chore: remove Forgejo Cargo dependency

.cargo/config.toml

@@ -1,5 +1,2 @@
-[registries.forgejo]
-index = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/"
-
 [registry]
 global-credential-providers = ["cargo:token"]

.github/workflows/ci.yml

@@ -19,18 +19,9 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.user.type != 'Bot'
     runs-on: [self-hosted, node-b, linux, x64, rust]
     env:
-      FORGEJO_CARGO_TOKEN: ${{ secrets.FORGEJO_CARGO_TOKEN }}
       CARGO_BUILD_JOBS: 1
     steps:
       - uses: actions/checkout@v7
-      - name: Configure Cargo credentials
-        run: |
-          export CARGO_HOME="$RUNNER_TEMP/cargo-home"
-          mkdir -p "$CARGO_HOME"
-          printf '[registries.forgejo]\ntoken = "Bearer %s"\n' "$FORGEJO_CARGO_TOKEN" > "$CARGO_HOME/credentials.toml"
-          chmod 600 "$CARGO_HOME/credentials.toml"
-          test -n "$FORGEJO_CARGO_TOKEN"
-          echo "CARGO_HOME=$CARGO_HOME" >> "$GITHUB_ENV"
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.88

.github/workflows/release.yml

@@ -63,8 +63,6 @@ jobs:
           build-args: |
             RUSTNZB_BUILD_REF=${{ github.ref_name }}
             RELEASE_OPTIMIZED=true
-          secrets: |
-            forgejo_token=${{ secrets.FORGEJO_CARGO_TOKEN }}
           cache-from: ''
           cache-to: ''
       - name: Smoke-test the exact amd64 release image

.gitignore

@@ -18,6 +18,7 @@ e2e/mock-auth-state.json
 /.ci-cache/
 /.ci-output/
 /.ci-artifacts/
+/tempmigration.md
 
 # Codesight
 .codesight/

Dockerfile

@@ -41,10 +41,8 @@ COPY Cargo.toml Cargo.lock ./
 COPY apps apps
 COPY crates crates
 
-# The Forgejo credential exists only in this BuildKit secret-mounted RUN. It
-# is never a Docker ARG, image ENV value, Cargo file, or cache layer.
-RUN --mount=type=secret,id=forgejo_token,required=true \
-    --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+# The build uses only public crates.io dependencies for the rustnzb binary.
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
     --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
     --mount=type=cache,target=/build/target,sharing=locked \
     set -eu; \
@@ -53,22 +51,17 @@ RUN --mount=type=secret,id=forgejo_token,required=true \
         linux/arm64) rust_target=aarch64-unknown-linux-musl ;; \
         *) printf 'unsupported target platform: %s\n' "$TARGETPLATFORM" >&2; exit 1 ;; \
     esac; \
-    token=$(cat /run/secrets/forgejo_token); \
     if [ "$RELEASE_OPTIMIZED" = true ]; then \
         export CARGO_PROFILE_RELEASE_LTO=thin \
             CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 \
             CARGO_PROFILE_RELEASE_STRIP=symbols; \
     fi; \
-    CARGO_REGISTRIES_FORGEJO_INDEX='sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/' \
-    CARGO_REGISTRIES_FORGEJO_CREDENTIAL_PROVIDER='cargo:token' \
-    CARGO_REGISTRIES_FORGEJO_TOKEN="Bearer $token" \
     CARGO_TARGET_DIR=/build/target \
     RUSTNZB_BUILD_REF="$RUSTNZB_BUILD_REF" \
         cargo zigbuild --release --locked -p rustnzb \
             --features webdav,vendored-openssl --target "$rust_target"; \
     mkdir -p /out; \
     cp "/build/target/$rust_target/release/rustnzb" /out/rustnzb; \
-    unset token CARGO_REGISTRIES_FORGEJO_TOKEN
 
 
 FROM lscr.io/linuxserver/baseimage-alpine:3.23@sha256:46d690858431e262d574274bb2863e1fbaf8de61c6f7677150dd79c2cc65cdcf AS runtime

Dockerfile.local

@@ -29,19 +29,12 @@ COPY apps/rustnzb/Cargo.toml apps/rustnzb/build.rs /build/apps/rustnzb/
 COPY apps/rustnzb/src /build/apps/rustnzb/src
 COPY crates /build/crates
 
-# Forgejo creds (still needed for private nzbdav-* crates — webdav feature)
-ARG GIT_AUTH_TOKEN
 ARG RUSTNZB_BUILD_REF
 ARG CI_COMMIT_SHA
 ARG CI_COMMIT_TAG
 ENV RUSTNZB_BUILD_REF=${RUSTNZB_BUILD_REF}
 ENV CI_COMMIT_SHA=${CI_COMMIT_SHA}
 ENV CI_COMMIT_TAG=${CI_COMMIT_TAG}
-RUN TOKEN="${GIT_AUTH_TOKEN}" && \
-    git config --global url."http://x-access-token:${TOKEN}@100.92.54.45:3002/".insteadOf "http://100.92.54.45:3002/" && \
-    printf '[registries.forgejo]\nindex = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/"\ncredential-provider = "cargo:token"\n\n[registry]\ndefault = "forgejo"\n' > $CARGO_HOME/config.toml && \
-    printf '[registries.forgejo]\ntoken = "Bearer %s"\n' "$TOKEN" > $CARGO_HOME/credentials.toml
-
 RUN cargo build --release -p rustnzb --features webdav
 
