly in priority order:
 `v0.16.75` is a one-line smoke test to confirm the Gitea remote (`git.us2plus2.com/marvin/site-gateway`) actually receives pushes end-to-end after the GitHub-to-Gitea migration: the Dashboard heading text reads "Dashboard v2" instead of "Dashboard" (both the static HTML fallback and the JS that sets it on render), with no other functional change. Pushed to both `origin` (Gitea) and `github` remotes per the dual-push arrangement while GitHub CI still builds the published container image.
 
 `v0.16.76` fixes the Gitea Actions container-publish pipeline, which failed twice after the earlier GitHub-to-Gitea migration -- first at registry sign-in (missing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` repo secrets, added directly in Gitea's Actions settings, no workflow change needed) and then at the "Scan image for vulnerabilities" step, which used `aquasecurity/trivy-action@0.35.0`. That action installs Trivy at runtime via a `git clone`-based installer script against GitHub, a dependency separate from the registry sign-in fix and one that doesn't reliably resolve from a Gitea Actions runner. Replaced with two plain shell steps: a pinned `curl` of Trivy 0.56.2's release tarball directly from GitHub's release CDN (a single static HTTPS download, not a git checkout) followed by `trivy image` run directly, keeping the same severity/exit-code/format settings. Scanning behavior is unchanged; only the installation mechanism moved off the flaky git-based installer.
+
+`v0.16.77` fixes a follow-on to v0.16.76's Trivy-installer replacement: the pinned version, `0.56.2`, no longer exists on GitHub's release list (current is `v0.74.0`), so the `curl -sfL` request 404'd and failed fast with exit code 22 instead of installing anything. `TRIVY_VERSION` is now `0.74.0`, verified against the actual release assets before pushing. No other change to the install/scan steps from v0.16.76.
+
+`v0.16.78` restores GitHub's half of the dual-publish pipeline without touching Gitea's: the earlier migration commits had rewritten `container.yml`'s registry login, tag, and publish steps to target only `git.us2plus2.com` using Gitea-only secrets, so every push to GitHub since then failed in ~30 seconds at "Sign in to Gitea Container Registry" with "Username and password required" -- GitHub's repo never had `REGISTRY_USERNAME`/`REGISTRY_TOKEN`. The login, tag-generation, and publish steps are now duplicated, one set per registry, each gated with `if: github.server_url == 'https://github.com'` (or `!=`) so the workflow self-selects which registry to sign into and push to depending on which host is actually running it -- Gitea Actions keeps using the existing `REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets against `git.us2plus2.com` exactly as before, GitHub Actions goes back to `ghcr.io` using `github.actor`/`GITHUB_TOKEN` as it did pre-migration. The shared build/scan steps (smoke-test image, SQLite check, Trivy install/scan) are unconditional and run identically on both. Also reverts the v0.16.75 smoke-test change: the Dashboard heading text is back to "Dashboard" now that the Gitea pipeline is confirmed working end to end.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "site-gateway",
-  "version": "0.16.76",
+  "version": "0.16.78",
   "private": true,
   "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.",
   "type": "module",

src/public/app.js

@@ -511,7 +511,7 @@ function render() {
   const adminUsersActive = activeAdminTab === "users", adminGroupsActive = activeAdminTab === "groups", adminApiActive = activeAdminTab === "api";
   $("#open-create").classList.toggle("hidden", !(management || adminUsersActive || adminGroupsActive || adminApiActive || ["streaming","redirects","access"].includes(state.view)) || !canManage()); $("#check-health").classList.toggle("hidden", state.view !== "certificates" || !canAdmin()); $("#refresh-logs").classList.toggle("hidden", state.view !== "logs");
   if (overview) {
-    $("#page-title").textContent = "Dashboard v2";
+    $("#page-title").textContent = "Dashboard";
     $("#page-subtitle").textContent = "Health, activity, and system status at a glance.";
     renderDashboard();
     return;

src/public/index.html

@@ -11,7 +11,7 @@
   <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png">
   <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png">
   <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
-  <link rel="stylesheet" href="/styles.css?v=0.16.76">
+  <link rel="stylesheet" href="/styles.css?v=0.16.78">
 </head>
 
 <!-- ================================================================
@@ -103,7 +103,7 @@
         <button class="admin-only" data-view="administration">Admin</button><button data-view="account">Account</button><button data-view="documentation">Docs</button>
       </nav>
       <header>
-        <div><p class="eyebrow">Gateway control</p><h1 id="page-title">Dashboard v2</h1><p id="page-subtitle" class="muted">Health, activity, and system status at a glance.</p></div>
+        <div><p class="eyebrow">Gateway control</p><h1 id="page-title">Dashboard</h1><p id="page-subtitle" class="muted">Health, activity, and system status at a glance.</p></div>
         <div class="header-actions"><button id="open-create" class="button primary">＋ New hosted site</button><button id="check-health" class="button primary hidden">Run certificate check</button><button id="refresh-logs" class="button primary hidden">Refresh logs</button><button id="refresh-view" class="icon-button page-refresh" aria-label="Refresh this page" title="Refresh this page">↻</button></div>
       </header>
 
@@ -454,6 +454,6 @@
   <div id="toast" class="toast" role="status"></div>
   <div id="update-banner" class="update-banner hidden" role="status"><span>A new version of Site Gateway is available.</span><div class="update-banner-actions"><button id="update-banner-refresh" class="button primary">Refresh</button><button id="update-banner-dismiss" class="text-button">Dismiss</button></div></div>
   <!-- App scripts: core (app.js) then extended views/admin (features.js) -->
-  <script src="/app.js?v=0.16.76" defer></script><script src="/features.js?v=0.16.76" defer></script><script src="/select-enhance.js?v=0.16.76" defer></script>
+  <script src="/app.js?v=0.16.78" defer></script><script src="/features.js?v=0.16.78" defer></script><script src="/select-enhance.js?v=0.16.78" defer></script>
 </body>
 </html>