ci: streamline all workflows, use actions mirror and remove vendored bundles

.gitea/actions/download-artifact/LICENSE

@@ -1,22 +0,0 @@
-
-The MIT License (MIT)
-
-Copyright (c) 2018 GitHub, Inc. and contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

.gitea/actions/download-artifact/UPSTREAM.json

@@ -1,8 +0,0 @@
-{
-  "name": "ci-action-gitea-download-artifact",
-  "source": "https://github.com/christopherhx/gitea-download-artifact.git",
-  "requested_ref": "v4",
-  "commit": "75635f32b4c1c41c4b3d64e8f85210112ed4c9c7",
-  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-download-artifact.git",
-  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-download-artifact"
-}

.gitea/actions/download-artifact/action.yml

@@ -1,40 +0,0 @@
-name: 'Download a Build Artifact'
-description: 'Download a build artifact that was previously uploaded in the workflow by the upload-artifact action'
-author: 'GitHub'
-inputs:
-  name:
-    description: 'Name of the artifact to download. If unspecified, all artifacts for the run are downloaded.'
-    required: false
-  path:
-    description: 'Destination path. Supports basic tilde expansion. Defaults to $GITHUB_WORKSPACE'
-    required: false
-  pattern:
-    description: 'A glob pattern matching the artifacts that should be downloaded. Ignored if name is specified.'
-    required: false
-  merge-multiple:
-    description: 'When multiple artifacts are matched, this changes the behavior of the destination directories.
-      If true, the downloaded artifacts will be in the same directory specified by path.
-      If false, the downloaded artifacts will be extracted into individual named directories within the specified path.'
-    required: false
-    default: 'false'
-  github-token:
-    description: 'The GitHub token used to authenticate with the GitHub API.
-      This is required when downloading artifacts from a different repository or from a different workflow run.
-      If this is not specified, the action will attempt to download artifacts from the current repository and the current workflow run.'
-    required: false
-  repository:
-    description: 'The repository owner and the repository name joined together by "/".
-      If github-token is specified, this is the repository that artifacts will be downloaded from.'
-    required: false
-    default: ${{ github.repository }}
-  run-id:
-    description: 'The id of the workflow run where the desired download artifact was uploaded from.
-      If github-token is specified, this is the run that artifacts will be downloaded from.'
-    required: false
-    default: ${{ github.run_id }}
-outputs:
-  download-path:
-    description: 'Path of artifact download'
-runs:
-  using: 'node20'
-  main: 'dist/index.js'

.gitea/actions/download-artifact/package.json

@@ -1,47 +0,0 @@
-{
-  "name": "download-artifact",
-  "version": "4.0.1",
-  "description": "Download an Actions Artifact from a workflow run",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "release": "ncc build src/download-artifact.ts && git add -f dist/",
-    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:build\"",
-    "format": "prettier --write **/*.ts",
-    "format-check": "prettier --check **/*.ts",
-    "lint": "eslint **/*.ts"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/actions/download-artifact.git"
-  },
-  "keywords": [
-    "Actions",
-    "GitHub",
-    "Artifacts",
-    "Download"
-  ],
-  "author": "GitHub",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/actions/download-artifact/issues"
-  },
-  "homepage": "https://github.com/actions/download-artifact#readme",
-  "dependencies": {
-    "@actions/artifact": "^2.0.1",
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^5.1.1",
-    "minimatch": "^9.0.3"
-  },
-  "devDependencies": {
-    "@types/node": "^12.12.6",
-    "@typescript-eslint/eslint-plugin": "^6.14.0",
-    "@vercel/ncc": "^0.33.4",
-    "concurrently": "^5.2.0",
-    "eslint": "^8.55.0",
-    "eslint-plugin-github": "^4.10.1",
-    "eslint-plugin-prettier": "^5.0.1",
-    "prettier": "^3.1.1",
-    "typescript": "^5.3.3"
-  }
-}

.gitea/actions/upload-artifact/LICENSE

@@ -1,22 +0,0 @@
-
-The MIT License (MIT)
-
-Copyright (c) 2018 GitHub, Inc. and contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

.gitea/actions/upload-artifact/UPSTREAM.json

@@ -1,8 +0,0 @@
-{
-  "name": "ci-action-gitea-upload-artifact",
-  "source": "https://github.com/christopherhx/gitea-upload-artifact.git",
-  "requested_ref": "v4",
-  "commit": "81f940d004763f986ba3582c007fd842dd5cb0d7",
-  "path": "/private/tmp/gitea-migration-20261105/mirrors/ci-action-gitea-upload-artifact.git",
-  "destination": "https://git.ermnvldmr.com/deytenit/ci-action-gitea-upload-artifact"
-}

.gitea/actions/upload-artifact/action.yml

@@ -1,61 +0,0 @@
-name: 'Upload a Build Artifact'
-description: 'Upload a build artifact that can be used by subsequent workflow steps'
-author: 'GitHub'
-inputs:
-  name:
-    description: 'Artifact name'
-    default: 'artifact'
-  path:
-    description: 'A file, directory or wildcard pattern that describes what to upload'
-    required: true
-  if-no-files-found:
-    description: >
-      The desired behavior if no files are found using the provided path.
-
-      Available Options:
-        warn: Output a warning but do not fail the action
-        error: Fail the action with an error message
-        ignore: Do not output any warnings or errors, the action does not fail
-    default: 'warn'
-  retention-days:
-    description: >
-      Duration after which artifact will expire in days. 0 means using default retention.
-
-      Minimum 1 day.
-      Maximum 90 days unless changed from the repository settings page.
-  compression-level:
-    description: >
-      The level of compression for Zlib to be applied to the artifact archive.
-      The value can range from 0 to 9:
-      - 0: No compression
-      - 1: Best speed
-      - 6: Default compression (same as GNU Gzip)
-      - 9: Best compression
-      Higher levels will result in better compression, but will take longer to complete.
-      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
-    default: '6'
-  overwrite:
-    description: >
-      If true, an artifact with a matching name will be deleted before a new one is uploaded.
-      If false, the action will fail if an artifact for the given name already exists.
-      Does not fail if the artifact does not exist.
-    default: 'false'
-
-outputs:
-  artifact-id:
-    description: >
-      A unique identifier for the artifact that was just uploaded. Empty if the artifact upload failed.
-
-      This ID can be used as input to other APIs to download, delete or get more information about an artifact: https://docs.github.com/en/rest/actions/artifacts
-  artifact-url:
-    description: >
-      A download URL for the artifact that was just uploaded. Empty if the artifact upload failed.
-
-      This download URL only works for requests Authenticated with GitHub. Anonymous downloads will be prompted to first login. 
-      If an anonymous download URL is needed than a short time restricted URL can be generated using the download artifact API: https://docs.github.com/en/rest/actions/artifacts#download-an-artifact    
-
-      This URL will be valid for as long as the artifact exists and the workflow run and repository exists. Once an artifact has expired this URL will no longer work.
-      Common uses cases for such a download URL can be adding download links to artifacts in descriptions or comments on pull requests or issues.
-runs:
-  using: 'node20'
-  main: 'dist/index.js'

