ci: replace Node-based actions with manual git clone and Debian container

.forgejo/workflows/ci.yml

@@ -6,58 +6,90 @@ on:
   workflow_dispatch:
 
 jobs:
-  lint-and-test:
+  ci:
-    name: Lint and test (py${{ matrix.python }})
+    name: Lint, test, and build
-    # Adjust this label to match your Forgejo runner
+    # This label must match your Forgejo runner's label
     runs-on: docker
-    container:
+    # Use a clean Debian container so tools are predictable
-      image: python:${{ matrix.python }}-bookworm
+    container: debian:stable-slim
-    strategy:
+    env:
-      fail-fast: false
+      PYTHONDONTWRITEBYTECODE: "1"
-      matrix:
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
-        python: ["3.10", "3.11", "3.12"]
+      UV_SYSTEM_PYTHON: "1"
     steps:
-      - name: Checkout
+      - name: Install build tooling
-        uses: actions/checkout@v4
-
-      - name: Set up Python (inside container)
         run: |
+          set -euo pipefail
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            git ca-certificates python3 python3-venv python3-pip python3-setuptools \
+            python3-wheel sqlite3
+          update-ca-certificates || true
+
+      - name: Checkout repository (manual)
+        run: |
+          set -euo pipefail
+          if [ -f Makefile ] || [ -d .git ]; then
+            echo "Repository present in workspace; skipping clone"
+            exit 0
+          fi
+          REMOTE_URL="${CI_REPOSITORY_URL:-}"
+          if [ -z "$REMOTE_URL" ]; then
+            if [ -n "${GITHUB_SERVER_URL:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
+              REMOTE_URL="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+            elif [ -n "${GITHUB_REPOSITORY:-}" ]; then
+              REMOTE_URL="https://git.jordanwages.com/${GITHUB_REPOSITORY}.git"
+            else
+              echo "Unable to determine repository URL from CI environment" >&2
+              exit 1
+            fi
+          fi
+          AUTH_URL="$REMOTE_URL"
+          if [ -n "${GITHUB_TOKEN:-}" ]; then
+            ACTOR="${GITHUB_ACTOR:-oauth2}"
+            AUTH_URL=$(printf '%s' "$REMOTE_URL" | sed -E "s#^https://#https://${ACTOR}:${GITHUB_TOKEN}@#")
+          fi
+          echo "Cloning from: $REMOTE_URL"
+          if ! git clone --depth 1 "$AUTH_URL" .; then
+            echo "Auth clone failed; trying anonymous clone..." >&2
+            git clone --depth 1 "$REMOTE_URL" .
+          fi
+          if [ -n "${GITHUB_SHA:-}" ]; then
+            git fetch --depth 1 origin "$GITHUB_SHA" || true
+            git checkout -q "$GITHUB_SHA" || true
+          elif [ -n "${GITHUB_REF_NAME:-}" ]; then
+            git fetch --depth 1 origin "$GITHUB_REF_NAME" || true
+            git checkout -q "$GITHUB_REF_NAME" || true
+          fi
+
+      - name: Set up venv and install deps
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          . .venv/bin/activate
           python -m pip install --upgrade pip
-          pip --version
-
-      - name: Install dependencies
-        run: |
           pip install -r requirements.txt
           pip install pytest
 
       - name: Format check (black)
-        run: black --check .
+        run: |
+          . .venv/bin/activate
+          black --check .
 
       - name: Lint (flake8)
-        run: flake8 .
+        run: |
+          . .venv/bin/activate
+          flake8 .
 
       - name: Run tests (pytest)
-        env:
-          PYTHONDONTWRITEBYTECODE: "1"
-        run: pytest -q
-
-  build-reports:
-    name: Build sample reports artifact
-    needs: lint-and-test
-    runs-on: docker
-    container:
-      image: python:3.11-bookworm
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
+          . .venv/bin/activate
-          pip install -r requirements.txt
+          pytest -q
 
-      - name: Seed minimal DB and generate reports
+      - name: Build sample reports (no artifact upload)
         run: |
+          set -euo pipefail
+          . .venv/bin/activate
           python - <<'PY'
           import sqlite3, pathlib
           db = pathlib.Path('database/ngxstat.db')
@@ -83,10 +115,5 @@ jobs:
           python scripts/generate_reports.py global
           python scripts/generate_reports.py hourly
           python scripts/generate_reports.py index
-
+          tar -czf ngxstat-reports.tar.gz -C output .
-      - name: Upload reports artifact
+          echo "Built sample reports archive: ngxstat-reports.tar.gz"
-        uses: actions/upload-artifact@v4
-        with:
-          name: ngxstat-reports
-          path: output/
-