ci: streamline all workflows, use actions mirror and remove vendored bundles

.gitea/workflows/services-www-release-manual.yml

@@ -23,37 +23,17 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
       && github.actor == 'deytenit'
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
+    - name: Checkout repository
+      uses: actions/checkout@v4
     - name: Authenticate local registry
-      run: python3 .gitea/scripts/docker.py login
+      run: python3 ci/scripts/docker.py login
       env:
         REGISTRY: git.ermnvldmr.com
         REGISTRY_USER: deytenit
         REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
     - name: Verify successful build and immutable digest
       id: provenance
-      run: python3 .gitea/scripts/provenance.py
+      run: python3 ci/scripts/provenance.py
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}
         TESTED_DIGEST: ${{ inputs.tested_digest }}
@@ -82,7 +62,7 @@ jobs:
 
         git tag "$VERSION" "$TESTED_SHA"
 
-        python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"
+        python3 ci/scripts/git_write.py "refs/tags/$VERSION"
 
         export VERSION
 
@@ -101,7 +81,7 @@ jobs:
         RELEASE_PROVENANCE
 
         '
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: www-release-provenance
         path: .ci/www-release.json