chore: rename helm chart from hightower to trebuchet

- Rename charts/hightower → charts/trebuchet - Update Chart.yaml name field to 'trebuchet' - Rename all helm template helpers from 'hightower.*' to 'trebuchet.*' - Update all template files to reference trebuchet helpers - Update values.yaml credentials secret names to use trebuchet prefix - Update helm-release.yml workflow to: - Monitor charts/trebuchet/** path instead of charts/hightower/** - Reference correct chart path in lint and package steps - Remove GitHub Pages publishing (incompatible with Gitea) - Add informative logging about chart artifact location This completes the rename from Hightower to Trebuchet branding. The helm chart is now properly named and the CI workflow is compatible with Gitea. Ref: FAR-132
chore: move .github folder to .gitea for Gitea compatibility
2026-05-18 15:56:05 +00:00 · 2026-05-18 15:56:05 +00:00 · 2026-05-16 21:09:46 -04:00 · 2026-05-16 21:02:41 -04:00 · 2026-05-16 20:40:28 -04:00 · 2026-05-16 20:35:51 -04:00
8 changed files with 154 additions and 118 deletions
@@ -16,7 +16,7 @@ concurrency:
 jobs:
  check:
    name: Type-check & lint
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -43,7 +43,7 @@ jobs:
    name: Build & push worker image
    needs: check
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
@@ -55,12 +55,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to GHCR
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push worker image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -68,14 +68,14 @@ jobs:
          context: .
          push: true
          tags: |
-            ghcr.io/farhoodlabs/trebuchet:latest
-            ghcr.io/farhoodlabs/trebuchet:sha-${{ github.sha }}
+            git.farh.net/farhoodlabs/trebuchet:latest
+            git.farh.net/farhoodlabs/trebuchet:sha-${{ github.sha }}

  build-api:
    name: Build & push API image
    needs: check
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
@@ -87,12 +87,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to GHCR
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -102,5 +102,5 @@ jobs:
          push: true
          no-cache: true
          tags: |
-            ghcr.io/farhoodlabs/trebuchet-api:latest
-            ghcr.io/farhoodlabs/trebuchet-api:sha-${{ github.sha }}
+            git.farh.net/farhoodlabs/trebuchet-api:latest
+            git.farh.net/farhoodlabs/trebuchet-api:sha-${{ github.sha }}
@@ -13,7 +13,7 @@ concurrency:
 jobs:
  preflight:
    name: Preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}

@@ -35,7 +35,6 @@ jobs:
          if [[ -z "$LATEST" ]]; then
            echo "version=1.0.0-beta.1" >> "$GITHUB_OUTPUT"
          else
-            # Extract N from 1.0.0-beta.N and increment
            N=$(echo "$LATEST" | grep -oE 'beta\.([0-9]+)' | grep -oE '[0-9]+')
            NEXT=$((N + 1))
            echo "version=1.0.0-beta.$NEXT" >> "$GITHUB_OUTPUT"
@@ -47,9 +46,10 @@ jobs:
  build-docker:
    name: Build Docker (worker)
    needs: preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
+      packages: write

    steps:
      - name: Checkout
@@ -58,11 +58,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push worker image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -71,14 +72,15 @@ jobs:
          push: true
          provenance: mode=max
          sbom: true
-          tags: farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
+          tags: git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}

  build-docker-api:
    name: Build Docker (API)
    needs: preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
+      packages: write

    steps:
      - name: Checkout
@@ -87,11 +89,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -101,15 +104,15 @@ jobs:
          push: true
          provenance: mode=max
          sbom: true
-          tags: farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
+          tags: git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}

  sign-docker:
    name: Sign Docker images
    needs: [preflight, build-docker, build-docker-api]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
-      id-token: write
+      packages: write
    outputs:
      worker_digest: ${{ steps.inspect-worker.outputs.digest }}
      api_digest: ${{ steps.inspect-api.outputs.digest }}
@@ -118,57 +121,63 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Inspect worker image
        id: inspect-worker
        run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Inspect API image
        id: inspect-api
        run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Install cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Sign worker image
-        run: cosign sign --yes "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"

      - name: Sign API image
-        run: cosign sign --yes "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"