 

apps/rustnzb/Cargo.toml

@@ -54,10 +54,10 @@ tokio-util = { version = "0.7", features = ["rt"] }
 openssl-sys = { version = "0.9", features = ["vendored"], optional = true }
 
 # WebDAV feature (opt-in: cargo build --features webdav)
-nzbdav-core = { version = "0.4.1", registry = "forgejo", optional = true }
-nzbdav-stream = { version = "0.4.1", registry = "forgejo", optional = true }
-nzbdav-dav = { version = "0.4.1", registry = "forgejo", optional = true }
-nzbdav-pipeline = { version = "0.4.1", registry = "forgejo", optional = true, default-features = false }
+nzbdav-core = { version = "0.4.0", optional = true }
+nzbdav-stream = { version = "0.4.0", optional = true }
+nzbdav-dav = { version = "0.4.0", optional = true }
+nzbdav-pipeline = { version = "0.4.0", optional = true, default-features = false }
 
 [package.metadata.deb]
 maintainer = "AusAgentSmith <admin@rustnzb.dev>"

ci/run

@@ -35,20 +35,14 @@ case "$task" in
     *) usage ;;
 esac
 
-needs_cargo_auth=false
-case "$task" in
-    fmt|check|test|clippy|e2e|desktop-test|build-linux|build-linux-arm64|build-windows|build-image|build-ci-images)
-        needs_cargo_auth=true
-        ;;
-esac
 needs_registry_auth=false
 if [ "$image_key" != host ] || [ "$task" = smoke-image ]; then
     needs_registry_auth=true
 fi
 
 # The authenticated wrapper fetches secrets into this process only. Docker is
 # given environment variable names, never token values in argv.
-if { [ "$needs_cargo_auth" = true ] || [ "$needs_registry_auth" = true ]; } \
+if [ "$needs_registry_auth" = true ] \
     && [ -z "${GIT_AUTH_TOKEN:-}" ] && [ -z "${FORGEJO_TOKEN_FILE:-}" ]; then
     if [ -z "${RUSTNZB_CI_AUTH_ACTIVE:-}" ] && command -v mydevenv2-agent-auth >/dev/null 2>&1; then
         export RUSTNZB_CI_AUTH_ACTIVE=1
@@ -141,17 +135,6 @@ else
     )
 fi
 
-if [ "$needs_cargo_auth" = true ]; then
-    if [ -n "${GIT_AUTH_TOKEN:-}" ]; then
-        docker_args+=(--env GIT_AUTH_TOKEN)
-    else
-        docker_args+=(
-            --mount "type=bind,src=$FORGEJO_TOKEN_FILE,dst=/run/secrets/forgejo_token,readonly"
-            --env FORGEJO_TOKEN_FILE=/run/secrets/forgejo_token
-        )
-    fi
-fi
-
 for name in CI_COMMIT_SHA CI_COMMIT_TAG CI_PIPELINE_NUMBER RUSTNZB_BUILD_REF CI_ARTIFACT_DIR CI_PACKAGE_DIR; do
     [ -z "${!name:-}" ] || docker_args+=(--env "$name")
 done

ci/tasks/build-image

@@ -3,7 +3,7 @@ set -eu
 . "$(dirname "$0")/lib.sh"
 task_start build-image docker
 
-: "${GIT_AUTH_TOKEN:?GIT_AUTH_TOKEN is required for the private WebDAV crates}"
+: "${GIT_AUTH_TOKEN:?GIT_AUTH_TOKEN is required for the Forgejo rollback image registry}"
 image=${1:-rustnzb:local}
 build_ref=${RUSTNZB_BUILD_REF:-$(git rev-parse --short=12 HEAD)}
 docker_config=$(mktemp -d)
@@ -32,7 +32,6 @@ set -- \
     --target runtime \
     --platform "${RUSTNZB_PLATFORM:-linux/amd64}" \
     --provenance=false \
-    --secret id=forgejo_token,env=GIT_AUTH_TOKEN \
     --build-arg "RUSTNZB_BUILD_REF=$build_ref" \
     --tag "$image"
 if [ "${RUSTNZB_PUSH:-false}" = true ]; then

ci/tasks/build-linux

@@ -1,10 +1,8 @@
 #!/bin/sh
 set -eu
 . "$(dirname "$0")/lib.sh"
-. "$(dirname "$0")/cargo-auth"
-trap 'cleanup_cargo_auth; cleanup_task_frontend' EXIT
+trap cleanup_task_frontend EXIT
 task_start build-linux cargo npm
-setup_cargo_auth
 task_target_dir build-linux
 ensure_frontend
 if [ -n "${CI_COMMIT_TAG:-}" ]; then