[mod] ci: remove security (#6400)

Manage alerts directly from Docker Hub

.github/workflows/container.yml

@@ -25,25 +25,21 @@ env:
 
 jobs:
   build:
-    if: github.repository_owner == 'searxng' || github.event_name == 'workflow_dispatch'
+    if: |
+      github.event_name == 'workflow_dispatch'
+      || (github.repository_owner == 'searxng' && github.event.workflow_run.conclusion == 'success')
     name: Build (${{ matrix.arch }})
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - arch: amd64
+          - runner: ubuntu-26.04
-            march: amd64
+            arch: amd64
-            os: ubuntu-24.04
+          - runner: ubuntu-26.04-arm
-            emulation: false
+            arch: arm64
-          - arch: arm64
+          - runner: ubuntu-26.04-arm
-            march: arm64
+            arch: armv7
-            os: ubuntu-24.04-arm
-            emulation: false
-          - arch: armv7
-            march: arm64
-            os: ubuntu-24.04-arm
-            emulation: true
 
     permissions:
       packages: write
@@ -53,33 +49,25 @@ jobs:
       git_url: ${{ steps.build.outputs.git_url }}
 
     steps:
-      # yamllint disable rule:line-length
+      - name: Login to GHCR
-      - name: Setup podman
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
-        env:
+        with:
-          PODMAN_VERSION: "v5.7.1"
+          registry: "ghcr.io"
-        run: |
+          username: "${{ github.repository_owner }}"
-          sudo apt-get purge -y podman runc crun conmon
+          password: "${{ secrets.GITHUB_TOKEN }}"
-
-          curl -fsSLO "https://github.com/mgoltzsche/podman-static/releases/download/${{ env.PODMAN_VERSION }}/podman-linux-${{ matrix.march }}.tar.gz"
-          curl -fsSLO "https://github.com/mgoltzsche/podman-static/releases/download/${{ env.PODMAN_VERSION }}/podman-linux-${{ matrix.march }}.tar.gz.asc"
-          gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 0CCF102C4F95D89E583FF1D4F8B5AF50344BB503
-          gpg --batch --verify "podman-linux-${{ matrix.march }}.tar.gz.asc" "podman-linux-${{ matrix.march }}.tar.gz"
-
-          tar -xzf "podman-linux-${{ matrix.march }}.tar.gz"
-          sudo cp -rfv ./podman-linux-${{ matrix.march }}/etc/. /etc/
-          sudo cp -rfv ./podman-linux-${{ matrix.march }}/usr/. /usr/
-
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      # yamllint enable rule:line-length
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
 
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
           persist-credentials: "false"
           fetch-depth: "0"
 
@@ -91,64 +79,36 @@ jobs:
             python-${{ env.PYTHON_VERSION }}-${{ runner.arch }}-
           path: "./local/"
 
-      - name: Get date
-        id: date
-        run: echo "date=$(date +'%Y%m%d')" >>$GITHUB_OUTPUT
-
       - name: Setup cache container
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
-          key: "container-${{ matrix.arch }}-${{ steps.date.outputs.date }}-${{ hashFiles('./requirements*.txt') }}"
+          key: "container-${{ matrix.arch }}-${{ hashFiles('./requirements*.txt') }}"
           restore-keys: |
-            container-${{ matrix.arch }}-${{ steps.date.outputs.date }}-
             container-${{ matrix.arch }}-
           path: "/var/tmp/buildah-cache-*/*"
 
