6 Commits

Include renames

Author	SHA1	Message	Date
Lucas RayanandClaude Sonnet 5.5	5d4e7147ce	ci: cache what is rebuilt on every run ... npm and Go module caches, the embedded Postgres binaries, Trivy's database, and the daemon's own layer cache for image builds. The webmail Next build is no longer run a second time outside the Dockerfile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 10:07:21 -03:00
Lucas RayanandClaude Sonnet 5.5	a28a9bc9d4	ci: run Go tests as a non-root user ... initdb, used by the embedded Postgres in the e2e suites, refuses to run as root. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:33:43 -03:00
Lucas RayanandClaude Sonnet 5.5	c30d618b3f	ci: copy files into containers instead of bind-mounting, patch two advisories ... The job workspace is a volume the DinD daemon cannot see, so migrations and the Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:22:42 -03:00
Lucas RayanandClaude Sonnet 5.5	33fa05b019	ci: run Trivy from its official image and drop the gha cache ... aquasecurity/trivy-action clones the Trivy repository from the workflow's own server, which on Gitea is not GitHub. The gha buildx cache has no Gitea counterpart. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 09:01:45 -03:00
Lucas RayanandClaude Sonnet 5.5	59363734ff	ci: publish images to the Gitea registry, use the gitea context ... Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each architecture separately (no artifact upload, no gha cache) and joins them with imagetools. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface and the GITEA_* equivalents are not set. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 08:48:44 -03:00
Lucas RayanandClaude Sonnet 5.5	9a722bc5ac	ci: publish images to the Gitea registry and move workflows to .gitea ... Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each architecture separately (no artifact upload, no gha cache) and joins them with imagetools. Workflows live in .gitea/workflows and use the gitea context. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-30 08:48:14 -03:00