chore: rename helm chart from hightower to trebuchet

- Rename charts/hightower → charts/trebuchet
- Update Chart.yaml name field to 'trebuchet'
- Rename all helm template helpers from 'hightower.*' to 'trebuchet.*'
- Update all template files to reference trebuchet helpers
- Update values.yaml credentials secret names to use trebuchet prefix
- Update helm-release.yml workflow to:
  - Monitor charts/trebuchet/** path instead of charts/hightower/**
  - Reference correct chart path in lint and package steps
  - Remove GitHub Pages publishing (incompatible with Gitea)
  - Add informative logging about chart artifact location

This completes the rename from Hightower to Trebuchet branding. The helm
chart is now properly named and the CI workflow is compatible with Gitea.

Ref: FAR-132

.gitea/workflows/ci.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   check:
     name: Type-check & lint
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -43,7 +43,7 @@ jobs:
     name: Build & push worker image
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
@@ -55,12 +55,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to GHCR
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          registry: ghcr.io
+          registry: git.farh.net
-          username: ${{ github.actor }}
+          username: gitea-admin
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push worker image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -68,14 +68,14 @@ jobs:
           context: .
           push: true
           tags: |
-            ghcr.io/farhoodlabs/trebuchet:latest
+            git.farh.net/farhoodlabs/trebuchet:latest
-            ghcr.io/farhoodlabs/trebuchet:sha-${{ github.sha }}
+            git.farh.net/farhoodlabs/trebuchet:sha-${{ github.sha }}
 
   build-api:
     name: Build & push API image
     needs: check
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
@@ -87,12 +87,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to GHCR
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          registry: ghcr.io
+          registry: git.farh.net
-          username: ${{ github.actor }}
+          username: gitea-admin
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push API image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -102,5 +102,5 @@ jobs:
           push: true
           no-cache: true
           tags: |
-            ghcr.io/farhoodlabs/trebuchet-api:latest
+            git.farh.net/farhoodlabs/trebuchet-api:latest
-            ghcr.io/farhoodlabs/trebuchet-api:sha-${{ github.sha }}
+            git.farh.net/farhoodlabs/trebuchet-api:sha-${{ github.sha }}

.gitea/workflows/release-beta.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   preflight:
     name: Preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
 
@@ -35,7 +35,6 @@ jobs:
           if [[ -z "$LATEST" ]]; then
             echo "version=1.0.0-beta.1" >> "$GITHUB_OUTPUT"
           else
-            # Extract N from 1.0.0-beta.N and increment
             N=$(echo "$LATEST" | grep -oE 'beta\.([0-9]+)' | grep -oE '[0-9]+')
             NEXT=$((N + 1))
             echo "version=1.0.0-beta.$NEXT" >> "$GITHUB_OUTPUT"
@@ -47,9 +46,10 @@ jobs:
   build-docker:
     name: Build Docker (worker)
     needs: preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
 
     steps:
       - name: Checkout
@@ -58,11 +58,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push worker image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -71,14 +72,15 @@ jobs:
           push: true
           provenance: mode=max
           sbom: true
-          tags: farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
+          tags: git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
 
   build-docker-api:
     name: Build Docker (API)
     needs: preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
 
     steps:
       - name: Checkout
@@ -87,11 +89,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push API image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -101,15 +104,15 @@ jobs:
           push: true
           provenance: mode=max
           sbom: true
-          tags: farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
+          tags: git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
 
   sign-docker:
     name: Sign Docker images
     needs: [preflight, build-docker, build-docker-api]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
+      packages: write
     outputs:
       worker_digest: ${{ steps.inspect-worker.outputs.digest }}
       api_digest: ${{ steps.inspect-api.outputs.digest }}
@@ -118,57 +121,63 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Inspect worker image
         id: inspect-worker
         run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Inspect API image
         id: inspect-api
         run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Install cosign
         uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Sign worker image
-        run: cosign sign --yes "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
 
       - name: Sign API image
-        run: cosign sign --yes "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
 
