chore: extract userbot subtree to its own repo

userbot/ (bot plus panel) now lives at /home/forust/userbot as a clone of forust/userbot instead of a subtree in homelab. Cleans up the pipeline references that only existed for it: scan-deps, test-backend and test-frontend jobs, the userbot build matrix entries, the deploy panel hook, and the userbot-only pyrightconfig. Running cluster workloads are untouched; homelab just stops building and testing upstream's code.

.gitea/workflows/ci.yaml

@@ -90,11 +90,8 @@ jobs:
           set -euo pipefail
           tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck)"
           export PATH="$tools_dir:$PATH"
-          # userbot/ is a git subtree synced from forust/userbot, so its shell
-          # scripts are upstream's to maintain, not ours. Linting them would let a
-          # routine subtree pull turn the deploy gate red on code we do not own.
           mapfile -t scripts < <(
-            git ls-files '*.sh' ':(glob)**/*.bash' ':!userbot/**'
+            git ls-files '*.sh' ':(glob)**/*.bash'
           )
           if [ "${#scripts[@]}" -eq 0 ]; then
             echo "No shell scripts found."
@@ -197,163 +194,6 @@ jobs:
 
           hadolint -c .hadolint.yaml "${dockerfiles[@]}"
 
-  # Known, accepted, and recorded. Each line is a real advisory against a
-  # package we build into the panel image, kept in this workflow rather than in
-  # the package manifest so that a subtree sync from forust/userbot cannot
-  # silently widen the exemption.
-  #
-  # starlette is the reason this job is not simply "fail on everything":
-  # fastapi 0.115.12 pins `starlette<0.47.0`, and the fixes for the last four
-  # below need 0.49.1 through 1.3.1, so clearing them means a jump from fastapi
-  # 0.115.12 to 0.141.x. That is upstream's call, not a drive-by in a lint
-  # commit. Of the seven, four are reachable here in principle: 1942 is a
-  # crafted Range header hitting FileResponse, and the panel serves its built
-  # SPA through exactly that; 249 is request.form() ignoring max_fields for
-  # x-www-form-urlencoded, which is the login form; 1941 is a large multipart
-  # body blocking the event loop; 161 and 248 are unvalidated Host and request
-  # path reaching request.url. 2280 needs HTTPEndpoint, which the panel does
-  # not use, and 2281 is Windows-only, and this deploys on Linux.
-  #
-  # The panel answers on userbot.workstation.internal and has no public
-  # forust.xyz route, which is what keeps the four reachable ones from being
-  # an internet-facing DoS. It still manages Telegram credentials.
-  #
-  # Deleting an entry here is how you accept a new advisory, so the diff says
-  # so out loud.
-  scan-deps:
-    # Renovate branches only ever carry version/digest bumps: nothing here can
-    # change the shipped dependency tree, so the audits would just burn runner
-    # time on the same box that serves prod. Static checks still run.
-    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Audit the Python dependencies that ship in the image
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh pip-audit)"
-          export PATH="$tools_dir:$PATH"
-          # requirements.txt, not requirements-dev.txt: this is what the image
-          # installs, and the test tooling is not a shipped attack surface.
-          pip-audit -r userbot/panel/backend/requirements.txt --strict \
-            --ignore-vuln CVE-2025-67720 \
-            --ignore-vuln PYSEC-2026-161 \
-            --ignore-vuln PYSEC-2026-1941 \
-            --ignore-vuln PYSEC-2026-1942 \
-            --ignore-vuln PYSEC-2026-2280 \
-            --ignore-vuln PYSEC-2026-2281 \
-            --ignore-vuln PYSEC-2026-248 \
-            --ignore-vuln PYSEC-2026-249
-
-      # devDependencies are excluded on purpose. `npm audit` on the full tree
-      # reports 7 findings, and every one of them is a build- or test-time
-      # package: the esbuild CORS advisory needs a vite dev server serving to
-      # the internet, and nanoid's infinite loop needs a custom generator
-      # called with size 0, which postcss does not do. None of them are in the
-      # 91 kB bundle the panel serves. The one production finding, devalue
-      # via svelte, is moderate, which is where --audit-level draws the line;
-      # this fails on the next high or critical one.
-      - name: Audit the production npm dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          # The pinned node, not whatever the runner has. Its system node is a
-          # rolling Arch package: during this very push its npm was missing
-          # entirely, and an hour later it was npm 12 on node 26. Both are the
-          # wrong major anyway — the panel image is node:22-alpine.
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
-          export PATH="$tools_dir:$PATH"
-          cd userbot/panel/frontend
-          npm ci
-          npm audit --omit=dev --audit-level=high
-
-  test-backend:
-    # Same as scan-deps: renovate bumps cannot break panel tests.
-    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # 25 tests over the panel's pydantic models, its auth flow, the SPA
-      # fallback and the Kubernetes client it shells out with. They existed and
-      # had never been executed by anything.
-      #
-      # Note that userbot/ is a subtree synced from forust/userbot, so a routine
-      # sync can turn this red on upstream's code. Unlike the shellcheck job,
-      # which skips that tree because style disagreements there are ours to
-      # lose, a failing test here is a real defect in a service we deploy.
-      - name: Run the panel backend test suite
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh uv)"
-          export PATH="$tools_dir:$PATH"
-
-          # A venv in a temp dir rather than a checked-out one: the runner is
-          # shared, and a leftover .venv would let a dependency the
-          # requirements no longer pin still satisfy an import.
-          #
-          # --python is not optional. uv otherwise takes whatever interpreter it
-          # finds first, and which one that is depends on the machine: this
-          # runner runs jobs on the host, where the only interpreter is 3.14,
-          # and pyrogram's sync.py calls the bare asyncio.get_event_loop() that
-          # 3.14 no longer auto-creates, so three tests fail at collection. The
-          # image is python:3.13-slim, so 3.13 is also the version worth
-          # testing: uv fetches a managed build of it when the host has none,
-          # which is what makes this job independent of the runner.
-          venv="$(mktemp -d)/venv"
-          uv venv --python 3.13 --quiet "$venv"
-          uv pip install --quiet --python "$venv/bin/python" \
-            -r userbot/panel/backend/requirements-dev.txt
-
-          # `python -m`, not bare `pytest`: the tests import `app.*` relative to
-          # the backend directory, which only works if the cwd is on sys.path,
-          # and only `python -m` puts it there.
-          cd userbot/panel/backend
-          "$venv/bin/python" -m pytest tests/ -q
-
-  test-frontend:
-    # Same as scan-deps: renovate bumps cannot break panel tests.
-    if: ${{ !startsWith(github.head_ref, 'renovate/') && !startsWith(github.ref_name, 'renovate/') }}
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # One `npm ci` for both checks below: it is by far the slowest part of
-      # this job, and a second one would learn nothing the first did not.
-      #
-      # `npm ci`, not `npm install`, for the same reason the Dockerfile uses it:
-      # the lockfile is what makes the tree that gets checked the tree that
-      # gets shipped.
-      - name: Type-check and test the panel frontend
-        shell: bash
-        run: |
-          set -euo pipefail
-          # The pinned node, not whatever the runner has. Its system node is a
-          # rolling Arch package: during this very push its npm was missing
-          # entirely, and an hour later it was npm 12 on node 26. Both are the
-          # wrong major anyway — the panel image is node:22-alpine.
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
-          export PATH="$tools_dir:$PATH"
-          cd userbot/panel/frontend
-          npm ci
-
-          # svelte-check has been a devDependency all along with no script
-          # pointing at it, so the type errors it reports had nowhere to
-          # surface. It is clean today, which is the only reason it can be a
-          # gate: it stops at whatever upstream introduces rather than
-          # reporting a backlog we inherited.
-          npm run check
-          npm test
-
   validate:
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 20
@@ -472,24 +312,11 @@ jobs:
 
