Update actions/checkout action to v6

.gitea/workflows/cron.yaml

@@ -1,53 +0,0 @@
-name: Nightly Rebuild
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
-        with:
-          dockerfile: Dockerfile
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-      - run: bash tests/test.sh ci-image:${{ github.sha }}
-
-  build-push:
-    needs: [test]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2df7f5ca915bee # v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - id: get-latest-tag
-        run: |
-          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-      - id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
-        with:
-          images: jcabillot/ip
-          tags: |
-            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d7f5c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          pull: true

.gitea/workflows/docker-build.yaml

@@ -0,0 +1,46 @@
+name: Docker Build and Push
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: jcabillot/ip
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true

.gitea/workflows/main.yaml

@@ -1,49 +0,0 @@
-name: Main Release
-
-on:
-  push:
-    branches: [master]
-
-jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
-        with:
-          dockerfile: Dockerfile
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-      - run: bash tests/test.sh ci-image:${{ github.sha }}
-
-  build:
-    needs: [test]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t jcabillot/ip:${{ github.sha }} .
-
-  tag:
-    needs: [build]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-      - name: Configure git auth
-        run: |
-          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/web/ip.git"
-      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
-          DEFAULT_BUMP: patch
-          RELEASE_BRANCHES: master
-          WITH_V: true
-          GIT_API_TAGGING: false

.gitea/workflows/pr.yaml

@@ -1,22 +0,0 @@
-name: PR Checks
-
-on:
-  pull_request:
-    branches: [master]
-
-jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
-        with:
-          dockerfile: Dockerfile
-
-  build-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-      - run: bash tests/test.sh ci-image:${{ github.sha }}

.gitea/workflows/tag.yaml

@@ -1,48 +0,0 @@
-name: Tag Release
-
-on:
-  push:
-    tags: ['*']
-
-jobs:
-  hadolint:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
-        with:
-          dockerfile: Dockerfile
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-      - run: bash tests/test.sh ci-image:${{ github.sha }}
-
-  build-push:
-    needs: [test]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2df7f5ca915bee # v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
-        with:
-          images: jcabillot/ip
-          tags: |
-            type=ref,event=tag
-            type=ref,event=tag,suffix=-latest
-      - uses: docker/build-push-action@f9f3042f7e2789586610d7f5c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          pull: true

AGENTS.md

@@ -1,30 +0,0 @@
-# AGENTS.md
-
-## 1. Overview
-
-Lightweight PHP micro-service that returns the client's public IP address as JSON. Containerized with Docker and deployed on Kubernetes.
-
-## 2. Folder Structure
-
-- `root/`: Application source code served by Apache.
-    - `index.php`: Single endpoint returning `REMOTE_ADDR` as JSON.
-- `.gitea/workflows/`: Gitea Actions CI pipelines.
-    - `docker-build.yaml`: Build and push Docker image to Docker Hub on push/PR to master + daily cron.
-- `Dockerfile`: Multi-stage build extending `jcabillot/phpapache` base image, copies `root/` into `/var/www/html`.
-- `.gitlab-ci.yml`: Legacy GitLab CI config (deprecated, replaced by Gitea Actions).
-- `Jenkinsfile`: Legacy Jenkins pipeline (deprecated, replaced by Gitea Actions).
-
-## 3. Core Behaviors & Patterns
-
-- **Request/Response Flow**: Single PHP endpoint sets `Content-Type: application/json` header and returns `$_SERVER['REMOTE_ADDR']` encoded as JSON string. No routing, no framework, no state.
-- **Container Base Image Pattern**: `Dockerfile` uses `ARG VERSION="latest"` to allow version pinning at build time, extends `jcabillot/phpapache` which provides PHP + Apache pre-configured. Application code is layered on top via `COPY root /var/www/html`.
-- **Traefik IngressRoute with HTTPS Redirect**: Two IngressRoute resources handle traffic — `ip-websecure` serves HTTPS on the `websecure` entrypoint, `ip-web` catches HTTP on `web` entrypoint and applies a `redirectScheme` middleware for permanent HTTPS redirect. The Service reference in the HTTP IngressRoute is required by Traefik even though the middleware intercepts before reaching it.
-- **Health Probes**: Deployment defines both `livenessProbe` and `readinessProbe` using `httpGet` on `/` at the named `http` port (8080). Kubernetes uses these to restart unhealthy pods and exclude unready pods from the Service endpoints.
-- **Security Hardening**: Pod spec sets `automountServiceAccountToken: false` to prevent unnecessary Kubernetes API access from the container.
-
-## 4. Conventions
-
-- **Kubernetes Labels**: Pods use `app: "front"` for Service selector matching and `owner: "jcabillot"` for resource attribution. Deployment-level labels use `app: "front"`.
-- **Named Ports**: Container port is named `http` (8080) and referenced by name in probes and Service targetPort, avoiding hardcoded port numbers.
-- **Docker Image Tagging**: CI uses `docker/metadata-action` to generate tags — `latest` for master branch pushes, branch/PR/SHA tags for other events. Push is skipped on pull requests.
-- **CI Secrets**: Docker Hub credentials are stored as Gitea Actions secrets (`DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN`), never hardcoded.

