Migrate CI/CD from GitHub Actions to Forgejo Actions

- Move workflows from .github/ to .forgejo/ so they only run on Forgejo
- Replace styfle/cancel-workflow-action with native concurrency block
- Use full GitHub URLs for all third-party actions to bypass mirror
- Switch Docker layer cache from type=gha to type=registry
- Drop label-subissues workflow (relies on GitHub-specific GraphQL API)
- Add timeout-minutes to all jobs; cancel-in-progress only for non-main branches

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -5,21 +5,18 @@ on:
             - main
     pull_request: {}
 
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 permissions:
-    actions: write
     contents: read
 
 jobs:
-    cancel:
-        name: 🛑 Cancel Previous Runs
-        runs-on: ubuntu-latest
-        steps:
-            - uses: styfle/cancel-workflow-action@0.12.1
-
     test:
         name: 🧪 Test
-        needs: [cancel]
         runs-on: ubuntu-latest
+        timeout-minutes: 20
 
         services:
             postgres:
@@ -38,10 +35,10 @@ jobs:
 
         steps:
             - name: ⬇️ Checkout repo
-              uses: actions/checkout@v4
+              uses: https://github.com/actions/checkout@v4
 
             - name: ⎔ Setup node
-              uses: actions/setup-node@v4
+              uses: https://github.com/actions/setup-node@v4
               with:
                   node-version-file: '.nvmrc'
                   cache: 'npm'
@@ -57,14 +54,14 @@ jobs:
 
     typecheck:
         name: ʦ TypeScript
-        needs: [cancel]
         runs-on: ubuntu-latest
+        timeout-minutes: 10
         steps:
             - name: ⬇️ Checkout repo
-              uses: actions/checkout@v4
+              uses: https://github.com/actions/checkout@v4
 
             - name: ⎔ Setup node
-              uses: actions/setup-node@v4
+              uses: https://github.com/actions/setup-node@v4
               with:
                   node-version-file: '.nvmrc'
                   cache: 'npm'
@@ -77,14 +74,14 @@ jobs:
 
     lint:
         name: 🔍 Lint
-        needs: [cancel]
         runs-on: ubuntu-latest
+        timeout-minutes: 10
         steps:
             - name: ⬇️ Checkout repo
-              uses: actions/checkout@v4
+              uses: https://github.com/actions/checkout@v4
 
             - name: ⎔ Setup node
-              uses: actions/setup-node@v4
+              uses: https://github.com/actions/setup-node@v4
               with:
                   node-version-file: '.nvmrc'
                   cache: 'npm'
@@ -98,42 +95,42 @@ jobs:
     build:
         name: 🐳 Build
         needs: [test, typecheck, lint]
-        # only build/deploy main branch on pushes
         if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
         runs-on: ubuntu-latest
+        timeout-minutes: 30
         steps:
             - name: ⬇️ Checkout repo
-              uses: actions/checkout@v4
+              uses: https://github.com/actions/checkout@v4
 
             - name: 🐳 Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
+              uses: https://github.com/docker/setup-buildx-action@v3
 
             - name: 🔓 Login to Container Registry
-              uses: docker/login-action@v3
+              uses: https://github.com/docker/login-action@v3
               with:
                   registry: ${{ vars.CONTAINER_REGISTRY }}
                   username: ${{ secrets.REGISTRY_USERNAME }}
                   password: ${{ secrets.REGISTRY_PASSWORD }}
 
             - name: 🗄️ Build and Push to Container Registry
-              uses: docker/build-push-action@v5
+              uses: https://github.com/docker/build-push-action@v5
               with:
                   context: .
                   push: true
                   tags: ${{ vars.CONTAINER_REGISTRY }}/brackt:latest
-                  cache-from: type=gha
-                  cache-to: type=gha,mode=max
+                  cache-from: type=registry,ref=${{ vars.CONTAINER_REGISTRY }}/brackt:buildcache
+                  cache-to: type=registry,ref=${{ vars.CONTAINER_REGISTRY }}/brackt:buildcache,mode=max
 
     deploy:
         name: 🚀 Deploy
         runs-on: ubuntu-latest
+        timeout-minutes: 10
         needs: [build]
-        # only deploy main branch on pushes
         if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
 
         steps:
             - name: 🚀 Deploy app to server
-              uses: appleboy/ssh-action@v1.0.3
+              uses: https://github.com/appleboy/ssh-action@v1.0.3
               env:
                   REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
                   REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}

.github/workflows/label-subissues.yaml

@@ -1,35 +0,0 @@
-name: Label Subissues
-on:
-  issues:
-    types: [opened, edited]
-
-jobs:
-  apply-label:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: Check for Parent and Label
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ISSUE_NODE_ID: ${{ github.event.issue.node_id }}
-        run: |
-          # Use GraphQL to check if this issue has a parent
-          PARENT_ID=$(gh api graphql -f query='
-            query($id: ID!) {
-              node(id: $id) {
-                ... on Issue {
-                  parent {
-                    id
-                  }
-                }
-              }
-            }' -f id=$ISSUE_NODE_ID --jq '.data.node.parent.id')
-
-          # If PARENT_ID is not null, it is a subissue
-          if [ "$PARENT_ID" != "null" ] && [ -n "$PARENT_ID" ]; then
-            echo "Subissue detected. Applying label..."
-            gh issue edit ${{ github.event.issue.number }} --add-label "subissue"
-          else
-            echo "This is a top-level issue."
-          fi