ci: migrate workflows to Gitea Actions

ci/container.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
-# Build and smoke-test the same image that is optionally published to GHCR.
+# Build and smoke-test the same image that is optionally published to Gitea.
+# Gitea Actions supplies the GitHub-compatible GITHUB_* runner variables.
 set -eu
 
 fail() {
@@ -19,17 +20,22 @@ esac
 : "${GITHUB_JOB:?GITHUB_JOB is required}"
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
+: "${REGISTRY_HOST:?REGISTRY_HOST is required (hostname, optionally with port)}"
 printf '%s\n' "$GITHUB_SHA" | grep -Eq '^[0-9a-f]{40}$' || fail 'Expected a full Git commit SHA'
 for run_identifier in "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT"; do
     case "$run_identifier" in
-        ''|*[!0-9]*) fail 'GitHub run ID and attempt must be numeric' ;;
+        ''|*[!0-9]*) fail 'Actions run ID and attempt must be numeric' ;;
     esac
 done
 case "$GITHUB_JOB" in
     ''|[!A-Za-z_]*|*[!A-Za-z0-9_-]*) fail 'GITHUB_JOB must be a safe job identifier' ;;
 esac
 printf '%s\n' "$GITHUB_REPOSITORY" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9_][A-Za-z0-9_.-]*$' || fail 'Expected GITHUB_REPOSITORY in owner/repository form'
-registry_image="ghcr.io/$(printf '%s' "$GITHUB_REPOSITORY" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
+case "$REGISTRY_HOST" in
+    ''|*[!a-z0-9.:-]*) fail 'REGISTRY_HOST must be a lowercase hostname, optionally with port' ;;
+esac
+printf '%s\n' "$REGISTRY_HOST" | grep -Eq '^[a-z0-9][a-z0-9.-]*(:[0-9]+)?$' || fail 'Invalid REGISTRY_HOST'
+registry_image="$REGISTRY_HOST/$(printf '%s' "$GITHUB_REPOSITORY" | LC_ALL=C tr '[:upper:]' '[:lower:]')"
 project_url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}"
 job_identifier="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${GITHUB_JOB}"
 
@@ -50,7 +56,7 @@ project_version=$(awk '
 
 publish_tag=
 if [ "$mode" = publish ]; then
-    [ "${GITHUB_REF_PROTECTED:-}" = true ] || fail 'Publication requires a protected branch or tag'
+    [ "$(sh ci/publish-policy.sh)" = true ] || fail 'Publication requires PUBLISH_IMAGES=true and a default-branch or release-tag push/manual run'
     case "${GITHUB_EVENT_NAME:-}" in
         push|workflow_dispatch) ;;
         *) fail 'Publication is allowed only from push or workflow_dispatch events' ;;
@@ -67,8 +73,8 @@ if [ "$mode" = publish ]; then
             ;;
         *) fail 'Publication requires a branch or tag ref' ;;
     esac
-    : "${GITHUB_ACTOR:?GITHUB_ACTOR is required for publication}"
-    : "${GHCR_TOKEN:?GHCR_TOKEN is required for publication}"
+    : "${REGISTRY_USERNAME:?REGISTRY_USERNAME must be the package token owner}"
+    : "${REGISTRY_TOKEN:?REGISTRY_TOKEN requires write:package permission}"
 fi
 
 BUILD_IMAGE="${registry_image}:ci-${job_identifier}"
@@ -119,8 +125,8 @@ if [ "$mode" = publish ]; then
     docker_config_dir=$(mktemp -d "${TMPDIR:-/tmp}/ais-ci-docker.XXXXXXXX")
     DOCKER_CONFIG=$docker_config_dir
     export DOCKER_CONFIG
-    printf '%s' "$GHCR_TOKEN" | docker login ghcr.io \
-        --username "$GITHUB_ACTOR" --password-stdin
+    printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" \
+        --username "$REGISTRY_USERNAME" --password-stdin
 
     commit_image="${registry_image}:sha-${GITHUB_SHA}"
     channel_image="${registry_image}:${publish_tag}"

ci/publish-policy.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Gitea 1.27 does not populate ref_protected. Repository administrators opt in
+# after configuring branch/tag protection and package credentials in Gitea.
+set -eu
+
+publish=false
+if [ "${PUBLISH_IMAGES:-}" = true ]; then
+    case "${GITHUB_EVENT_NAME:-}" in
+        push|workflow_dispatch)
+            case "${GITHUB_REF_TYPE:-}" in
+                branch)
+                    if [ -n "${DEFAULT_BRANCH:-}" ] && [ "${GITHUB_REF_NAME:-}" = "$DEFAULT_BRANCH" ]; then
+                        publish=true
+                    fi
+                    ;;
+                tag)
+                    case "${GITHUB_REF_NAME:-}" in
+                        ''|*[!v0-9.]*) ;;
+                        *)
+                            if printf '%s\n' "$GITHUB_REF_NAME" | grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'; then
+                                publish=true
+                            fi
+                            ;;
+                    esac
+                    ;;
+            esac
+            ;;
+    esac
+fi
+printf '%s\n' "$publish"

ci/python-tests.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
 # Run tests in an isolated, disposable environment on a Linux Actions runner.
+# Gitea Actions supplies the GitHub-compatible GITHUB_* runner variables.
 set -eu
 
 fail() {
@@ -13,7 +14,7 @@ fail() {
 : "${GITHUB_JOB:?GITHUB_JOB is required}"
 for run_identifier in "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT"; do
     case "$run_identifier" in
-        ''|*[!0-9]*) fail 'GitHub run ID and attempt must be numeric' ;;
+        ''|*[!0-9]*) fail 'Actions run ID and attempt must be numeric' ;;
     esac
 done
 case "$GITHUB_JOB" in