ci: migrate GitHub actions to Gitea actions

.gitea/workflows/ai-orchestrator-deploy.yml

@@ -0,0 +1,23 @@
+name: Deploy to VPS
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'shared/AI-Orchestrator/**'
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to VPS via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: 217.160.174.2
+          username: root
+          key: ${{ secrets.VPS_SSH_KEY }}
+          script: |
+            cd /opt/AI-Orchestrator
+            git pull origin main
+            docker compose up -d --build
+            echo "Deploy complete"

.gitea/workflows/ai-orchestrator-pat-check.yml

@@ -0,0 +1,32 @@
+name: PAT Lifecycle Check
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Every Monday at 06:00 UTC
+  workflow_dispatch: {}
+
+jobs:
+  check-pats:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install dependencies
+        run: pip install -r scripts/pat_manager/requirements.txt
+      - name: Run PAT Manager
+        env:
+          GITLAB_PAT: ${{ secrets.GITLAB_PAT }}
+          GITLAB_URL: https://gitlab.com
+          JIRA_PAT: ${{ secrets.JIRA_PAT }}
+          JIRA_URL: https://jira.atlassian.net
+          CONFLUENCE_PAT: ${{ secrets.CONFLUENCE_PAT }}
+          CONFLUENCE_URL: https://confluence.atlassian.net
+          ORGMYLIFE_API_KEY: ${{ secrets.ORGMYLIFE_API_SECRET }}
+          ORGMYLIFE_URL: https://orgmylife.app
+          ORGMYLIFE_USER: ${{ secrets.ORGMYLIFE_USER }}
+          ORGMYLIFE_PASS: ${{ secrets.ORGMYLIFE_PASS }}
+          GH_TOKEN: ${{ secrets.PAT_MANAGER_TOKEN }}
+          ALERT_CHANNEL: orgmylife
+        run: python -m scripts.pat_manager

.gitea/workflows/ai-orchestrator-sync-to-orgmylife.yml

@@ -0,0 +1,38 @@
+name: Sync Tasks to OrgMyLife
+
+on:
+  push:
+    paths: ['PLAN.md', 'TASKS.md', 'SETUP_TODO.md']
+  workflow_dispatch: {}
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse open tasks and sync to OrgMyLife
+        run: |
+          REPO_NAME="AI-Orchestrator"
+          
+          TASKS="[]"
+          for file in SETUP_TODO.md PLAN.md TASKS.md; do
+            if [ -f "$file" ]; then
+              ITEMS=$(grep -E '^\s*- \[ \]' "$file" | sed 's/.*- \[ \] //' | head -50)
+              if [ -n "$ITEMS" ]; then
+                TASKS=$(echo "$ITEMS" | jq -R -s 'split("\n") | map(select(length > 0)) | map({"title": ., "status": "backlog"})')
+                break
+              fi
+            fi
+          done
+          
+          echo "Found tasks: $TASKS"
+          
+          PAYLOAD=$(jq -n --arg repo "$REPO_NAME" --argjson tasks "$TASKS" '{"repo": $repo, "tasks": $tasks}')
+          
+          curl -s -X POST \
+            -u "${{ secrets.ORGMYLIFE_USER }}:${{ secrets.ORGMYLIFE_PASS }}" \
+            -H "X-API-Key: ${{ secrets.ORGMYLIFE_API_SECRET }}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "https://api.andreknie.de/api/projects/sync"

.gitea/workflows/andreknie-de-deploy.yml

@@ -0,0 +1,64 @@
+name: Deploy CV Site (andreknie.de)
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'privat/CV/andreknie.de/**'
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+
+      - name: Install & Build Frontend
+        working-directory: privat/CV/andreknie.de
+        run: |
+          npm ci
+          npm run build
+
+      - name: Copy project files to VM
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.SSH_HOST }}
+          username: ${{ secrets.SSH_USER }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          source: "privat/CV/andreknie.de/*"
+          target: "/opt/orchestrator"
+
+      - name: Execute Deployment on VM
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.SSH_HOST }}
+          username: ${{ secrets.SSH_USER }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          script: |
+            cd /opt/orchestrator/privat/CV/andreknie.de
+            
+            # 1. Sichere .env aus den Gitea Secrets generieren
+            cat <<EOF > .env
+            PORT=3003
+            NODE_ENV=production
+            BASE_URL=https://andreknie.de
+            SMTP_HOST=${{ secrets.SMTP_HOST }}
+            SMTP_PORT=587
+            SMTP_USER=${{ secrets.SMTP_USER }}
+            SMTP_PASS=${{ secrets.SMTP_PASS }}
+            STAKEHOLDER_EMAIL=kontakt@d-hive.de
+            
+            DATABASE_URL=postgresql://umami:${{ secrets.UMAMI_DB_PASS }}@umami-db:5432/umami
+            POSTGRES_DB=umami
+            POSTGRES_USER=umami
+            POSTGRES_PASSWORD=${{ secrets.UMAMI_DB_PASS }}
+            HASH_SALT=${{ secrets.UMAMI_HASH_SALT }}
+            EOF
+            
+            # 2. Frontend-Build in den Caddy-Ordner verschieben
+            mkdir -p site
+            cp -r dist/* site/
+            
+            # 3. Docker Container neustarten
+            docker compose up -d --build