       - name: Verify worker image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
         run: |
           sleep 10
-          cosign verify \
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release-beta.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
 
       - name: Verify API image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
         run: |
-          cosign verify \
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release-beta.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
 
   publish-npm:
     name: Publish npm (beta)
     needs: [preflight, sign-docker]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Checkout

.gitea/workflows/release.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   preflight:
     name: Preflight
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     outputs:
@@ -42,11 +42,12 @@ jobs:
         id: probe
         shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_URL: https://git.farh.net
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
           set -euo pipefail
 
-          npx semantic-release@25 --dry-run --no-ci 2>&1 | tee semantic-release.log
+          npx -p semantic-release@25 -p semantic-release-gitea semantic-release --dry-run --no-ci 2>&1 | tee semantic-release.log
 
           if grep -qi "the next release version is" semantic-release.log; then
             echo "should_release=true" >> "$GITHUB_OUTPUT"
@@ -60,9 +61,10 @@ jobs:
     name: Build Docker (worker)
     needs: preflight
     if: needs.preflight.outputs.should_release == 'true'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
 
     steps:
       - name: Checkout
@@ -71,11 +73,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push worker image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -85,16 +88,17 @@ jobs:
           provenance: mode=max
           sbom: true
           tags: |
-            farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
+            git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}
-            farhoodlabs/trebuchet:latest
+            git.farh.net/farhoodlabs/trebuchet:latest
 
   build-docker-api:
     name: Build Docker (API)
     needs: preflight
     if: needs.preflight.outputs.should_release == 'true'
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: write
 
     steps:
       - name: Checkout
@@ -103,11 +107,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push API image
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
@@ -118,16 +123,16 @@ jobs:
           provenance: mode=max
           sbom: true
           tags: |
-            farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
+            git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}
-            farhoodlabs/trebuchet-api:latest
+            git.farh.net/farhoodlabs/trebuchet-api:latest
 
   sign-docker:
     name: Sign Docker images
     needs: [preflight, build-docker, build-docker-api]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
+      packages: write
     outputs:
       worker_digest: ${{ steps.inspect-worker.outputs.digest }}
       api_digest: ${{ steps.inspect-api.outputs.digest }}
@@ -136,57 +141,63 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Inspect worker image
         id: inspect-worker
         run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Inspect API image
         id: inspect-api
         run: |
-          docker buildx imagetools inspect "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
+          docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}"
-          DIGEST="sha256:$(docker buildx imagetools inspect --raw "farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
+          DIGEST="sha256:$(docker buildx imagetools inspect --raw "git.farh.net/farhoodlabs/trebuchet-api:${{ needs.preflight.outputs.version }}" | sha256sum | cut -d' ' -f1)"
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
       - name: Install cosign
         uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Sign worker image
-        run: cosign sign --yes "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
 
       - name: Sign API image
-        run: cosign sign --yes "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
 
       - name: Verify worker image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
         run: |
           sleep 10
-          cosign verify \
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "git.farh.net/farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet@${{ steps.inspect-worker.outputs.digest }}"
 
       - name: Verify API image signature
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
         run: |
-          cosign verify \
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "git.farh.net/farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
-            --certificate-identity https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }} \
-            "farhoodlabs/trebuchet-api@${{ steps.inspect-api.outputs.digest }}"
 
   publish-npm:
     name: Publish npm
     needs: [preflight, sign-docker]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Checkout
@@ -226,9 +237,9 @@ jobs:
           fi
 
   release:
-    name: Create GitHub release
+    name: Create Gitea release
     needs: [preflight, publish-npm]
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     permissions:
       contents: write
 
@@ -250,7 +261,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Create GitHub release
+      - name: Create Gitea release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITEA_URL: https://git.farh.net
-        run: npx semantic-release@25
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: npx -p semantic-release@25 -p semantic-release-gitea semantic-release

.gitea/workflows/rollback-beta.yml

@@ -18,7 +18,7 @@ concurrency:
 jobs:
   rollback:
     name: Roll back npm beta dist-tag
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     steps:
       - name: Validate target version
         id: target