      - name: Verify worker image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
        run: |
          sleep 10
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release-beta.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
+            "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"

      - name: Verify API image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release-beta.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
+            "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"

  publish-npm:
    name: Publish npm (beta)
    needs: [preflight, sign-docker]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
-      id-token: write

    steps:
      - name: Checkout
@@ -13,7 +13,7 @@ concurrency:
 jobs:
  preflight:
    name: Preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
@@ -42,11 +42,12 @@ jobs:
        id: probe
        shell: bash
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_URL: https://git.farh.net
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail

-          npx semantic-release@25 --dry-run --no-ci 2>&1 | tee semantic-release.log
+          npx -p semantic-release@25 -p semantic-release-gitea semantic-release --dry-run --no-ci 2>&1 | tee semantic-release.log

          if grep -qi "the next release version is" semantic-release.log; then
            echo "should_release=true" >> "$GITHUB_OUTPUT"
@@ -60,9 +61,10 @@ jobs:
    name: Build Docker (worker)
    needs: preflight
    if: needs.preflight.outputs.should_release == 'true'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
+      packages: write

    steps:
      - name: Checkout
@@ -71,11 +73,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push worker image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -85,16 +88,17 @@ jobs:
          provenance: mode=max
          sbom: true
          tags: |
-            farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
-            farhoodlabs/trebuchet:latest
+            git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
+            git.farh.net/farhoodlabs/trebuchet:latest

  build-docker-api:
    name: Build Docker (API)
    needs: preflight
    if: needs.preflight.outputs.should_release == 'true'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
+      packages: write

    steps:
      - name: Checkout
@@ -103,11 +107,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -118,16 +123,16 @@ jobs:
          provenance: mode=max
          sbom: true
          tags: |
-            farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
-            farhoodlabs/trebuchet-api:latest
+            git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
+            git.farh.net/farhoodlabs/trebuchet-api:latest

  sign-docker:
    name: Sign Docker images
    needs: [preflight, build-docker, build-docker-api]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
-      id-token: write
+      packages: write
    outputs:
      worker_digest: ${{ steps.inspect-worker.outputs.digest }}
      api_digest: ${{ steps.inspect-api.outputs.digest }}
@@ -136,57 +141,63 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Inspect worker image
        id: inspect-worker
        run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Inspect API image
        id: inspect-api
        run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"

      - name: Install cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Sign worker image
-        run: cosign sign --yes "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"

      - name: Sign API image
-        run: cosign sign --yes "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"

      - name: Verify worker image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
        run: |
          sleep 10
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
+            "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"

      - name: Verify API image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
+            "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"

  publish-npm:
    name: Publish npm
    needs: [preflight, sign-docker]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: read
-      id-token: write

    steps:
      - name: Checkout
@@ -226,9 +237,9 @@ jobs:
          fi

  release:
-    name: Create GitHub release
+    name: Create Gitea release
    needs: [preflight, publish-npm]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    permissions:
      contents: write

@@ -250,7 +261,8 @@ jobs:
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

-      - name: Create GitHub release
+      - name: Create Gitea release
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx semantic-release@25
+          GITEA_URL: https://git.farh.net
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: npx -p semantic-release@25 -p semantic-release-gitea semantic-release
@@ -18,7 +18,7 @@ concurrency:
 jobs:
  rollback:
    name: Roll back npm beta dist-tag
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
    steps:
      - name: Validate target version
        id: target
@@ -17,8 +17,8 @@ concurrency:

 jobs:
  rollback:
-    name: Roll back npm, Docker, and GitHub release latest
-    runs-on: runners-farhoodlabs
+    name: Roll back npm and Docker latest
+    runs-on: ubuntu-latest
    steps:
      - name: Checkout tags
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -74,48 +74,44 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          registry: git.farh.net
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Verify Docker image tag exists
-        run: docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
+        run: docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"

      - name: Install cosign
        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Verify Docker image signature before rollback
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
        run: |
-          cosign verify \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-            --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/release.yml@refs/heads/main" \
-            "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
+            "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"