.gitea/actions/upload-artifact/package.json

@@ -1,54 +0,0 @@
-{
-  "name": "upload-artifact",
-  "version": "4.2.0",
-  "description": "Upload an Actions Artifact in a workflow run",
-  "main": "dist/index.js",
-  "scripts": {
-    "build": "tsc",
-    "release": "ncc build src/upload-artifact.ts && git add -f dist/index.js",
-    "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:test\" \"npm:build\"",
-    "format": "prettier --write **/*.ts",
-    "format-check": "prettier --check **/*.ts",
-    "lint": "eslint **/*.ts",
-    "test": "jest --testTimeout 10000"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/actions/upload-artifact.git"
-  },
-  "keywords": [
-    "Actions",
-    "GitHub",
-    "Artifacts",
-    "Upload"
-  ],
-  "author": "GitHub",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/actions/upload-artifact/issues"
-  },
-  "homepage": "https://github.com/actions/upload-artifact#readme",
-  "dependencies": {
-    "@actions/artifact": "^2.1.0",
-    "@actions/core": "^1.10.0",
-    "@actions/github": "^6.0.0",
-    "@actions/glob": "^0.3.0",
-    "@actions/io": "^1.1.2"
-  },
-  "devDependencies": {
-    "@types/jest": "^29.2.5",
-    "@types/node": "^18.11.18",
-    "@typescript-eslint/parser": "^5.48.0",
-    "@vercel/ncc": "^0.36.0",
-    "concurrently": "^7.6.0",
-    "eslint": "^8.31.0",
-    "eslint-plugin-github": "^4.6.0",
-    "eslint-plugin-jest": "^27.2.0",
-    "glob": "^8.0.3",
-    "jest": "^29.3.1",
-    "jest-circus": "^29.3.1",
-    "prettier": "^2.8.1",
-    "ts-jest": "^29.0.3",
-    "typescript": "^4.9.4"
-  }
-}

.gitea/scripts/cache.py

@@ -1,87 +0,0 @@
-import hashlib
-import json
-import os
-import platform
-import subprocess
-import sys
-import tarfile
-import tempfile
-import urllib.error
-import urllib.parse
-import urllib.request
-import zipfile
-from pathlib import Path
-
-SERVER='https://git.ermnvldmr.com'
-
-
-def eligible(run, repository, current_run):
-    if run.get('repository',{}).get('full_name')!=repository:
-        return False
-    if str(run.get('id'))==current_run:
-        return True
-    return run.get('head_branch')=='next' and run.get('event') in ('push','workflow_dispatch') and run.get('status')=='completed' and run.get('conclusion')=='success'
-
-
-def request(url):
-    if not url.startswith(SERVER+'/'):
-        raise ValueError('Unexpected cache artifact host')
-    class LocalRedirect(urllib.request.HTTPRedirectHandler):
-        def redirect_request(self, req, fp, code, msg, headers, newurl):
-            if not newurl.startswith(SERVER+'/'):
-                raise ValueError('Unexpected cache storage host')
-            return super().redirect_request(req,fp,code,msg,headers,newurl)
-    req=urllib.request.Request(url,headers={'Authorization':'token '+os.environ['CACHE_TOKEN']})
-    return urllib.request.build_opener(LocalRedirect).open(req,timeout=60)
-
-
-def api(path):
-    with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+path) as response:
-        return json.load(response)
-
-
-def main():
-    store=Path(subprocess.check_output(['pnpm','store','path','--silent'],text=True).strip())
-    archive=Path('.ci/pnpm-store.tar')
-    if sys.argv[1]=='pack':
-        archive.parent.mkdir(exist_ok=True)
-        store.mkdir(parents=True,exist_ok=True)
-        with tarfile.open(archive,'w') as target:target.add(store,arcname='.')
-        return
-    versions=subprocess.check_output(['node','--version'],text=True).strip()+'-'+subprocess.check_output(['pnpm','--version'],text=True).strip()
-    key='pnpm-'+platform.system().lower()+'-'+platform.machine()+'-'+versions+'-'+hashlib.sha256(Path('pnpm-lock.yaml').read_bytes()).hexdigest()
-    with open(os.environ['GITHUB_OUTPUT'],'a') as output:output.write('key='+key+'\n')
-    try:
-        artifacts=api('/actions/artifacts?name='+urllib.parse.quote(key))['artifacts']
-        artifacts.sort(key=lambda a:a['id'],reverse=True)
-        for artifact in artifacts:
-            if artifact.get('expired',True) or artifact.get('name')!=key:
-                continue
-            run_id=artifact.get('workflow_run',{}).get('id')
-            if not run_id:
-                continue
-            run=api('/actions/runs/'+str(run_id))
-            if not eligible(run,os.environ['GITHUB_REPOSITORY'],os.environ['GITHUB_RUN_ID']):
-                continue
-            with tempfile.TemporaryDirectory(prefix='pnpm-artifact-cache-') as directory:
-                downloaded=Path(directory)/'cache.zip'
-                with request(SERVER+'/api/v1/repos/'+os.environ['GITHUB_REPOSITORY']+'/actions/artifacts/'+str(artifact['id'])+'/zip') as response,downloaded.open('wb') as target:
-                    while chunk:=response.read(1048576):target.write(chunk)
-                with zipfile.ZipFile(downloaded) as zipped:
-                    members=[name for name in zipped.namelist() if name.rsplit('/',1)[-1]=='pnpm-store.tar']
-                    if len(members)!=1:
-                        raise ValueError('Invalid cache archive')
-                    packed=Path(directory)/'store.tar'
-                    with zipped.open(members[0]) as source,packed.open('wb') as target:
-                        while chunk:=source.read(1048576):target.write(chunk)
-                store.mkdir(parents=True,exist_ok=True)
-                with tarfile.open(packed) as tar:tar.extractall(store,filter='data')
-            print('Restored repository-scoped pnpm cache artifact')
-            return
-    except (urllib.error.HTTPError,urllib.error.URLError,ValueError,tarfile.TarError,zipfile.BadZipFile):
-        print('Cache unavailable; dependencies will be fetched normally')
-        return
-    print('No eligible cache artifact; dependencies will be fetched normally')
-
-
-if __name__=='__main__':main()