.gitea/workflows/confluence_bot-confluence-push.yml

@@ -0,0 +1,19 @@
+name: Push Pages to Confluence
+
+on:
+  push:
+    paths: ['pages/**']
+  workflow_dispatch: {}
+
+jobs:
+  push:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Write secrets file
+        run: |
+          "CONFLUENCE_TOKEN=${{ secrets.CONFLUENCE_TOKEN }}" | Out-File .secrets -Encoding UTF8
+
+      - name: Push pages to Confluence
+        run: powershell -ExecutionPolicy Bypass -File scripts/confluence-push.ps1

.gitea/workflows/jury-voting-deploy.yml

@@ -0,0 +1,111 @@
+name: Deploy Jury Voting
+
+on:
+  push:
+    branches:
+    paths:
+      - 'dhive/Jury-Voting/**'
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build frontend
+        env:
+          NODE_ENV: production
+        run: npm run build
+
+      - name: Create deployment archive
+        run: |
+          tar czf deploy.tar.gz \
+            --exclude='*.pdf' \
+            --exclude='*.doc' \
+            --exclude='*.xlsx' \
+            --exclude='Teams' \
+            --exclude='node_modules' \
+            --exclude='.git' \
+            dist/ \
+            server/ \
+            shared/ \
+            package.json \
+            package-lock.json \
+            jury-voting.service \
+            tsconfig.json \
+            tsconfig.node.json
+
+      - name: Deploy to VPS
+        uses: appleboy/ssh-action@v1
+        with:
+          host: 217.160.174.2
+          username: root
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            mkdir -p /opt/jury-voting/server/data
+
+      - name: Upload archive
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: 217.160.174.2
+          username: root
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          source: deploy.tar.gz
+          target: /tmp/
+
+      - name: Extract and start service
+        uses: appleboy/ssh-action@v1
+        with:
+          host: 217.160.174.2
+          username: root
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            set -e
+
+            # Install Node.js if not present
+            if ! command -v node &> /dev/null; then
+              curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+              apt-get install -y nodejs
+            fi
+
+            # Extract archive (preserve session.json)
+            cd /opt/jury-voting
+            tar xzf /tmp/deploy.tar.gz --overwrite
+            rm -f /tmp/deploy.tar.gz
+
+            # Install production dependencies
+            npm ci --omit=dev
+
+            # Seed data if first run
+            if [ ! -f server/data/session.json ]; then
+              cp server/data/seed.json server/data/session.json
+            fi
+
+            # Install and restart systemd service
+            cp jury-voting.service /etc/systemd/system/jury-voting.service
+            systemctl daemon-reload
+            systemctl enable jury-voting
+            systemctl restart jury-voting
+
+            # Verify
+            sleep 2
+            curl -sf http://localhost:3002/api/health && echo "Deploy successful!" || (journalctl -u jury-voting -n 20 --no-pager && exit 1)

.gitea/workflows/notegraph-deploy.yml

@@ -0,0 +1,56 @@
+name: Deploy NoteGraph to VPS
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'privat/NoteGraph/**'
+  workflow_dispatch: {}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to VPS
+        uses: appleboy/ssh-action@v1
+        env:
+          ENV_CONTENT: |
+            SB_USER=${{ secrets.SB_USER }}
+            DOMAIN=notes.andreknie.de
+            GIT_AUTOCOMMIT=true
+            LLM_PROVIDER=${{ secrets.LLM_PROVIDER }}
+            LLM_MODEL=${{ secrets.LLM_MODEL }}
+            OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
+            ANTHROPIC_API_KEY=${{ secrets.ANTHROPIC_API_KEY }}
+            GOOGLE_API_KEY=${{ secrets.GOOGLE_API_KEY }}
+            MISTRAL_API_KEY=${{ secrets.MISTRAL_API_KEY }}
+            NEXTCLOUD_INBOX_URL=${{ secrets.NEXTCLOUD_INBOX_URL }}
+            NEXTCLOUD_INBOX_USER=${{ secrets.NEXTCLOUD_INBOX_USER }}
+            NEXTCLOUD_INBOX_PASSWORD=${{ secrets.NEXTCLOUD_INBOX_PASSWORD }}
+            ORGMYLIFE_API_URL=${{ secrets.ORGMYLIFE_API_URL }}
+            ORGMYLIFE_API_KEY=${{ secrets.ORGMYLIFE_API_KEY }}
+        with:
+          host: 217.160.174.2
+          username: root
+          key: ${{ secrets.VPS_SSH_KEY }}
+          envs: ENV_CONTENT
+          script: |
+            # Ensure directory exists
+            if [ ! -d /opt/NoteGraph ]; then
+              cd /opt
+              git clone https://github.com/DoctoDre/NoteGraph.git || true
+            fi
+
+            cd /opt/NoteGraph
+            git pull origin main || true
+
+            # Write .env from GitHub secrets
+            printf '%s\n' "$ENV_CONTENT" > .env
+
+            # Update Caddy config and reload
+            cp /opt/NoteGraph/Caddyfile /etc/caddy/Caddyfile.d/notegraph.conf 2>/dev/null || \
+              cp /opt/NoteGraph/Caddyfile /etc/caddy/Caddyfile
+            systemctl reload caddy || true
+
+            docker compose up -d --build
+            echo "NoteGraph deploy complete"