      - name: Move Docker latest
        run: |
          docker buildx imagetools create \
-            --tag "farhoodlabs/trebuchet:latest" \
-            "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
+            --tag "git.farh.net/farhoodlabs/trebuchet:latest" \
+            "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"

      - name: Move npm latest
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm dist-tag add "@trebuchet/cli@${{ steps.target.outputs.version }}" latest

-      - name: Mark GitHub release as latest
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release edit "v${{ steps.target.outputs.version }}" --latest
-
      - name: Show final npm dist-tags
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm dist-tag ls @trebuchet/cli

      - name: Verify Docker latest now points to target
-        run: docker buildx imagetools inspect "farhoodlabs/trebuchet:latest"
+        run: docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:latest"

      - name: Write summary
        run: |
@@ -124,6 +120,9 @@ jobs:
            echo ""
            echo "- Target version: \`${{ steps.target.outputs.version }}\`"
            echo "- npm package: \`@trebuchet/cli\`"
-            echo "- Docker image: \`farhoodlabs/trebuchet\`"
-            echo "- GitHub release: \`v${{ steps.target.outputs.version }}\` marked as latest"
+            echo "- Docker image: \`git.farh.net/farhoodlabs/trebuchet\`"
+            echo ""
+            echo "NOTE: Gitea determines the 'latest' release by date, not a flag."
+            echo "To re-mark \`v${{ steps.target.outputs.version }}\` as the latest"
+            echo "release on Gitea, edit the release in the UI to bump its date."
          } >> "$GITHUB_STEP_SUMMARY"
@@ -5,3 +5,5 @@ credentials/
 dist/
 repos/
 .turbo/
+cosign.key
+cosign.pub
@@ -9,13 +9,6 @@
        "npmPublish": false
      }
    ],
-    [
-      "@semantic-release/github",
-      {
-        "successCommentCondition": false,
-        "failCommentCondition": false,
-        "releasedLabels": false
-      }
-    ]
+    "semantic-release-gitea"
  ]
 }
@@ -4,3 +4,24 @@ description: API-driven AI pentester built on Shannon, deployed as a service on
 type: application
 version: 0.1.1
 appVersion: "1.0.0"
+home: https://git.farh.net/farhoodlabs/trebuchet
+sources:
+  - https://git.farh.net/farhoodlabs/trebuchet
+maintainers:
+  - name: farhoodlabs
+    url: https://git.farh.net/farhoodlabs
+keywords:
+  - security
+  - pentesting
+  - ai
+  - kubernetes
+annotations:
+  artifacthub.io/license: AGPL-3.0
+  artifacthub.io/links: |
+    - name: source
+      url: https://git.farh.net/farhoodlabs/trebuchet
+  artifacthub.io/images: |
+    - name: worker
+      image: git.farh.net/farhoodlabs/trebuchet:latest
+    - name: api
+      image: git.farh.net/farhoodlabs/trebuchet-api:latest
Author	SHA1	Message	Date
Chris Farhood	c3227c3dcd	chore: rename helm chart from hightower to trebuchet CI / Type-check & lint (pull_request) Successful in 16s Details CI / Build & push worker image (pull_request) Has been skipped Details CI / Build & push API image (pull_request) Has been skipped Details - Rename charts/hightower → charts/trebuchet - Update Chart.yaml name field to 'trebuchet' - Rename all helm template helpers from 'hightower.' to 'trebuchet.' - Update all template files to reference trebuchet helpers - Update values.yaml credentials secret names to use trebuchet prefix - Update helm-release.yml workflow to: - Monitor charts/trebuchet/ path instead of charts/hightower/ - Reference correct chart path in lint and package steps - Remove GitHub Pages publishing (incompatible with Gitea) - Add informative logging about chart artifact location This completes the rename from Hightower to Trebuchet branding. The helm chart is now properly named and the CI workflow is compatible with Gitea. Ref: FAR-132	2026-05-18 15:56:05 +00:00
