From e7bde2b3f47efa869e37d198bda61380f75f935b Mon Sep 17 00:00:00 2001 From: Johan Lundberg Date: Thu, 30 Jul 2026 23:35:14 +0200 Subject: [PATCH] Use Forgejo workflows and registry --- .dockerignore | 2 +- .../ISSUE_TEMPLATE/bug_report.yml | 6 ++- .../pull_request_template.md | 0 {.github => .forgejo}/workflows/ci.yml | 32 +++++++++----- .forgejo/workflows/publish-latest.yml | 42 ++++++++++++++++++ .forgejo/workflows/publish.yml | 43 +++++++++++++++++++ .github/dependabot.yml | 14 ------ CONTRIBUTING.md | 6 +-- Dockerfile | 2 +- README.md | 13 +++++- SECURITY.md | 12 +++--- docker-compose.yml | 2 +- 12 files changed, 134 insertions(+), 40 deletions(-) rename {.github => .forgejo}/ISSUE_TEMPLATE/bug_report.yml (95%) rename {.github => .forgejo}/pull_request_template.md (100%) rename {.github => .forgejo}/workflows/ci.yml (55%) create mode 100644 .forgejo/workflows/publish-latest.yml create mode 100644 .forgejo/workflows/publish.yml delete mode 100644 .github/dependabot.yml diff --git a/.dockerignore b/.dockerignore index 1114078..99911cf 100644 --- a/.dockerignore +++ b/.dockerignore @@ -5,7 +5,7 @@ config.ini # Local runtime artefacts. .git/ -.github/ +.forgejo/ .agents/ .codex/ .venv/ diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.forgejo/ISSUE_TEMPLATE/bug_report.yml similarity index 95% rename from .github/ISSUE_TEMPLATE/bug_report.yml rename to .forgejo/ISSUE_TEMPLATE/bug_report.yml index 449c019..5245830 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.forgejo/ISSUE_TEMPLATE/bug_report.yml @@ -1,7 +1,9 @@ name: Bug report -description: Report reproducible incorrect behavior +about: Report reproducible incorrect behavior title: "[Bug]: " -labels: ["bug"] +ref: main +labels: + - bug body: - type: markdown attributes: diff --git a/.github/pull_request_template.md b/.forgejo/pull_request_template.md similarity index 100% rename from .github/pull_request_template.md rename to .forgejo/pull_request_template.md diff --git a/.github/workflows/ci.yml b/.forgejo/workflows/ci.yml similarity index 55% rename from .github/workflows/ci.yml rename to .forgejo/workflows/ci.yml index e2b0c26..a93c28a 100644 --- a/.github/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -1,25 +1,25 @@ -name: CI - +name: ci on: push: pull_request: -permissions: - contents: read - jobs: test: - runs-on: ubuntu-latest + runs-on: docker + container: + image: catthehacker/ubuntu:act-22.04 strategy: fail-fast: false matrix: python-version: ["3.10", "3.12", "3.13"] steps: - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 with: python-version: ${{ matrix.python-version }} cache: pip + - run: python -m pip install --upgrade pip - run: python -m pip install -r requirements.txt - run: python -m py_compile wlc_monitor.py @@ -27,9 +27,21 @@ jobs: - run: python -m pip check container: - runs-on: ubuntu-latest + runs-on: docker + container: + image: catthehacker/ubuntu:act-22.04 + volumes: + - /certs/client:/certs/client + env: + DOCKER_HOST: tcp://docker:2376 + DOCKER_TLS_VERIFY: "1" + DOCKER_CERT_PATH: /certs/client steps: - uses: actions/checkout@v4 - - run: cp .env.example .env - - run: docker compose config --quiet - - run: docker build --tag wlc-monitor:test . + + - uses: docker/build-push-action@v6 + with: + context: . + target: prod + push: false + tags: wlc-monitor:test diff --git a/.forgejo/workflows/publish-latest.yml b/.forgejo/workflows/publish-latest.yml new file mode 100644 index 0000000..a3d5568 --- /dev/null +++ b/.forgejo/workflows/publish-latest.yml @@ -0,0 +1,42 @@ +name: publish-latest +on: + push: + branches: [main] + +jobs: + docker: + runs-on: docker + container: + image: catthehacker/ubuntu:act-22.04 + volumes: + - /certs/client:/certs/client + env: + DOCKER_HOST: tcp://docker:2376 + DOCKER_TLS_VERIFY: "1" + DOCKER_CERT_PATH: /certs/client + steps: + - uses: actions/checkout@v4 + + - uses: docker/login-action@v3 + with: + registry: git.snakedesert.se + # Forgejo exposes github.* compatibility aliases; this matches the + # established Porchlight workflow and works with older runners. + username: ${{ github.repository_owner }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - uses: docker/metadata-action@v5 + id: meta + with: + images: git.snakedesert.se/${{ github.repository }} + tags: | + type=raw,value=edge + type=sha,format=short + + - uses: docker/build-push-action@v6 + with: + context: . + target: prod + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} diff --git a/.forgejo/workflows/publish.yml b/.forgejo/workflows/publish.yml new file mode 100644 index 0000000..fe86166 --- /dev/null +++ b/.forgejo/workflows/publish.yml @@ -0,0 +1,43 @@ +name: publish-image +on: + push: + tags: ['v*'] + +jobs: + docker: + runs-on: docker + container: + image: catthehacker/ubuntu:act-22.04 + volumes: + - /certs/client:/certs/client + env: + DOCKER_HOST: tcp://docker:2376 + DOCKER_TLS_VERIFY: "1" + DOCKER_CERT_PATH: /certs/client + steps: + - uses: actions/checkout@v4 + + - uses: docker/login-action@v3 + with: + registry: git.snakedesert.se + # Forgejo exposes github.