.gitea/scripts/docker.py

@@ -1,64 +0,0 @@
-import json
-import os
-import re
-import subprocess
-import sys
-from pathlib import Path
-
-
-def lines(value):
-    return [line.strip() for line in value.splitlines() if line.strip()]
-
-
-def output(name, value):
-    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
-        stream.write(f'{name}<<GITEA_VALUE\n{value}\nGITEA_VALUE\n')
-
-
-def metadata(images, rules, sha):
-    result = []
-    for rule in lines(rules):
-        fields = dict(part.split('=', 1) for part in rule.split(',') if '=' in part)
-        if fields.get('enable', 'true').lower() == 'false':
-            continue
-        kind = fields.get('type')
-        if kind == 'sha':
-            tag = 'sha-' + sha[:7]
-        elif kind == 'raw':
-            tag = fields['value']
-        else:
-            raise ValueError('Unsupported metadata rule')
-        if not re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}', tag):
-            raise ValueError('Invalid image tag')
-        result.extend(image.lower() + ':' + tag for image in lines(images))
-    return result
-
-
-def main():
-    mode = sys.argv[1]
-    if mode == 'login':
-        subprocess.run(['docker', 'login', os.environ['REGISTRY'], '--username', os.environ['REGISTRY_USER'], '--password-stdin'], input=os.environ['REGISTRY_TOKEN'], text=True, check=True)
-    elif mode == 'metadata':
-        output('tags', '\n'.join(metadata(os.environ['IMAGES'], os.environ['TAG_RULES'], os.environ['SOURCE_SHA'])))
-        output('labels', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'])
-    elif mode == 'build':
-        command = ['docker', 'buildx', 'build', '--metadata-file', '/tmp/image-metadata.json']
-        for env, flag in [('TAGS', '--tag'), ('LABELS', '--label'), ('BUILD_ARGS', '--build-arg')]:
-            for value in lines(os.environ.get(env, '')):
-                command.extend([flag, value])
-        command += ['--label', 'org.opencontainers.image.revision=' + os.environ['SOURCE_SHA'], '--label', 'com.ermnvldmr.ci.run=' + os.environ['RUN_ID']]
-        if os.environ.get('PLATFORMS'):
-            command += ['--platform', os.environ['PLATFORMS']]
-        if os.environ.get('DOCKERFILE'):
-            command += ['--file', os.environ['DOCKERFILE']]
-        if os.environ.get('PUSH', 'false').lower() == 'true':
-            command.append('--push')
-        command.append(os.environ.get('CONTEXT', '.'))
-        subprocess.run(command, check=True)
-        output('digest', json.loads(Path('/tmp/image-metadata.json').read_text())['containerimage.digest'])
-    else:
-        raise ValueError('Unknown docker operation')
-
-
-if __name__ == '__main__':
-    main()

.gitea/scripts/git_write.py

@@ -1,25 +0,0 @@
-import os
-import re
-import shlex
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-
-def main():
-    ref=sys.argv[1]
-    if ref not in ('HEAD:next','trunk') and not re.fullmatch(r'refs/tags/[A-Za-z0-9][A-Za-z0-9._-]*',ref):
-        raise ValueError('Unexpected publication ref')
-    repository=os.environ['GITHUB_REPOSITORY']
-    if not re.fullmatch(r'deytenit/[A-Za-z0-9_.-]+',repository):
-        raise ValueError('Unexpected repository owner')
-    with tempfile.TemporaryDirectory(prefix='gitea-write-key-') as directory:
-        key=Path(directory)/'key';key.write_text(os.environ['GIT_WRITE_KEY']);key.chmod(0o600)
-        known=Path(__file__).resolve().parent.parent/'known_hosts'
-        env=dict(os.environ);env.pop('GIT_WRITE_KEY',None)
-        env['GIT_SSH_COMMAND']=shlex.join(['ssh','-T','-i',str(key),'-o','IdentitiesOnly=yes','-o','StrictHostKeyChecking=yes','-o','HostKeyAlgorithms=ssh-ed25519','-o','UserKnownHostsFile='+str(known)])
-        subprocess.run(['git','push','ssh://git@git.ermnvldmr.com:22222/'+repository+'.git',ref],env=env,check=True)
-
-
-if __name__=='__main__':main()

.gitea/scripts/provenance.py

@@ -1,113 +0,0 @@
-import json
-import base64
-import io
-import zipfile
-import os
-import re
-import subprocess
-import urllib.request
-
-SERVER = 'https://git.ermnvldmr.com'
-REPO = 'deytenit/ermnvldmr.com'
-IMAGE = SERVER.removeprefix('https://') + '/' + REPO + '/www'
-
-
-def validate_input(sha, digest, run_id):
-    if not re.fullmatch(r'[0-9a-f]{40}', sha):
-        raise ValueError('Full source SHA required')
-    if not re.fullmatch(r'sha256:[0-9a-f]{64}', digest):
-        raise ValueError('OCI sha256 digest required')
-    if not re.fullmatch(r'[1-9][0-9]*', run_id):
-        raise ValueError('Numeric build run ID required')
-
-
-def validate_run(run, sha):
-    expected = {'head_sha': sha, 'head_branch': 'next', 'status': 'completed', 'conclusion': 'success'}
-    if any(run.get(key) != value for key, value in expected.items()):
-        raise ValueError('Build did not succeed for this next commit')
-    if run.get('repository', {}).get('full_name') != REPO or (run.get('head_repository') and run['head_repository'].get('full_name') != REPO):
-        raise ValueError('Build source repository mismatch')
-    if run.get('path') != 'services-www-next-required.yml@refs/heads/next':
-        raise ValueError('Wrong build workflow')
-    if run.get('event') not in ('push', 'workflow_dispatch'):
-        raise ValueError('Untrusted build event')
-
-
-def api(path):
-    req = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + path, headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
-    with urllib.request.urlopen(req, timeout=30) as response:
-        return json.load(response)
-
-
-def validate_labels(labels, sha, run_id):
-    if labels.get('org.opencontainers.image.revision') != sha or labels.get('com.ermnvldmr.ci.run') != run_id:
-        raise ValueError('Immutable image provenance mismatch')
-
-
-def validate_manifest(manifest, sha, digest, run_id):
-    expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO}
-    if manifest != expected:
-        raise ValueError('Build artifact does not attest requested image digest')
-
-
-def artifact_manifest(run_id, name='www-provenance', filename='www-provenance.json'):
-    artifacts = api('/actions/runs/' + run_id + '/artifacts')['artifacts']
-    matching = [a for a in artifacts if a.get('name') == name and not a.get('expired', True)]
-    if len(matching) != 1:
-        raise ValueError('Exactly one unexpired build provenance artifact required')
-    class SameHostRedirect(urllib.request.HTTPRedirectHandler):
-        def redirect_request(self, req, fp, code, msg, headers, newurl):
-            if not newurl.startswith(SERVER + '/'):
-                raise ValueError('Unexpected artifact storage host')
-            return super().redirect_request(req, fp, code, msg, headers, newurl)
-    request = urllib.request.Request(SERVER + '/api/v1/repos/' + REPO + '/actions/artifacts/' + str(matching[0]['id']) + '/zip', headers={'Authorization': 'token ' + os.environ['PROVENANCE_TOKEN']})
-    with urllib.request.build_opener(SameHostRedirect).open(request, timeout=30) as response:
-        payload = response.read(1024 * 1024 + 1)
-    if len(payload) > 1024 * 1024:
-        raise ValueError('Unexpected provenance artifact size')
-    with zipfile.ZipFile(io.BytesIO(payload)) as archive:
-        members = [name for name in archive.namelist() if name.rsplit('/', 1)[-1] == filename]
-        if len(members) != 1:
-            raise ValueError('Missing or ambiguous provenance manifest')
-        if archive.getinfo(members[0]).file_size > 65536:
-            raise ValueError('Unexpected provenance document size')
-        return json.loads(archive.read(members[0]))
-
-
-def main():
-    sha, digest, run_id = os.environ['TESTED_SHA'], os.environ['TESTED_DIGEST'], os.environ['BUILD_RUN_ID']
-    validate_input(sha, digest, run_id)
-    current = api('/actions/runs/' + os.environ['GITHUB_RUN_ID'])
-    if current.get('event') != 'workflow_dispatch' or current.get('head_branch') != 'next':
-        raise ValueError('Approval must be manually dispatched on protected next')
-    actor = current.get('trigger_actor') or current.get('actor') or {}
-    if actor.get('login') != 'deytenit':
-        raise ValueError('Only the repository owner may approve promotion')
-    if not api('/branches/next').get('protected'):
-        raise ValueError('The next branch must be protected before promotion')
-    validate_run(api('/actions/runs/' + run_id), sha)
-    validate_manifest(artifact_manifest(run_id), sha, digest, run_id)
-    if os.environ.get('RELEASE_RUN_ID'):
-        release_id = os.environ['RELEASE_RUN_ID']
-        if not re.fullmatch(r'[1-9][0-9]*', release_id):
-            raise ValueError('Numeric release run ID required')
-        release = api('/actions/runs/' + release_id)
-        actor = release.get('trigger_actor') or release.get('actor') or {}
-        if release.get('conclusion') != 'success' or release.get('status') != 'completed' or release.get('event') != 'workflow_dispatch' or release.get('head_branch') != 'next' or release.get('path') != 'services-www-release-manual.yml@refs/heads/next' or actor.get('login') != 'deytenit':
-            raise ValueError('Successful independently approved release required')
-        manifest = artifact_manifest(release_id, 'www-release-provenance', 'www-release.json')
-        expected = {'sha': sha, 'digest': digest, 'run_id': run_id, 'repository': REPO, 'release_tag': os.environ['RELEASE_TAG']}
-        if manifest != expected:
-            raise ValueError('Release approval does not match requested artifact')
-    auth = base64.b64encode(('deytenit:' + os.environ['PROVENANCE_TOKEN']).encode()).decode()
-    subprocess.run(['git', '-c', 'http.https://git.ermnvldmr.com/.extraheader=AUTHORIZATION: basic ' + auth, 'fetch', 'origin', 'next'], check=True)
-    subprocess.run(['git', 'merge-base', '--is-ancestor', sha, 'origin/next'], check=True)
-    subprocess.run(['docker', 'pull', IMAGE + '@' + digest], check=True)
-    data = json.loads(subprocess.check_output(['docker', 'image', 'inspect', IMAGE + '@' + digest], text=True))
-    validate_labels(data[0]['Config'].get('Labels') or {}, sha, run_id)
-    with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
-        stream.write('short_sha=sha-' + sha[:7] + '\n')
-
-
-if __name__ == '__main__':
-    main()

