Use Forgejo workflows and registry

.dockerignore

@@ -5,7 +5,7 @@ config.ini
 
 # Local runtime artefacts.
 .git/
-.github/
+.forgejo/
 .agents/
 .codex/
 .venv/

.forgejo/ISSUE_TEMPLATE/bug_report.yml

@@ -1,7 +1,9 @@
 name: Bug report
-description: Report reproducible incorrect behavior
+about: Report reproducible incorrect behavior
 title: "[Bug]: "
-labels: ["bug"]
+ref: main
+labels:
+  - bug
 body:
   - type: markdown
     attributes:

.forgejo/workflows/ci.yml

@@ -1,25 +1,25 @@
-name: CI
-
+name: ci
 on:
   push:
   pull_request:
 
-permissions:
-  contents: read
-
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-22.04
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
+
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
+
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -r requirements.txt
       - run: python -m py_compile wlc_monitor.py
@@ -27,9 +27,21 @@ jobs:
       - run: python -m pip check
 
   container:
-    runs-on: ubuntu-latest
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-22.04
+      volumes:
+        - /certs/client:/certs/client
+    env:
+      DOCKER_HOST: tcp://docker:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /certs/client
     steps:
       - uses: actions/checkout@v4
-      - run: cp .env.example .env
-      - run: docker compose config --quiet
-      - run: docker build --tag wlc-monitor:test .
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: prod
+          push: false
+          tags: wlc-monitor:test

.forgejo/workflows/publish-latest.yml

@@ -0,0 +1,42 @@
+name: publish-latest
+on:
+  push:
+    branches: [main]
+
+jobs:
+  docker:
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-22.04
+      volumes:
+        - /certs/client:/certs/client
+    env:
+      DOCKER_HOST: tcp://docker:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /certs/client
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: git.snakedesert.se
+          # Forgejo exposes github.* compatibility aliases; this matches the
+          # established Porchlight workflow and works with older runners.
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: git.snakedesert.se/${{ github.repository }}
+          tags: |
+            type=raw,value=edge
+            type=sha,format=short
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: prod
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.forgejo/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: publish-image
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  docker:
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-22.04
+      volumes:
+        - /certs/client:/certs/client
+    env:
+      DOCKER_HOST: tcp://docker:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /certs/client
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: git.snakedesert.se
+          # Forgejo exposes github.* compatibility aliases; this matches the
+          # established Porchlight workflow and works with older runners.
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: git.snakedesert.se/${{ github.repository }}
+          tags: |
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: prod
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/dependabot.yml

@@ -1,14 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: pip
-    directory: /
-    schedule:
-      interval: monthly
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: monthly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: monthly

CONTRIBUTING.md

@@ -4,9 +4,9 @@ Thanks for helping improve WLC Monitor.
 
 ## Before you start
 
-Use GitHub Issues for reproducible bugs and focused feature proposals. Search
-existing issues first. Use the private process in [SECURITY.md](SECURITY.md)
-for vulnerabilities.
+Use this repository's Issues for reproducible bugs and focused feature
+proposals. Search existing issues first. Use the private process in
+[SECURITY.md](SECURITY.md) for vulnerabilities.
 
 ## Development setup
 

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM python:3.12-slim
+FROM python:3.12-slim AS prod
 
 # Unbuffered so `docker logs` shows poll output as it happens rather than in
 # 4KB bursts -- stdout is block-buffered when it is not a TTY.

README.md

@@ -48,9 +48,14 @@ cp .env.example .env
 chmod 600 .env
 # Edit .env and set the controller, SNMP credentials, mail server,
 # sender, and recipients.
-docker compose up -d --build
+docker compose pull
+docker compose up -d --no-build
 ```
 
+Tagged releases are published to
+`git.snakedesert.se/lundberg/wlc-monitor`. To build the image locally instead,
+run `docker compose up -d --build`.
+
 Verify the controller and mail paths:
 
 ```bash
@@ -226,6 +231,12 @@ docker compose config --quiet
 docker build -t wlc-monitor:test .
 ```
 
+Forgejo Actions runs these checks for pushes and pull requests. Pushes to
+`main` publish `edge` and commit-SHA container tags; version tags matching
+`v*` publish the version and `latest` tags. Registry publication requires the
+repository secret `REGISTRY_TOKEN`, following the same runner setup as the
+other projects on this Forgejo instance.
+
 ## Contributing and security
 
 Bug reports and pull requests are welcome; see

SECURITY.md

@@ -8,13 +8,11 @@ begin.
 
 ## Reporting a vulnerability
 
-Do not open a public issue for a suspected vulnerability. Prefer GitHub's
-private vulnerability reporting from the repository's Security tab. Include
-the affected commit or version, impact, reproduction steps, and any suggested
-mitigation.
-
-If private reporting is not enabled, ask the maintainer for a private reporting
-channel without disclosing vulnerability details publicly.
+Do not open a public issue for a suspected vulnerability. Contact the
+maintainer through an established private channel and include the affected
+commit or version, impact, reproduction steps, and any suggested mitigation.
+If you do not have a private contact method, ask for one in an issue without
+disclosing vulnerability details.
 
 Do not include real SNMP credentials, `.env`, `config.ini`, `state.json`,
 controller addresses, AP names, or unredacted logs. Reports will be

docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wlc-monitor:
     build: .
-    image: wlc-monitor:latest
+    image: git.snakedesert.se/lundberg/wlc-monitor:latest
     container_name: wlc-monitor
     restart: unless-stopped