.gitea/workflows/projekt-kiq-hp-deploy.yml

@@ -0,0 +1,115 @@
+name: CI and Deploy
+
+on:
+  push:
+    branches:
+    paths:
+      - 'dhive/Projekt-KIQ-HP/**'
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DEPLOY_HOST: projekt-kiq.d-hive.de
+  DEPLOY_USER: github-deploy
+  DEPLOY_PATH: /opt/projekt-kiq
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build frontend
+        run: npm run build
+
+      - name: Prepare SSH
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "${DEPLOY_HOST}" > ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Create directories
+        run: |
+          ssh -i ~/.ssh/deploy_key \
+            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" \
+            "install -d -m 755 ${DEPLOY_PATH}/site ${DEPLOY_PATH}/server/data"
+
+      - name: Deploy frontend
+        run: |
+          rsync -az --delete \
+            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
+            dist/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/site/"
+
+      - name: Deploy backend + Docker files
+        run: |
+          rsync -az \
+            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
+            server/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/server/"
+          rsync -az \
+            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
+            package.json package-lock.json Dockerfile docker-compose.yml \
+            "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/"
+
+      - name: Write .env
+        run: |
+          ssh -i ~/.ssh/deploy_key \
+            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" \
+            "printf '%s\n' \
+              'PORT=3003' \
+              'NODE_ENV=production' \
+              'ADMIN_USER=${{ secrets.KIQ_ADMIN_USER }}' \
+              'ADMIN_PASSWORD=${{ secrets.KIQ_ADMIN_PASSWORD }}' \
+              'SESSION_SECRET=${{ secrets.KIQ_SESSION_SECRET }}' \
+              'SMTP_HOST=${{ secrets.KIQ_SMTP_HOST }}' \
+              'SMTP_PORT=${{ secrets.KIQ_SMTP_PORT }}' \
+              'SMTP_USER=${{ secrets.KIQ_SMTP_USER }}' \
+              'SMTP_PASS=${{ secrets.KIQ_SMTP_PASS }}' \
+              'ALERT_EMAIL=${{ secrets.KIQ_ALERT_EMAIL }}' \
+              > ${DEPLOY_PATH}/.env"
+
+      - name: Deploy Caddyfile
+        run: |
+          rsync -az \
+            -e "ssh -i ~/.ssh/deploy_key -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
+            Caddyfile "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}/Caddyfile"
+          ssh -i ~/.ssh/deploy_key \
+            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" \
+            "sudo -n /usr/bin/install -o root -g root -m 644 ${DEPLOY_PATH}/Caddyfile /etc/caddy/Caddyfile && \
+             sudo -n /usr/bin/systemctl reload caddy"
+
+      - name: Build and start Docker container
+        run: |
+          ssh -i ~/.ssh/deploy_key \
+            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" \
+            "cd ${DEPLOY_PATH} && sudo -n docker compose up -d --build"
+
+      - name: Verify
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key \
+            -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" \
+            "curl -sf http://localhost:3003/api/health || sudo -n docker compose -f ${DEPLOY_PATH}/docker-compose.yml logs --tail 20"

.gitea/workflows/projekt-kiq-hp-sync-to-orgmylife.yml

@@ -0,0 +1,38 @@
+name: Sync Tasks to OrgMyLife
+
+on:
+  push:
+    paths: ['PLAN.md', 'TASKS.md', 'BACKLOG.md']
+  workflow_dispatch: {}
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse open tasks and sync to OrgMyLife
+        run: |
+          REPO_NAME="Projekt-KIQ-HP"
+          
+          TASKS="[]"
+          for file in PLAN.md TASKS.md BACKLOG.md; do
+            if [ -f "$file" ]; then
+              ITEMS=$(grep -E '^\s*- \[ \]' "$file" | sed 's/.*- \[ \] //' | head -50)
+              if [ -n "$ITEMS" ]; then
+                TASKS=$(echo "$ITEMS" | jq -R -s 'split("\n") | map(select(length > 0)) | map({"title": ., "status": "backlog"})')
+                break
+              fi
+            fi
+          done
+          
+          echo "Found tasks: $TASKS"
+          
+          PAYLOAD=$(jq -n --arg repo "$REPO_NAME" --argjson tasks "$TASKS" '{"repo": $repo, "tasks": $tasks}')
+          
+          curl -s -X POST \
+            -u "${{ secrets.ORGMYLIFE_USER }}:${{ secrets.ORGMYLIFE_PASS }}" \
+            -H "X-API-Key: ${{ secrets.ORGMYLIFE_API_SECRET }}" \
+            -H "Content-Type: application/json" \
+            -d "$PAYLOAD" \
+            "https://api.andreknie.de/api/projects/sync"