.gitea/workflows/ci-next-build-golden-image.yml

@@ -12,28 +12,7 @@ jobs:
     runs-on: apex-debian13
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Validate Shell Script Syntax
       run: bash -n ci/packer/scripts/*.sh
   build-image:
@@ -44,28 +23,7 @@ jobs:
       image_name: ${{ steps.vars.outputs.image_name }}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Calculate Image Name
       id: vars
       run: 'SHORT_SHA="$(echo ${{ github.sha }} | cut -c1-7)"
@@ -82,101 +40,9 @@ jobs:
 
         '
     - name: Build Debian K3s Golden Image
-      run: 'mkdir -p output-qemu
+      run: bash ci/scripts/build-golden-image.sh
-
-        echo "Downloading official Debian 12 cloud image..."
-
-        curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
-
-
-        echo "Expanding disk image to 10G..."
-
-        qemu-img resize base.qcow2 10G
-
-
-        echo "Connecting disk image via NBD..."
-
-        sudo modprobe nbd max_part=8
-
-        sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
-
-        sleep 1
-
-        sudo partx -u /dev/nbd0 || true
-
-
-        echo "Mounting disk filesystem..."
-
-        sudo mkdir -p /mnt/target
-
-        sudo mount /dev/nbd0p1 /mnt/target
-
-
-        echo "Mounting host virtual filesystems and configuring DNS..."
-
-        sudo rm -f /mnt/target/etc/resolv.conf
-
-        echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
-
-        echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
-
-        sudo mount --bind /dev /mnt/target/dev
-
-        sudo mount --bind /dev/pts /mnt/target/dev/pts
-
-        sudo mount --bind /proc /mnt/target/proc
-
-        sudo mount --bind /sys /mnt/target/sys
-
-
-        echo "Copying provisioner scripts..."
-
-        sudo mkdir -p /mnt/target/tmp/scripts
-
-        sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
-
-        sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/
-
-        sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml
-
-        sudo chmod +x /mnt/target/tmp/scripts/*.sh
-
-
-        echo "Running provisioner scripts in chroot..."
-
-        sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
-
-        sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
-
-        sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
-
-        sudo rm -rf /mnt/target/tmp/scripts
-
-
-        echo "Unmounting filesystems..."
-
-        sudo umount /mnt/target/sys
-
-        sudo umount /mnt/target/proc
-
-        sudo umount /mnt/target/dev/pts
-
-        sudo umount /mnt/target/dev
-
-        sudo umount /mnt/target
-
-        sudo qemu-nbd --disconnect /dev/nbd0
-
-
-        echo "Compressing and optimizing qcow2 with 2M cluster size..."
-
-        qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
-
-        echo "Golden image built successfully."
-
-        '
     - name: Prepare and Upload Image Artifact
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: golden-image
         path: output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
@@ -186,53 +52,19 @@ jobs:
     needs: build-image
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Download Image Artifact
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: golden-image
         path: output-qemu
     - name: Upload to Static S3 (/dev/images/)
+      run: bash ci/scripts/upload-golden-image.sh "${IMAGE_NAME}"
       env:
-        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID
+        AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID || secrets.COM_ERMNVLDMR_STATIC_AWS_ACCESS_KEY_ID }}
-          }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY || secrets.COM_ERMNVLDMR_STATIC_AWS_SECRET_ACCESS_KEY
+        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION || 'auto' }}
-          }}
+        S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL }}
-        AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION || secrets.COM_ERMNVLDMR_STATIC_S3_REGION
+        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET }}
-          || 'auto' }}
-        S3_ENDPOINT: ${{ secrets.STATIC_S3_ENDPOINT_URL || secrets.COM_ERMNVLDMR_STATIC_S3_ENDPOINT_URL
-          }}
-        S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET || secrets.COM_ERMNVLDMR_STATIC_S3_BUCKET
-          }}
         IMAGE_NAME: ${{ needs.build-image.outputs.image_name }}
-      run: "mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 \"output-qemu/${IMAGE_NAME}\"\
-        \nif [ -n \"${S3_BUCKET}\" ] && [ -n \"${AWS_ACCESS_KEY_ID}\" ]; then\n  ENDPOINT_FLAG=\"\
-        \"\n  [ -n \"${S3_ENDPOINT}\" ] && ENDPOINT_FLAG=\"--endpoint-url=${S3_ENDPOINT}\"\
-        \n  echo \"Cleaning up older images in dev/images/ to free bucket storage...\"\
-        \n  aws ${ENDPOINT_FLAG} s3 rm \"s3://${S3_BUCKET}/dev/images/\" --recursive\
-        \ --exclude \"*\" --include \"com-ermnvldmr-debian-12-k3s-*.qcow2\" || true\n\
-        \  aws ${ENDPOINT_FLAG} s3 cp \"output-qemu/${IMAGE_NAME}\" \"s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
-        \n  echo \"Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}\"\
-        \nelse\n  echo \"S3 storage secrets not provided; skipping remote S3 upload.\
-        \ Image artifact is preserved in GitHub Actions run artifacts.\"\nfi\n"