.gitea/workflows/rollback.yml

@@ -17,8 +17,8 @@ concurrency:
 
 jobs:
   rollback:
-    name: Roll back npm, Docker, and GitHub release latest
+    name: Roll back npm and Docker latest
-    runs-on: runners-farhoodlabs
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout tags
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -74,48 +74,44 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Log in to Docker Hub
+      - name: Log in to Gitea registry
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          registry: git.farh.net
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: gitea-admin
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Verify Docker image tag exists
-        run: docker buildx imagetools inspect "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
+        run: docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
 
       - name: Install cosign
         uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Verify Docker image signature before rollback
+        env:
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
         run: |
-          cosign verify \
+          cosign verify --key env://COSIGN_PUBLIC_KEY \
-            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
-            --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/release.yml@refs/heads/main" \
-            "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
 
       - name: Move Docker latest
         run: |
           docker buildx imagetools create \
-            --tag "farhoodlabs/trebuchet:latest" \
+            --tag "git.farh.net/farhoodlabs/trebuchet:latest" \
-            "farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
+            "git.farh.net/farhoodlabs/trebuchet:${{ steps.target.outputs.version }}"
 
       - name: Move npm latest
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm dist-tag add "@trebuchet/cli@${{ steps.target.outputs.version }}" latest
 
-      - name: Mark GitHub release as latest
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release edit "v${{ steps.target.outputs.version }}" --latest
-
       - name: Show final npm dist-tags
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm dist-tag ls @trebuchet/cli
 
       - name: Verify Docker latest now points to target
-        run: docker buildx imagetools inspect "farhoodlabs/trebuchet:latest"
+        run: docker buildx imagetools inspect "git.farh.net/farhoodlabs/trebuchet:latest"
 
       - name: Write summary
         run: |
@@ -124,6 +120,9 @@ jobs:
             echo ""
             echo "- Target version: \`${{ steps.target.outputs.version }}\`"
             echo "- npm package: \`@trebuchet/cli\`"
-            echo "- Docker image: \`farhoodlabs/trebuchet\`"
+            echo "- Docker image: \`git.farh.net/farhoodlabs/trebuchet\`"
-            echo "- GitHub release: \`v${{ steps.target.outputs.version }}\` marked as latest"
+            echo ""
+            echo "NOTE: Gitea determines the 'latest' release by date, not a flag."
+            echo "To re-mark \`v${{ steps.target.outputs.version }}\` as the latest"
+            echo "release on Gitea, edit the release in the UI to bump its date."
           } >> "$GITHUB_STEP_SUMMARY"

.gitignore

@@ -5,3 +5,5 @@ credentials/
 dist/
 repos/
 .turbo/
+cosign.key
+cosign.pub

.releaserc.json

@@ -9,13 +9,6 @@
         "npmPublish": false
       }
     ],
-    [
+    "semantic-release-gitea"
-      "@semantic-release/github",
-      {
-        "successCommentCondition": false,
-        "failCommentCondition": false,
-        "releasedLabels": false
-      }
-    ]
   ]
 }

charts/trebuchet/Chart.yaml

@@ -4,3 +4,24 @@ description: API-driven AI pentester built on Shannon, deployed as a service on
 type: application
 version: 0.1.1
 appVersion: "1.0.0"
+home: https://git.farh.net/farhoodlabs/trebuchet
+sources:
+  - https://git.farh.net/farhoodlabs/trebuchet
+maintainers:
+  - name: farhoodlabs
+    url: https://git.farh.net/farhoodlabs
+keywords:
+  - security
+  - pentesting
+  - ai
+  - kubernetes
+annotations:
+  artifacthub.io/license: AGPL-3.0
+  artifacthub.io/links: |
+    - name: source
+      url: https://git.farh.net/farhoodlabs/trebuchet
+  artifacthub.io/images: |
+    - name: worker
+      image: git.farh.net/farhoodlabs/trebuchet:latest
+    - name: api
+      image: git.farh.net/farhoodlabs/trebuchet-api:latest