From a2cd42b86f79b95d9c6dc203099cfe68619fb389 Mon Sep 17 00:00:00 2001
From: Andreas Brain <dev@abrain.de>
Date: Sun, 4 Oct 2026 12:31:46 +0200
Subject: [PATCH 1/2] Convert Drone CI to GitHub Actions

---
 .drone.yml                         | 37 ------------------
 .github/workflows/build-deploy.yml | 62 ++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 37 deletions(-)
 delete mode 100644 .drone.yml
 create mode 100644 .github/workflows/build-deploy.yml

diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index ac93ec5..0000000
--- a/.drone.yml
+++ /dev/null
@@ -1,37 +0,0 @@
----
-kind: pipeline
-type: docker
-name: build
-
-steps:
-  - name: install
-    image: composer:2.10.3@sha256:af98f42dfff7c68ba8d53c2164fd9fde1087b7d449514baa38c418b1f6bc4bac
-    commands:
-      - composer install
-  - name: build
-    image: php:8.5.11@sha256:19642e172d3a542225225e202ddc2c11f67bdcbddf147b676c49338609b9290f
-    commands:
-      - ./vendor/bin/daux generate
-  - name: deploy
-    image: cschlosser/drone-ftps@sha256:a376718d90e289d2d09860bf6d526bee2878f467dd61b819ec9e2c3eecc6821f
-    environment:
-      FTP_USERNAME:
-        from_secret: username
-      FTP_PASSWORD:
-        from_secret: password
-      PLUGIN_HOSTNAME:
-        from_secret: ftphost
-      PLUGIN_SRC_DIR: /static
-      PLUGIN_DEST_DIR: /
-      PLUGIN_MIRROR_OPTS: -e
-      PLUGIN_CLEAN_DIR: false
-    when:
-      event:
-        exclude:
-          - pull_request
-
-trigger:
-  branch:
-    include:
-      - main
-
diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
new file mode 100644
index 0000000..7745fbb
--- /dev/null
+++ b/.github/workflows/build-deploy.yml
@@ -0,0 +1,62 @@
+---
+name: build
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: shivammathur/setup-php@2.37.2
+        with:
+          php-version: '8.5'
+          tools: composer:2.10.3
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache dependencies
+        uses: actions/cache@v5.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist
+
+      - name: build
+        run: ./vendor/bin/daux generate
+
+      - name: deploy
+        if: github.event_name != 'pull_request'
+        env:
+          FTP_USERNAME: ${{ secrets.FTP_USERNAME }}
+          FTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
+          FTP_HOST: ${{ secrets.FTP_HOST }}
+        run: |
+          sudo apt-get update && sudo apt-get install -y lftp
+          lftp -u "$FTP_USERNAME,$FTP_PASSWORD" "$FTP_HOST" -e "
+            set ftp:ssl-force true;
+            set ftp:ssl-protect-data true;
+            set ssl:verify-certificate true;
+            set ssl:check-hostname true;
+            set net:max-retries 3;
+            mirror --verbose -R -e static /;
+            quit"

From 7d7eb591282c37978491d7b9cefa157dc575351a Mon Sep 17 00:00:00 2001
From: Andreas Brain <dev@abrain.de>
Date: Sun, 4 Oct 2026 12:35:46 +0200
Subject: [PATCH 2/2] Pin Actions to commit SHA

Usually Renovate would have done this, but the repo settings enfocred it from the start.
---
 .github/workflows/build-deploy.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
index 7745fbb..2fd3f89 100644
--- a/.github/workflows/build-deploy.yml
+++ b/.github/workflows/build-deploy.yml
@@ -18,11 +18,11 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: shivammathur/setup-php@2.37.2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.5'
           tools: composer:2.10.3
@@ -32,7 +32,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache dependencies
-        uses: actions/cache@v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}