Convert build-push job: add fetch-depth: 0, get-latest-tag logic, tag with {version}-latest
Add version comments (# v6, # v4, etc.) on all uses: directives
Add pull: true on build-push action
main.yaml (Main Release)
Add hadolint job (continue-on-error: true)
Add test job
Add build job (build production image with SHA tag)
Add tag job: configure git auth with SA_TOKEN_ACTION_PUSH_TAGS, bump version on push to master
Version comments on all uses: directives
pr.yaml (PR Checks)
Rename job lint → hadolint, add version comments
Merge lint + test into single build-test job (matches htpasswd pattern)
tag.yaml (Tag Release)
Change trigger from branches: [master] to tags: ['*']
Add full pipeline: hadolint → test → build-push (login + metadata + push to Docker Hub)
Tags: type=ref,event=tag and type=ref,event=tag,suffix=-latest
Version comments, pull: true
Key changes from old pattern
No direct Docker push on push-to-master (only on cron or tag events)
Uses SA_TOKEN_ACTION_PUSH_TAGS secret for automated tag creation
All actions pinned with SHA + version comments for Renovate compatibility
Convert Gitea Actions workflows to the standard htpasswd 4-workflow pattern used across web/* repos.
## Changes
### cron.yaml (Nightly Rebuild)
- Keep original schedule: `0 0 * * *`
- Add `hadolint` job (lint Dockerfile, continue-on-error: true)
- Add `test` job (build ci-image, run tests)
- Convert `build-push` job: add `fetch-depth: 0`, get-latest-tag logic, tag with `{version}-latest`
- Add version comments (`# v6`, `# v4`, etc.) on all `uses:` directives
- Add `pull: true` on build-push action
### main.yaml (Main Release)
- Add `hadolint` job (continue-on-error: true)
- Add `test` job
- Add `build` job (build production image with SHA tag)
- Add `tag` job: configure git auth with `SA_TOKEN_ACTION_PUSH_TAGS`, bump version on push to master
- Version comments on all `uses:` directives
### pr.yaml (PR Checks)
- Rename job `lint` → `hadolint`, add version comments
- Merge `lint` + `test` into single `build-test` job (matches htpasswd pattern)
### tag.yaml (Tag Release)
- Change trigger from `branches: [master]` to `tags: ['*']`
- Add full pipeline: hadolint → test → build-push (login + metadata + push to Docker Hub)
- Tags: `type=ref,event=tag` and `type=ref,event=tag,suffix=-latest`
- Version comments, `pull: true`
## Key changes from old pattern
- No direct Docker push on push-to-master (only on cron or tag events)
- Uses `SA_TOKEN_ACTION_PUSH_TAGS` secret for automated tag creation
- All actions pinned with SHA + version comments for Renovate compatibility
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Convert Gitea Actions workflows to the standard htpasswd 4-workflow pattern used across web/* repos.
Changes
cron.yaml (Nightly Rebuild)
0 0 * * *hadolintjob (lint Dockerfile, continue-on-error: true)testjob (build ci-image, run tests)build-pushjob: addfetch-depth: 0, get-latest-tag logic, tag with{version}-latest# v6,# v4, etc.) on alluses:directivespull: trueon build-push actionmain.yaml (Main Release)
hadolintjob (continue-on-error: true)testjobbuildjob (build production image with SHA tag)tagjob: configure git auth withSA_TOKEN_ACTION_PUSH_TAGS, bump version on push to masteruses:directivespr.yaml (PR Checks)
lint→hadolint, add version commentslint+testinto singlebuild-testjob (matches htpasswd pattern)tag.yaml (Tag Release)
branches: [master]totags: ['*']type=ref,event=tagandtype=ref,event=tag,suffix=-latestpull: trueKey changes from old pattern
SA_TOKEN_ACTION_PUSH_TAGSsecret for automated tag creation