* compatibility aliases; this matches the + # established Porchlight workflow and works with older runners. + username: ${{ github.repository_owner }} + password: ${{ secrets.REGISTRY_TOKEN }} + + - uses: docker/metadata-action@v5 + id: meta + with: + images: git.snakedesert.se/${{ github.repository }} + tags: | + type=ref,event=tag + type=semver,pattern={{version}} + type=raw,value=latest + + - uses: docker/build-push-action@v6 + with: + context: . + target: prod + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 8ba1e84..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,14 +0,0 @@ -version: 2 -updates: - - package-ecosystem: pip - directory: / - schedule: - interval: monthly - - package-ecosystem: docker - directory: / - schedule: - interval: monthly - - package-ecosystem: github-actions - directory: / - schedule: - interval: monthly diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index fa761c3..ee6fcc1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,9 +4,9 @@ Thanks for helping improve WLC Monitor. ## Before you start -Use GitHub Issues for reproducible bugs and focused feature proposals. Search -existing issues first. Use the private process in [SECURITY.md](SECURITY.md) -for vulnerabilities. +Use this repository's Issues for reproducible bugs and focused feature +proposals. Search existing issues first. Use the private process in +[SECURITY.md](SECURITY.md) for vulnerabilities. ## Development setup diff --git a/Dockerfile b/Dockerfile index 3821a53..353f168 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # syntax=docker/dockerfile:1 -FROM python:3.12-slim +FROM python:3.12-slim AS prod # Unbuffered so `docker logs` shows poll output as it happens rather than in # 4KB bursts -- stdout is block-buffered when it is not a TTY. diff --git a/README.md b/README.md index f1949c8..8cd0059 100644 --- a/README.md +++ b/README.md @@ -48,9 +48,14 @@ cp .env.example .env chmod 600 .env # Edit .env and set the controller, SNMP credentials, mail server, # sender, and recipients. -docker compose up -d --build +docker compose pull +docker compose up -d --no-build ``` +Tagged releases are published to +`git.snakedesert.se/lundberg/wlc-monitor`. To build the image locally instead, +run `docker compose up -d --build`. + Verify the controller and mail paths: ```bash @@ -226,6 +231,12 @@ docker compose config --quiet docker build -t wlc-monitor:test . ``` +Forgejo Actions runs these checks for pushes and pull requests. Pushes to +`main` publish `edge` and commit-SHA container tags; version tags matching +`v*` publish the version and `latest` tags. Registry publication requires the +repository secret `REGISTRY_TOKEN`, following the same runner setup as the +other projects on this Forgejo instance. + ## Contributing and security Bug reports and pull requests are welcome; see diff --git a/SECURITY.md b/SECURITY.md index c2327e9..c22ab06 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,13 +8,11 @@ begin. ## Reporting a vulnerability -Do not open a public issue for a suspected vulnerability. Prefer GitHub's -private vulnerability reporting from the repository's Security tab. Include -the affected commit or version, impact, reproduction steps, and any suggested -mitigation. - -If private reporting is not enabled, ask the maintainer for a private reporting -channel without disclosing vulnerability details publicly. +Do not open a public issue for a suspected vulnerability. Contact the +maintainer through an established private channel and include the affected +commit or version, impact, reproduction steps, and any suggested mitigation. +If you do not have a private contact method, ask for one in an issue without +disclosing vulnerability details. Do not include real SNMP credentials, `.env`, `config.ini`, `state.json`, controller addresses, AP names, or unredacted logs. Reports will be diff --git a/docker-compose.yml b/docker-compose.yml index cae0187..70a8d67 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,7 +1,7 @@ services: wlc-monitor: build: . - image: wlc-monitor:latest + image: git.snakedesert.se/lundberg/wlc-monitor:latest container_name: wlc-monitor restart: unless-stopped