.gitea/workflows/packages-kits-next-required.yml

@@ -10,8 +10,7 @@ name: packages/kits - next/required
     - packages/i18n/**
     - .gitea/workflows/packages-kits-next-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-next-kits-${{ github.ref }}
   cancel-in-progress: true
@@ -25,52 +24,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -80,44 +46,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -131,25 +66,25 @@ jobs:
     - name: Build UI
       run: pnpm --filter @ermnvldmr/ui build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
         retention-days: 30
     - name: Upload UI dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -159,65 +94,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -228,65 +132,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -297,65 +170,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -366,72 +208,41 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
     - name: Build Kits Storybook
       run: pnpm --filter @ermnvldmr/kits build-storybook
     - name: Upload Storybook build
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: kits-storybook-static-${{ github.run_id }}
         path: packages/kits/storybook-static/
@@ -441,72 +252,41 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
     - name: Install Playwright browsers
       run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
     - name: Download Storybook build
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: kits-storybook-static-${{ github.run_id }}
         path: packages/kits/storybook-static/
@@ -517,65 +297,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist

.gitea/workflows/packages-kits-pr-required.yml

@@ -10,8 +10,7 @@ name: packages/kits - pr/required
     - packages/i18n/**
     - .gitea/workflows/packages-kits-pr-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-pr-kits-${{ github.head_ref }}
   cancel-in-progress: true
@@ -25,52 +24,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -80,44 +46,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -131,25 +66,25 @@ jobs:
     - name: Build UI
       run: pnpm --filter @ermnvldmr/ui build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
         retention-days: 30
     - name: Upload UI dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -159,65 +94,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -228,65 +132,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -297,65 +170,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
@@ -366,72 +208,41 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
     - name: Build Kits Storybook
       run: pnpm --filter @ermnvldmr/kits build-storybook
     - name: Upload Storybook build
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: kits-storybook-static-${{ github.run_id }}
         path: packages/kits/storybook-static/
@@ -441,72 +252,41 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist
     - name: Install Playwright browsers
       run: pnpm --filter @ermnvldmr/kits exec playwright install --with-deps chromium
     - name: Download Storybook build
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: kits-storybook-static-${{ github.run_id }}
         path: packages/kits/storybook-static/
@@ -517,65 +297,34 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download UI dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-dist-${{ github.run_id }}
         path: packages/ui/dist

.gitea/workflows/packages-ssg-next-required.yml

@@ -7,8 +7,7 @@ name: packages/ssg - next/required
     - packages/ssg/**
     - .gitea/workflows/packages-ssg-next-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-ssg-${{ github.ref_name }}
   cancel-in-progress: true
@@ -22,52 +21,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -77,44 +43,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -122,7 +57,7 @@ jobs:
     - name: Build Rsbuild config
       run: pnpm --filter @ermnvldmr/rsbuild-config build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -132,50 +67,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -186,50 +90,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -240,50 +113,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist

.gitea/workflows/packages-ssg-pr-required.yml

@@ -7,8 +7,7 @@ name: packages/ssg - pr/required
     - packages/ssg/**
     - .gitea/workflows/packages-ssg-pr-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-pr-ssg-${{ github.head_ref }}
   cancel-in-progress: true
@@ -22,52 +21,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -77,44 +43,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -122,7 +57,7 @@ jobs:
     - name: Build Rsbuild config
       run: pnpm --filter @ermnvldmr/rsbuild-config build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -132,50 +67,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -186,50 +90,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -240,50 +113,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist

.gitea/workflows/packages-stl-next-required.yml

@@ -7,8 +7,7 @@ name: packages/stl - next/required
     - packages/stl/**
     - .gitea/workflows/packages-stl-next-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-stl-${{ github.ref_name }}
   cancel-in-progress: true
@@ -22,52 +21,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -77,44 +43,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -122,7 +57,7 @@ jobs:
     - name: Build Rsbuild config
       run: pnpm --filter @ermnvldmr/rsbuild-config build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -132,50 +67,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -186,50 +90,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -240,50 +113,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
@@ -294,50 +136,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist

.gitea/workflows/packages-stl-pr-required.yml

@@ -7,8 +7,7 @@ name: packages/stl - pr/required
     - packages/stl/**
     - .gitea/workflows/packages-stl-pr-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
   workflow_dispatch: {}
 concurrency:
   group: ci-pr-stl-${{ github.head_ref }}
@@ -23,52 +22,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -78,44 +44,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -123,7 +58,7 @@ jobs:
     - name: Build Rsbuild config
       run: pnpm --filter @ermnvldmr/rsbuild-config build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -133,50 +68,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -187,50 +91,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -241,50 +114,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
@@ -295,50 +137,19 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist

.gitea/workflows/packages-ui-next-required.yml

@@ -9,8 +9,7 @@ name: packages/ui - next/required
     - packages/i18n/**
     - .gitea/workflows/packages-ui-next-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-ui-${{ github.ref_name }}
   cancel-in-progress: true
@@ -24,52 +23,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -79,44 +45,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -128,19 +63,19 @@ jobs:
     - name: Build i18n
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -150,60 +85,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -214,60 +118,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -278,60 +151,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -342,60 +184,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -406,60 +217,29 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -474,60 +254,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist

