From f7f266b994a1b7d0e3b54e49e640be35b8078bf0 Mon Sep 17 00:00:00 2001 From: Astounds Date: Fri, 29 May 2026 21:28:22 -0500 Subject: Add hardened Docker support and multi-arch CI Multi-stage Dockerfile (non-root, Tor-ready), compose file, and entrypoints. Forgejo CI builds linux/amd64+arm64, scans with checksum-verified Grype, and pins all actions to commit SHA. Makefile gains venv bootstrap and docker targets; server.py gains a --bind flag. --- .forgejo/workflows/git-sync.yaml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .forgejo/workflows/git-sync.yaml (limited to '.forgejo/workflows/git-sync.yaml') diff --git a/.forgejo/workflows/git-sync.yaml b/.forgejo/workflows/git-sync.yaml new file mode 100644 index 0000000..f1028c5 --- /dev/null +++ b/.forgejo/workflows/git-sync.yaml @@ -0,0 +1,40 @@ +name: git-sync-with-mirror + +on: + push: + branches: [ master ] + workflow_dispatch: + +jobs: + git-sync: + runs-on: ubuntu-latest + + steps: + - name: git-sync + env: + git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git + git_sync_destination_repo: ssh://git@c.fridu.us/software/yt-local.git + if: env.git_sync_source_repo && env.git_sync_destination_repo + uses: actions/git-sync@v1 + with: + source_repo: git@git.fridu.us:heckyel/yt-local.git + source_branch: "master" + destination_repo: ssh://git@c.fridu.us/software/yt-local.git + destination_branch: "master" + source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} + destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} + + - name: git-sync-sourcehut + env: + git_sync_source_repo: git@git.fridu.us:heckyel/yt-local.git + git_sync_destination_repo: git@git.sr.ht:~heckyel/yt-local + if: env.git_sync_source_repo && env.git_sync_destination_repo + uses: actions/git-sync@v1 + with: + source_repo: git@git.fridu.us:heckyel/yt-local.git + source_branch: "master" + destination_repo: git@git.sr.ht:~heckyel/yt-local + destination_branch: "master" + source_ssh_private_key: ${{ secrets.GIT_SYNC_SOURCE_SSH_PRIVATE_KEY }} + destination_ssh_private_key: ${{ secrets.GIT_SYNC_DESTINATION_SSH_PRIVATE_KEY }} + continue-on-error: true -- cgit v1.2.3