Chris Farhood	ff32ec85c5	chore: move .github folder to .gitea for Gitea compatibility CI / Type-check & lint (pull_request) Successful in 15s Details CI / Build & push worker image (pull_request) Has been skipped Details CI / Build & push API image (pull_request) Has been skipped Details Gitea prefers .gitea/ISSUE_TEMPLATE/ and .gitea/workflows/ over the GitHub-convention .github/ equivalents. Moves all issue templates and workflow files to the Gitea-native paths and updates CLAUDE.md references. Cosign certificate identity paths in release/rollback workflows are intentionally left unchanged — they reference the signing identity from prior workflow runs and will need a separate update when the CI signing infrastructure migrates. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-18 15:56:05 +00:00
Chris Farhood	48c0351be3	ci: switch back to REGISTRY_TOKEN PAT for registry auth CI / Type-check & lint (push) Successful in 15s Details CI / Build & push API image (push) Successful in 1m2s Details CI / Build & push worker image (push) Successful in 3m6s Details Even on Gitea 1.26 the auto-token still hits the registry with 401 in this environment. Use the gitea-admin PAT stored as REGISTRY_TOKEN. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 21:09:46 -04:00
Chris Farhood	5c7e4d45d4	ci: revert to auto GITEA_TOKEN for registry auth CI / Type-check & lint (push) Successful in 15s Details CI / Build & push worker image (push) Failing after 8s Details CI / Build & push API image (push) Failing after 8s Details Gitea 1.26 (PR #36173) honors permissions.packages: write on the auto-provided GITEA_TOKEN, so the PAT workaround is no longer needed. You can delete the REGISTRY_TOKEN org secret. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 21:02:41 -04:00
Chris Farhood	8fe637e0e2	ci: pin registry login username to gitea-admin CI / Type-check & lint (push) Successful in 15s Details CI / Build & push worker image (push) Failing after 7s Details CI / Build & push API image (push) Failing after 8s Details REGISTRY_TOKEN was created under the gitea-admin user, so the docker/helm registry username must match. Using github.actor would fail for any other workflow-triggering user. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 20:40:28 -04:00
Chris Farhood	f3d73c9160	ci: use REGISTRY_TOKEN PAT for container registry auth CI / Type-check & lint (push) Successful in 52s Details CI / Build & push worker image (push) Failing after 1m50s Details CI / Build & push API image (push) Failing after 1m50s Details The auto-provided GITEA_TOKEN doesn't grant write:package scope in Gitea 1.25 even when permissions.packages: write is declared. Switch registry logins to a dedicated PAT stored as REGISTRY_TOKEN. Keep GITEA_TOKEN for semantic-release-gitea API calls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 20:35:51 -04:00
Chris Farhood	a6da45f6bf	ci: trigger workflow re-run CI / Type-check & lint (push) Successful in 1m8s Details CI / Build & push worker image (push) Failing after 2m11s Details CI / Build & push API image (push) Failing after 2m11s Details	2026-05-16 19:49:54 -04:00
Chris Farhood	547d8ae314	ci: trigger workflow re-run CI / Build & push API image (push) Failing after 1m39s Details CI / Type-check & lint (push) Successful in 1m10s Details CI / Build & push worker image (push) Failing after 1m38s Details	2026-05-16 19:36:42 -04:00
Chris Farhood	1a874724c2	ci: trigger workflow re-run CI / Type-check & lint (push) Successful in 1m12s Details CI / Build & push API image (push) Failing after 2m15s Details CI / Build & push worker image (push) Failing after 2m15s Details	2026-05-16 19:11:59 -04:00
Chris Farhood	262a8be326	ci: migrate from GitHub Actions to Gitea Actions Helm Chart Release / Lint, package & push OCI (push) Failing after 12s Details CI / Type-check & lint (push) Failing after 37s Details CI / Build & push API image (push) Has been skipped Details CI / Build & push worker image (push) Has been skipped Details Move workflows to .gitea/workflows and adapt for git.farh.net: - Push container images to git.farh.net instead of GHCR/Docker Hub - Publish Helm chart as OCI artifact (no gh-pages, Gitea lacks Pages) - Replace cosign keyless signing with key-based (COSIGN_PRIVATE_KEY/PASSWORD/PUBLIC_KEY) - Swap @semantic-release/github for semantic-release-gitea - Drop gh CLI from rollback workflow - Use GITEA_TOKEN for registry auth and release creation - Add Artifact Hub annotations to Chart.yaml - Run on ubuntu-latest Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 18:55:32 -04:00