.gitea/workflows/packages-ui-pr-required.yml

@@ -9,8 +9,7 @@ name: packages/ui - pr/required
     - packages/i18n/**
     - .gitea/workflows/packages-ui-pr-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-pr-ui-${{ github.head_ref }}
   cancel-in-progress: true
@@ -24,52 +23,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -79,44 +45,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -128,19 +63,19 @@ jobs:
     - name: Build i18n
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -150,60 +85,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -214,60 +118,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -278,60 +151,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -342,67 +184,36 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Build UI Storybook
       run: pnpm --filter @ermnvldmr/ui build-storybook
     - name: Upload Storybook build
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: ui-storybook-static-${{ github.run_id }}
         path: packages/ui/storybook-static/
@@ -412,67 +223,36 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Install Playwright browsers
       run: pnpm --filter @ermnvldmr/ui exec playwright install --with-deps chromium
     - name: Download Storybook build
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: ui-storybook-static-${{ github.run_id }}
         path: packages/ui/storybook-static/
@@ -483,60 +263,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist

.gitea/workflows/services-static-next-required.yml

@@ -11,8 +11,7 @@ name: services/static - next/required
     - .gitea/workflows/services-static-next-required.yml
     - ci/scripts/**
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-static-${{ github.ref_name }}
   cancel-in-progress: true
@@ -26,52 +25,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -81,44 +47,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -128,13 +63,13 @@ jobs:
     - name: Build i18n
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -144,55 +79,24 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -203,55 +107,24 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -262,62 +135,31 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Build static service
       run: pnpm --filter @ermnvldmr/static build
     - name: Upload build artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: static-dist
         path: services/static/dist/
@@ -332,30 +174,9 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/next'
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Download build artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: static-dist
         path: services/static/dist/

.gitea/workflows/services-static-pr-required.yml

@@ -11,8 +11,7 @@ name: services/static - pr/required
     - .gitea/workflows/services-static-pr-required.yml
     - ci/scripts/**
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-pr-static-${{ github.head_ref }}
   cancel-in-progress: true
@@ -26,52 +25,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -81,44 +47,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -128,13 +63,13 @@ jobs:
     - name: Build i18n
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload Config Artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -144,55 +79,24 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -203,55 +107,24 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -262,62 +135,31 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Config Artifacts
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Build static service
       run: pnpm --filter @ermnvldmr/static build
     - name: Upload build artifacts
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: static-dist-${{ github.run_id }}
         path: services/static/dist/

.gitea/workflows/services-www-deploy-manual.yml

@@ -31,37 +31,17 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
       && github.actor == 'deytenit'
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Authenticate local registry
-      run: python3 .gitea/scripts/docker.py login
+      run: python3 ci/scripts/docker.py login
       env:
         REGISTRY: git.ermnvldmr.com
         REGISTRY_USER: deytenit
         REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_READ_TOKEN }}
     - name: Verify successful build and immutable digest
       id: provenance
-      run: python3 .gitea/scripts/provenance.py
+      run: python3 ci/scripts/provenance.py
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}
         TESTED_DIGEST: ${{ inputs.tested_digest }}
@@ -91,32 +71,6 @@ jobs:
 
         '
     - name: Await production rollout
-      run: "TARGET_COMMIT=\"sha-${TESTED_SHA:0:7}\"\nENDPOINT=\"https://www.ermnvldmr.com/version.json\"\
+      run: bash ci/scripts/await-rollout.sh https://www.ermnvldmr.com/version.json "sha-${TESTED_SHA:0:7}"
-        \n\necho \"========================================================\"\necho\
-        \ \"Verifying production deployment on $ENDPOINT\"\necho \"Expected commit:\
-        \  $TARGET_COMMIT\"\necho \"========================================================\"\
-        \n\nMAX_ATTEMPTS=45\nATTEMPT=1\nCF_BLOCKED_COUNT=0\n\nwhile [ $ATTEMPT -le\
-        \ $MAX_ATTEMPTS ]; do\n  echo \"Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT...\"\
-        \n\n  RESP_FILE=$(mktemp)\n  HTTP_CODE=$(curl -sL --max-time 10 \\\n    -H\
-        \ \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\
-        \ (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" \\\n    -H \"Accept:\
-        \ application/json\" \\\n    -o \"$RESP_FILE\" \\\n    -w \"%{http_code}\"\
-        \ \\\n    \"$ENDPOINT\" || echo \"000\")\n\n  if [ \"$HTTP_CODE\" = \"200\"\
-        \ ]; then\n    LIVE_COMMIT=$(jq -r '.commit // empty' \"$RESP_FILE\" 2>/dev/null\
-        \ || true)\n    echo \"  Live commit:  ${LIVE_COMMIT:-<none>}\"\n\n    if\
-        \ [ \"$LIVE_COMMIT\" = \"$TARGET_COMMIT\" ]; then\n      echo \"\u2705 Success!\
-        \ Production has successfully rolled out $TARGET_COMMIT.\"\n      rm -f \"\
-        $RESP_FILE\"\n      exit 0\n    fi\n  elif [ \"$HTTP_CODE\" = \"403\" ] ||\
-        \ [ \"$HTTP_CODE\" = \"503\" ]; then\n    echo \"  HTTP $HTTP_CODE: Cloudflare\
-        \ WAF/challenge encountered from runner IP.\"\n    CF_BLOCKED_COUNT=$((CF_BLOCKED_COUNT\
-        \ + 1))\n  else\n    echo \"  HTTP $HTTP_CODE: Endpoint returned unexpected\
-        \ status code or timed out.\"\n  fi\n\n  rm -f \"$RESP_FILE\"\n\n  if [ $CF_BLOCKED_COUNT\
-        \ -ge 5 ]; then\n    echo \"\u26A0\uFE0F Cloudflare WAF consistently blocked\
-        \ external probe requests from this runner IP (HTTP $HTTP_CODE).\"\n    echo\
-        \ \"The GitOps release commit was already pushed to the repository; FluxCD\
-        \ will reconcile the cluster.\"\n    echo \"Skipping further external HTTP\
-        \ verification to avoid false negative.\"\n    exit 0\n  fi\n\n  ATTEMPT=$((ATTEMPT\
-        \ + 1))\n  sleep 10\ndone\n\necho \"\u274C Deployment verification timed out\
-        \ after 7.5 minutes.\"\nexit 1\n"
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}

.gitea/workflows/services-www-next-required.yml

@@ -13,8 +13,7 @@ name: services/www - next/required
     - ci/config/nginx/**
     - ci/scripts/**
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
   workflow_dispatch: null
 concurrency:
   group: ci-www-${{ github.ref_name }}
@@ -29,52 +28,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -84,44 +50,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -131,13 +66,13 @@ jobs:
     - name: Build Storybook config
       run: pnpm --filter @ermnvldmr/storybook-config build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
@@ -145,7 +80,7 @@ jobs:
     - name: Build i18n package
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
@@ -155,60 +90,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
@@ -219,60 +123,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
@@ -283,67 +156,36 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Build WWW Storybook
       run: pnpm --filter @ermnvldmr/www build-storybook
     - name: Upload Storybook build
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-static
         path: services/www/storybook-static/
@@ -353,60 +195,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
@@ -417,67 +228,36 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
     - name: Install Playwright browsers
       run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
     - name: Download Storybook build
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-static
         path: services/www/storybook-static/
@@ -488,60 +268,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist
         path: packages/storybook-config/dist
@@ -550,7 +299,7 @@ jobs:
       env:
         RSDOCTOR: 'true'
     - name: Upload Rsdoctor report
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsdoctor-report
         path: services/www/rsdoctor/
@@ -571,28 +320,7 @@ jobs:
       short_sha: ${{ steps.vars.outputs.short_sha }}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Calculate Short SHA
       id: vars
       run: 'SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
@@ -601,7 +329,7 @@ jobs:
 