-      - if: ${{ matrix.emulation }}
-        name: Setup QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
-
-      - name: Login to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
-        with:
-          registry: "ghcr.io"
-          username: "${{ github.repository_owner }}"
-          password: "${{ secrets.GITHUB_TOKEN }}"
-
       - name: Build
         id: build
         env:
           OVERRIDE_ARCH: "${{ matrix.arch }}"
-        run: make podman.build
+        run: make container.build
 
   test:
     name: Test (${{ matrix.arch }})
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     needs: build
     strategy:
       fail-fast: false
       matrix:
         include:
-          - arch: amd64
+          - runner: ubuntu-26.04
-            os: ubuntu-24.04
+            arch: amd64
-            emulation: false
+          - runner: ubuntu-26.04-arm
-          - arch: arm64
+            arch: arm64
-            os: ubuntu-24.04-arm
+          - runner: ubuntu-26.04-arm
-            emulation: false
+            arch: armv7
-          - arch: armv7
-            os: ubuntu-24.04-arm
-            emulation: true
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          persist-credentials: "false"
-
-      - if: ${{ matrix.emulation }}
-        name: Setup QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
-
       - name: Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
@@ -156,6 +116,15 @@ jobs:
           username: "${{ github.repository_owner }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
 
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
+          persist-credentials: "false"
+
       - name: Test
         env:
           OVERRIDE_ARCH: "${{ matrix.arch }}"
@@ -165,7 +134,7 @@ jobs:
   release:
     if: github.repository_owner == 'searxng' && github.ref_name == 'master'
     name: Release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     needs:
       - build
       - test
@@ -174,10 +143,12 @@ jobs:
       packages: write
 
     steps:
-      - name: Checkout
+      - name: Login to Docker Hub
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
-          persist-credentials: "false"
+          registry: "docker.io"
+          username: "${{ secrets.DOCKER_USER }}"
+          password: "${{ secrets.DOCKER_TOKEN }}"
 
       - name: Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
@@ -186,12 +157,11 @@ jobs:
           username: "${{ github.repository_owner }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
 
-      - name: Login to Docker Hub
+      - name: Checkout
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
-          registry: "docker.io"
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
-          username: "${{ secrets.DOCKER_USER }}"
+          persist-credentials: "false"
-          password: "${{ secrets.DOCKER_TOKEN }}"
 
       - name: Release
         env:

.github/workflows/data-update.yml

@@ -21,7 +21,7 @@ jobs:
   data:
     if: github.repository_owner == 'searxng'
     name: ${{ matrix.fetch }}
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     strategy:
       fail-fast: false
       matrix:
@@ -64,23 +64,17 @@ jobs:
         run: V=1 ./manage pyenv.cmd python "./searxng_extra/update/${{ matrix.fetch }}"
 
       - name: Create PR
-        id: cpr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           author: "searxng-bot <searxng-bot@users.noreply.github.com>"
           committer: "searxng-bot <searxng-bot@users.noreply.github.com>"
-          title: "[data] update searx.data - ${{ matrix.fetch }}"
+          title: "[mod] data: update searx.data - ${{ matrix.fetch }}"
-          commit-message: "[data] update searx.data - ${{ matrix.fetch }}"
+          commit-message: "[mod] data: update searx.data - ${{ matrix.fetch }}"
-          branch: "update_data_${{ matrix.fetch }}"
+          branch: "ci-data-${{ matrix.fetch }}"
           delete-branch: "true"
           draft: "false"
           signoff: "false"
           body: |
-            [data] update searx.data - ${{ matrix.fetch }}
+            Update searx.data - ${{ matrix.fetch }}
           labels: |
             data
-
-      - name: Display information
-        run: |
-          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

.github/workflows/documentation.yml

@@ -25,7 +25,7 @@ jobs:
   release:
     if: github.repository_owner == 'searxng' || github.event_name == 'workflow_dispatch'
     name: Release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     permissions:
       # for JamesIves/github-pages-deploy-action to push
       contents: write
@@ -65,7 +65,7 @@ jobs:
         with:
           folder: "dist/docs"
           branch: "gh-pages"
-          commit-message: "[doc] build from commit ${{ github.sha }}"
+          commit-message: "[mod] docs: build from commit ${{ github.sha }}"
           # Automatically remove deleted files from the deploy branch
           clean: "true"
           single-commit: "true"

.github/workflows/integration.yml

@@ -23,7 +23,7 @@ env:
 jobs:
   test:
     name: Python ${{ matrix.python-version }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         python-version:
@@ -59,29 +59,24 @@ jobs:
 
   theme:
     name: Theme
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     steps:
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
 
