ci: streamline all workflows, use actions mirror and remove vendored bundles

.gitea/workflows/services-www-deploy-manual.yml

@@ -31,37 +31,17 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
       && github.actor == 'deytenit'
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
+    - name: Checkout repository
+      uses: actions/checkout@v4
     - name: Authenticate local registry
-      run: python3 .gitea/scripts/docker.py login
+      run: python3 ci/scripts/docker.py login
       env:
         REGISTRY: git.ermnvldmr.com
         REGISTRY_USER: deytenit
         REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_READ_TOKEN }}
     - name: Verify successful build and immutable digest
       id: provenance
-      run: python3 .gitea/scripts/provenance.py
+      run: python3 ci/scripts/provenance.py
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}
         TESTED_DIGEST: ${{ inputs.tested_digest }}
@@ -91,32 +71,6 @@ jobs:
 
         '
     - name: Await production rollout
-      run: "TARGET_COMMIT=\"sha-${TESTED_SHA:0:7}\"\nENDPOINT=\"https://www.ermnvldmr.com/version.json\"\
-        \n\necho \"========================================================\"\necho\
-        \ \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
-        \  $TARGET_COMMIT\"\necho \"========================================================\"\
-        \n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
-        \ $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
-        \n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H\
-        \ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
-        \ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept:\
-        \ application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\"\
-        \ \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\"\
-        \ ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
-        \ || true)\n    echo \"  Live commit:  ${LIVE_COMMIT:-<none>}\"\n\n    if\
-        \ [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success!\
-        \ Production has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"\
-        $RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] ||\
-        \ [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare\
-        \ WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
-        \ + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected\
-        \ status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT\
-        \ -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
-        \ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo\
-        \ \"The GitOps release commit was already pushed to the repository; FluxCD\
-        \ will reconcile the cluster.\"\n    echo \"Skipping further external HTTP\
-        \ verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT\
-        \ + 1))\n  sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
-        \ after 7.5 minutes.\"\nexit 1\n"
+      run: bash ci/scripts/await-rollout.sh https://www.ermnvldmr.com/version.json "sha-${TESTED_SHA:0:7}"
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}