         '
     - name: Log in to GitHub Container Registry
-      run: python3 .gitea/scripts/docker.py login
+      run: python3 ci/scripts/docker.py login
       env:
         REGISTRY: git.ermnvldmr.com
         REGISTRY_USER: ${{ github.repository_owner }}
@@ -613,7 +341,7 @@ jobs:
 
         docker buildx inspect --bootstrap'
     - name: Build and push Docker image
-      run: python3 .gitea/scripts/docker.py build
+      run: python3 ci/scripts/docker.py build
       env:
         TAGS: git.ermnvldmr.com/${{ github.repository }}/www:${{ steps.vars.outputs.short_sha
           }}
@@ -646,7 +374,7 @@ jobs:
         ''repository'': os.environ[''GITHUB_REPOSITORY'']}))
 
         PROVENANCE'
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: www-provenance
         path: .ci/www-provenance.json

.gitea/workflows/services-www-pr-required.yml

@@ -10,8 +10,7 @@ name: services/www - pr/required
     - packages/i18n/**
     - .gitea/workflows/services-www-pr-required.yml
     - pnpm-lock.yaml
-    - .gitea/scripts/**
+    - ci/scripts/**
-    - .gitea/actions/**
 concurrency:
   group: ci-pr-www-${{ github.head_ref }}
   cancel-in-progress: true
@@ -25,52 +24,19 @@ jobs:
     outputs: {}
     steps:
     - name: Checkout repository
-      run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+      uses: actions/checkout@v4
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+    - name: Setup environment
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - name: Setup Node.js with pnpm cache
-      run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Pack dependency cache
-      run: python3 .gitea/scripts/cache.py pack
+      run: python3 ci/scripts/cache.py pack
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: ${{ steps.dependency-cache.outputs.key }}
         path: .ci/pnpm-store.tar
@@ -80,44 +46,13 @@ jobs:
     needs: setup-stage
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
@@ -127,13 +62,13 @@ jobs:
     - name: Build Storybook config
       run: pnpm --filter @ermnvldmr/storybook-config build
     - name: Upload Rsbuild Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
         retention-days: 30
     - name: Upload Storybook Config
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
@@ -141,7 +76,7 @@ jobs:
     - name: Build i18n package
       run: pnpm --filter @ermnvldmr/i18n build
     - name: Upload i18n dist
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
@@ -151,60 +86,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
@@ -215,60 +119,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
@@ -279,67 +152,36 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Build WWW Storybook
       run: pnpm --filter @ermnvldmr/www build-storybook
     - name: Upload Storybook build
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: www-storybook-static-${{ github.run_id }}
         path: services/www/storybook-static/
@@ -349,60 +191,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
@@ -413,67 +224,36 @@ jobs:
     needs: build-storybook
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
     - name: Install Playwright browsers
       run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
     - name: Download Storybook build
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: www-storybook-static-${{ github.run_id }}
         path: services/www/storybook-static/
@@ -484,60 +264,29 @@ jobs:
     needs: build-configs
     runs-on: apex-debian13
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
+    - name: Setup environment
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
+      run: bash ci/scripts/setup-env.sh 9.12.3 20
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
-    - name: Install pnpm
-      run: 'case "$PNPM_VERSION" in 8|9|9.12.3) ;; *) exit 1;; esac
-
-        test -x "/opt/ci/pnpm/$PNPM_VERSION/bin/pnpm"
-
-        echo "/opt/ci/pnpm/$PNPM_VERSION/bin" >> "$GITHUB_PATH"'
-      env:
-        PNPM_VERSION: 9.12.3
-    - run: "case \"$NODE_VERSION\" in\n  18*) major=18;; 20*) major=20;; 22*) major=22;;\
-        \ *) exit 1;;\nesac\ntest -x \"/opt/ci/node/$major/bin/node\"\necho \"/opt/ci/node/$major/bin\"\
-        \ >> \"$GITHUB_PATH\""
-      env:
-        NODE_VERSION: '20'
     - name: Restore repository dependency cache
       id: dependency-cache
-      run: python3 .gitea/scripts/cache.py restore
+      run: python3 ci/scripts/cache.py restore
       env:
         CACHE_TOKEN: ${{ github.token }}
     - name: Install dependencies
       run: pnpm install --frozen-lockfile
     - name: Download Rsbuild Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: rsbuild-config-dist-${{ github.run_id }}
         path: packages/rsbuild-config/dist
     - name: Download i18n dist
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: i18n-dist-${{ github.run_id }}
         path: packages/i18n/dist
     - name: Download Storybook Config
-      uses: ./.gitea/actions/download-artifact
+      uses: actions/download-artifact@v4
       with:
         name: storybook-config-dist-${{ github.run_id }}
         path: packages/storybook-config/dist
@@ -546,7 +295,7 @@ jobs:
       env:
         RSDOCTOR: 'true'
     - name: Upload Rsdoctor report
-      uses: ./.gitea/actions/upload-artifact
+      uses: actions/upload-artifact@v4
       with:
         name: rsdoctor-report-${{ github.run_id }}
         path: services/www/rsdoctor/