   build:
     needs:
-      # scan-deps and the two test jobs were missing here, so a commit with a
-      # known-vulnerable dependency or a failing test still moved the :prod tag.
-      # The deploy was blocked either way - it requires the whole workflow to
-      # have succeeded - but the tag had already moved, and the next deploy to
-      # run resolved it. Publishing and passing the checks are the same gate.
-      [
-        lint-actionlint,
-        lint-shellcheck,
-        lint-compose,
-        lint-prettier,
-        lint-ruff,
-        lint-yaml,
-        lint-dockerfiles,
-        scan-deps,
-        test-backend,
-        test-frontend,
-        validate,
-      ]
+      # The panel's scan-deps/test-backend/test-frontend jobs gated here until
+      # userbot moved to its own repo; upstream's code is upstream's gate now.
+      # The rule is unchanged: publishing and passing the checks are the same
+      # gate, so a commit that fails any of these still cannot move :prod.
+      [lint-actionlint, lint-shellcheck, lint-compose, lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
     if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev') && !startsWith(github.ref_name, 'renovate/')
     runs-on: [self-hosted, linux, arch, homelab]
     timeout-minutes: 60
@@ -544,9 +371,6 @@ jobs:
               errorpages/*)
                 add_service errorpages
                 ;;
-              userbot/*)
-                add_service userbot
-                ;;
               homepages/*)
                 add_service homepages
                 ;;
@@ -646,32 +470,6 @@ jobs:
                   docker push "${image}:${tag}"
                 done
                 ;;
-              userbot)
-                set_tags
-                for target in runtime panel; do
-                  case "$target" in
-                    runtime)
-                      context="userbot"
-                      image="${REGISTRY}/forust/userbot"
-                      ;;
-                    panel)
-                      context="userbot/panel"
-                      image="${REGISTRY}/forust/userbot-panel"
-                      ;;
-                  esac
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
               homepages)
                 for variant in forust xdfnx; do
                   case "$variant" in

.gitea/workflows/deploy-lib.sh

@@ -779,19 +779,6 @@ stage_apply_k8s() {
       exit 1
     fi
   done
-  if [ -f "$REPO/userbot/k8s/active" ]; then
-    log "userbot panel hook"
-    if kubectl get secret userbot-common-secrets -n userbot >/dev/null 2>&1; then
-      echo "  userbot-common-secrets already present in userbot ns, not touching"
-    elif kubectl get secret userbot-common-secrets -n default >/dev/null 2>&1; then
-      echo "  bootstrapping userbot-common-secrets into userbot ns"
-      kubectl get secret userbot-common-secrets -n default -o json \
-        | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
-        | kubectl apply -f -
-    else
-      echo "  WARNING: userbot-common-secrets missing in both default and userbot ns; create it manually from the laptop"
-    fi
-  fi
   restart_stale_images
 
   # No verification here on purpose. This stage may be killed at any point by