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: "26"
+          check-latest: "true"
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: "false"
 
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version-file: "./.nvmrc"
-
-      - name: Setup cache Node.js
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
-        with:
-          key: "nodejs-${{ runner.arch }}-${{ hashFiles('./.nvmrc', './package.json') }}"
-          path: "./client/simple/node_modules/"
-
       - name: Setup cache Python
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
@@ -90,6 +85,14 @@ jobs:
             python-${{ env.PYTHON_VERSION }}-${{ runner.arch }}-
           path: "./local/"
 
+      - name: Setup cache Node.js
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          key: "nodejs-${{ runner.arch }}-${{ hashFiles('**/package-lock.json') }}"
+          restore-keys: |
+            nodejs-${{ runner.arch }}-
+          path: "./client/simple/node_modules/"
+
       - name: Setup venv
         run: make V=1 install
 

.github/workflows/l10n.yml

@@ -26,9 +26,9 @@ env:
 
 jobs:
   update:
-    if: github.repository_owner == 'searxng' && github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'searxng'
     name: Update
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     permissions:
       # For "make V=1 weblate.push.translations"
       contents: write
@@ -59,7 +59,7 @@ jobs:
       - name: Setup Weblate
         run: |
           mkdir -p ~/.config
-          echo "${{ secrets.WEBLATE_CONFIG }}" > ~/.config/weblate
+          echo "${{ secrets.WEBLATE_CONFIG }}" >~/.config/weblate
 
       - name: Setup Git
         run: |
@@ -74,7 +74,7 @@ jobs:
       github.repository_owner == 'searxng'
       && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule')
     name: Pull Request
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     permissions:
       # For "make V=1 weblate.translations.commit"
       contents: write
@@ -107,7 +107,7 @@ jobs:
       - name: Setup Weblate
         run: |
           mkdir -p ~/.config
-          echo "${{ secrets.WEBLATE_CONFIG }}" > ~/.config/weblate
+          echo "${{ secrets.WEBLATE_CONFIG }}" >~/.config/weblate
 
       - name: Setup Git
         run: |
@@ -118,23 +118,17 @@ jobs:
         run: make V=1 weblate.translations.commit
 
       - name: Create PR
-        id: cpr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           author: "searxng-bot <searxng-bot@users.noreply.github.com>"
           committer: "searxng-bot <searxng-bot@users.noreply.github.com>"
-          title: "[l10n] update translations from Weblate"
+          title: "[mod] i18n: update translations from Weblate"
-          commit-message: "[l10n] update translations from Weblate"
+          commit-message: "[mod] i18n: update translations from Weblate"
           branch: "translations_update"
           delete-branch: "true"
           draft: "false"
           signoff: "false"
           body: |
-            [l10n] update translations from Weblate
+            Update translations from Weblate
           labels: |
             area:i18n
-
-      - name: Display information
-        run: |
-          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

.github/workflows/security.yml

@@ -1,46 +0,0 @@
----
-name: Security
-
-# yamllint disable-line rule:truthy
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "42 05 * * *"
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  container:
-    if: github.repository_owner == 'searxng'
-    name: Container
-    runs-on: ubuntu-24.04-arm
-    permissions:
-      security-events: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          persist-credentials: "false"
-
-      - name: Sync GHCS from Docker Scout
-        uses: docker/scout-action@2688993af7bafd6ba8c6a74ec652442be91dd82b  # v1.23.1
-        with:
-          organization: "searxng"
-          dockerhub-user: "${{ secrets.DOCKER_USER }}"
-          dockerhub-password: "${{ secrets.DOCKER_TOKEN }}"
-          image: "registry://ghcr.io/searxng/searxng:latest"
-          command: "cves"
-          sarif-file: "./scout.sarif"
-          exit-code: "false"
-          write-comment: "false"
-
-      - name: Upload SARIFs
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9  # v4.37.0
-        with:
-          sarif_file: "./scout.sarif"