.gitea/workflows/services-www-release-manual.yml

@@ -23,37 +23,17 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/next'
       && github.actor == 'deytenit'
     steps:
-    - run: "set -euo pipefail\ncase \"$CHECKOUT_REF\" in -*) exit 1;; esac\nGITHUB_SERVER_URL=${GITHUB_SERVER_URL%/}\n\
+    - name: Checkout repository
-        case \"$GITHUB_SERVER_URL\" in https://git.ermnvldmr.com) ;; *) exit 1;; esac\n\
+      uses: actions/checkout@v4
-        AUTH=$(printf 'deytenit:%s' \"$CHECKOUT_TOKEN\" | base64 -w0)\nHEADER=\"http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION:\
-        \ basic $AUTH\"\ngit init \"$GITHUB_WORKSPACE\"\ncd \"$GITHUB_WORKSPACE\"\n\
-        git remote add origin \"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git\"\ngit -c\
-        \ \"$HEADER\" fetch --tags origin '+refs/heads/*:refs/remotes/origin/*'\n\
-        git -c \"$HEADER\" fetch origin \"$CHECKOUT_REF\"\ngit checkout --detach FETCH_HEAD\n\
-        test \"$(git rev-parse HEAD)\" = \"$GITHUB_SHA\"\nif [ \"$CHECKOUT_SUBMODULES\"\
-        \ = recursive ]; then\n    key_file=$(mktemp \"${RUNNER_TEMP:-/tmp}/hextra-key.XXXXXX\"\
-        )\n    trap 'rm -f \"$key_file\"' EXIT\n    umask 077\n    printf '%s\\n'\
-        \ \"$HEXTRA_READ_KEY\" > \"$key_file\"\n    chmod 600 \"$key_file\"\n    export\
-        \ GIT_SSH_COMMAND=\"ssh -T -i $key_file -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes\
-        \ -o HostKeyAlgorithms=ssh-ed25519 -o UserKnownHostsFile=$GITHUB_WORKSPACE/.gitea/known_hosts\"\
-        \n    git submodule update --init --recursive\nfi\nif [ \"$PERSIST_CREDENTIALS\"\
-        \ = true ]; then\n    git config \"http.${GITHUB_SERVER_URL}/.extraheader\"\
-        \ \"AUTHORIZATION: basic $AUTH\"\nfi\n"
-      env:
-        CHECKOUT_REF: ${{ github.sha }}
-        CHECKOUT_SUBMODULES: 'false'
-        CHECKOUT_TOKEN: ${{ github.token }}
-        PERSIST_CREDENTIALS: 'false'
-        HEXTRA_READ_KEY: ''
     - name: Authenticate local registry
-      run: python3 .gitea/scripts/docker.py login
+      run: python3 ci/scripts/docker.py login
       env:
         REGISTRY: git.ermnvldmr.com
         REGISTRY_USER: deytenit
         REGISTRY_TOKEN: ${{ secrets.RELEASE_REGISTRY_TOKEN }}
     - name: Verify successful build and immutable digest
       id: provenance
-      run: python3 .gitea/scripts/provenance.py
+      run: python3 ci/scripts/provenance.py
       env:
         TESTED_SHA: ${{ inputs.tested_sha }}
         TESTED_DIGEST: ${{ inputs.tested_digest }}
@@ -82,7 +62,7 @@ jobs:
 
         git tag "$VERSION" "$TESTED_SHA"
 
-        python3 .gitea/scripts/git_write.py "refs/tags/$VERSION"
+        python3 ci/scripts/git_write.py "refs/tags/$VERSION"
 
         export VERSION
 
@@ -101,7 +81,7 @@ jobs:
         RELEASE_PROVENANCE
 
         '
-    - uses: ./.gitea/actions/upload-artifact
+    - uses: actions/upload-artifact@v4
       with:
         name: www-release-provenance
         path: .ci/www-release.json

ci/scripts/build-golden-image.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mkdir -p output-qemu
+
+echo "Downloading official Debian 12 cloud image..."
+curl -fsSL -o base.qcow2 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
+
+echo "Expanding disk image to 10G..."
+qemu-img resize base.qcow2 10G
+
+echo "Connecting disk image via NBD..."
+sudo modprobe nbd max_part=8
+sudo qemu-nbd --connect=/dev/nbd0 base.qcow2
+sleep 1
+sudo partx -u /dev/nbd0 || true
+
+echo "Mounting disk filesystem..."
+sudo mkdir -p /mnt/target
+sudo mount /dev/nbd0p1 /mnt/target
+
+echo "Mounting host virtual filesystems and configuring DNS..."
+sudo rm -f /mnt/target/etc/resolv.conf
+echo "nameserver 1.1.1.1" | sudo tee /mnt/target/etc/resolv.conf
+echo "nameserver 8.8.8.8" | sudo tee -a /mnt/target/etc/resolv.conf
+sudo mount --bind /dev /mnt/target/dev
+sudo mount --bind /dev/pts /mnt/target/dev/pts
+sudo mount --bind /proc /mnt/target/proc
+sudo mount --bind /sys /mnt/target/sys
+
+echo "Copying provisioner scripts..."
+sudo mkdir -p /mnt/target/tmp/scripts
+sudo cp ci/packer/scripts/*.sh /mnt/target/tmp/scripts/
+sudo cp /opt/ci/assets/k3s /opt/ci/assets/k3s-install.sh /mnt/target/tmp/scripts/
+sudo cp /opt/ci/assets/flux-install-local.yaml /mnt/target/tmp/scripts/flux-install.yaml
+sudo chmod +x /mnt/target/tmp/scripts/*.sh
+
+echo "Running provisioner scripts in chroot..."
+sudo chroot /mnt/target /bin/bash /tmp/scripts/01-base-system.sh
+sudo chroot /mnt/target /bin/bash /tmp/scripts/02-install-k3s.sh
+sudo chroot /mnt/target /bin/bash /tmp/scripts/03-cleanup.sh
+sudo rm -rf /mnt/target/tmp/scripts
+
+echo "Unmounting filesystems..."
+sudo umount /mnt/target/sys
+sudo umount /mnt/target/proc
+sudo umount /mnt/target/dev/pts
+sudo umount /mnt/target/dev
+sudo umount /mnt/target
+sudo qemu-nbd --disconnect /dev/nbd0
+
+echo "Compressing and optimizing qcow2 with 2M cluster size..."
+qemu-img convert -f qcow2 -O qcow2 -o cluster_size=2M -c base.qcow2 output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2
+echo "Golden image built successfully."

ci/scripts/deploy-gitops.sh

@@ -38,10 +38,6 @@ if git diff --staged --quiet; then
     echo "No manifest changes to commit for $SERVICE."
 else
     git commit -m "chore(release): deploy ${SERVICE} ${TAG} [skip ci]"
-    if [ -f "$ROOT_DIR/ci/scripts/git_write.py" ]; then
     python3 "$ROOT_DIR/ci/scripts/git_write.py" HEAD:next
-    else
-        python3 "$ROOT_DIR/.gitea/scripts/git_write.py" HEAD:next
-    fi
     echo "Successfully deployed $SERVICE ($TAG) via GitOps."
 fi

ci/scripts/upload-golden-image.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME="${1:-com-ermnvldmr-debian-12-k3s-amd64.qcow2}"
+mv output-qemu/com-ermnvldmr-debian-12-k3s-amd64.qcow2 "output-qemu/${IMAGE_NAME}"
+
+if [ -n "${S3_BUCKET:-}" ] && [ -n "${AWS_ACCESS_KEY_ID:-}" ]; then
+  ENDPOINT_FLAG=""
+  [ -n "${S3_ENDPOINT:-}" ] && ENDPOINT_FLAG="--endpoint-url=${S3_ENDPOINT}"
+  echo "Cleaning up older images in dev/images/ to free bucket storage..."
+  aws ${ENDPOINT_FLAG} s3 rm "s3://${S3_BUCKET}/dev/images/" --recursive --exclude "*" --include "com-ermnvldmr-debian-12-k3s-*.qcow2" || true
+  aws ${ENDPOINT_FLAG} s3 cp "output-qemu/${IMAGE_NAME}" "s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
+  echo "Golden image uploaded to s3://${S3_BUCKET}/dev/images/${IMAGE_NAME}"
+else
+  echo "S3 storage secrets not provided; skipping remote S3 upload. Image artifact is preserved in workflow run artifacts."
+fi