renovate.json

@@ -1,17 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "customManagers": [
-    {
-      "customType": "regex",
-      "description": "Detect ARG VERSION pin for jcabillot/phpapache base image",
-      "managerFilePatterns": [
-        "/^Dockerfile$/"
-      ],
-      "matchStrings": [
-        "ARG\\s+VERSION=\"(?<currentValue>[^\"]+)\""
-      ],
-      "depNameTemplate": "jcabillot/phpapache",
-      "datasourceTemplate": "docker"
-    }
-  ]
-}

tests/test.sh

@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-IMAGE="${1:?Usage: test.sh <image>}"
-CONTAINER_NAME="test-$(echo "$IMAGE" | tr ':/' '-')-$$"
-PASSED=0
-FAILED=0
-TOTAL=0
-
-cleanup() {
-  docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
-}
-trap cleanup EXIT
-
-assert() {
-  local name="$1" expected="$2" actual="$3"
-  TOTAL=$((TOTAL + 1))
-  if [ "$expected" = "$actual" ]; then
-    echo "  PASS: $name"
-    PASSED=$((PASSED + 1))
-  else
-    echo "  FAIL: $name (expected: '$expected', got: '$actual')"
-    FAILED=$((FAILED + 1))
-  fi
-}
-
-assert_match() {
-  local name="$1" pattern="$2" actual="$3"
-  TOTAL=$((TOTAL + 1))
-  if echo "$actual" | grep -qE "$pattern"; then
-    echo "  PASS: $name"
-    PASSED=$((PASSED + 1))
-  else
-    echo "  FAIL: $name (pattern: '$pattern', got: '$actual')"
-    FAILED=$((FAILED + 1))
-  fi
-}
-
-echo "Running container: $IMAGE"
-docker run -d --name "$CONTAINER_NAME" -p 8080:8080 "$IMAGE" >/dev/null
-
-DOCKER_GW=$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}')
-BASE_URL="http://${DOCKER_GW}:8080"
-
-echo "Waiting for container on ${DOCKER_GW}:8080..."
-for i in $(seq 1 30); do
-  if curl -sf "$BASE_URL/" >/dev/null 2>&1; then
-    echo "Container ready after ${i}s"
-    break
-  fi
-  if [ "$i" -eq 30 ]; then
-    echo "FAIL: Container did not become ready within 30s"
-    docker logs "$CONTAINER_NAME"
-    exit 1
-  fi
-  sleep 1
-done
-
-echo ""
-echo "Test: GET /"
-RESPONSE=$(curl -sf -D - "$BASE_URL/")
-STATUS=$(echo "$RESPONSE" | head -1 | grep -oP '\d{3}')
-CONTENT_TYPE=$(echo "$RESPONSE" | grep -i 'content-type' | tr -d '\r' | cut -d: -f2- | xargs)
-BODY=$(echo "$RESPONSE" | tail -1)
-
-assert "HTTP status is 200" "200" "$STATUS"
-assert_match "Content-Type is application/json" "application/json" "$CONTENT_TYPE"
-assert_match "Body contains valid IP" '^(\"[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\"|\"[0-9a-fA-F:]+\")$' "$BODY"
-
-echo ""
-echo "Results: $PASSED/$TOTAL passed, $FAILED failed"
-[ "$FAILED" -eq 0 ]