Add public monitoring features and CI updates

- Add status pages, incidents, badges, maintenance, bulk ops, and metrics
- Add Docker packaging, env example, and frontend routes
- Refresh GitHub workflows and project metadata

.github/workflows/docker-images.yml

@@ -8,6 +8,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       max-parallel: 5
@@ -152,26 +153,26 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up bun
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./internal/site
+        run: bun install --frozen-lockfile --cwd ./internal/site
 
       - name: Build site
         run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Docker metadata
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ matrix.image }}
           tags: ${{ matrix.tags }}
@@ -181,7 +182,7 @@ jobs:
         env:
           password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
         if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
           password: ${{ secrets[matrix.password_secret] }}
@@ -190,7 +191,7 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./
           file: ${{ matrix.dockerfile }}

.github/workflows/release.yml

@@ -11,9 +11,10 @@ permissions:
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -21,15 +22,16 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./internal/site
+        run: bun install --frozen-lockfile --cwd ./internal/site
 
       - name: Build site
         run: bun run --cwd ./internal/site build
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: "^1.22.1"
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
 
       - name: Set up .NET
         uses: actions/setup-dotnet@v4

.github/workflows/test.yml

@@ -0,0 +1,132 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  frontend-build:
+    name: Frontend Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --cwd ./internal/site
+        shell: bash
+
+      - name: Build site
+        run: bun run --cwd ./internal/site build
+        shell: bash
+
+  go-test:
+    name: Go Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Run tests
+        run: go test -tags=testing ./...
+        shell: bash
+
+  release-smoke:
+    name: Release Smoke Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --cwd ./internal/site
+        shell: bash
+
+      - name: Build site
+        run: bun run --cwd ./internal/site build
+        shell: bash
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "9.0.x"
+
+      - name: Build Windows sensor helper
+        run: dotnet build -c Release ./agent/lhm/beszel_lhm.csproj
+        shell: bash
+
+      - name: Fetch Windows smartctl asset
+        run: go generate -run fetchsmartctl ./agent
+        shell: bash
+
+      - name: Build Linux binaries
+        run: go build ./internal/cmd/hub ./internal/cmd/agent
+        shell: bash
+
+      - name: Build Windows agent
+        run: GOOS=windows GOARCH=amd64 go build ./internal/cmd/agent
+        shell: bash
+
+  docker-smoke:
+    name: Docker Smoke Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - dockerfile: ./internal/dockerfile_hub
+            image: beszel-hub-smoke
+          - dockerfile: ./internal/dockerfile_agent
+            image: beszel-agent-smoke
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --cwd ./internal/site
+        shell: bash
+
+      - name: Build site
+        run: bun run --cwd ./internal/site build
+        shell: bash
+
+      - name: Build Docker image
+        run: docker build --file "${{ matrix.dockerfile }}" --tag "${{ matrix.image }}" .
+        shell: bash

.github/workflows/vulncheck.yml

@@ -17,14 +17,15 @@ jobs:
   vulncheck:
     name: VulnCheck
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v6
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 1.26.x
-          # cached: false
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
         shell: bash