feat: static sites feature with Gitea/GitHub/GitLab support and Deno backend

Deploy static content from Git repository folders with optional server-side
API endpoints. Supports Gitea/Forgejo/Gogs, GitHub, and GitLab with provider
autodetection.

- New Sites entity with CRUD, encrypted secrets, and manual/push/tag sync triggers
- Pluggable GitProvider interface with three implementations
- Deno container mode: auto-generates router from API_{method}_{name} exports
- Static container mode: nginx serving files with optional markdown rendering
- Wizard UI with provider selector, repo picker, branch/folder tree pickers
- Deploy pipeline builds fresh image, starts container, configures NPM proxy
- Stop/Start buttons, force redeploy on manual trigger
- Periodic health checker detects crashed containers
- Proxy route existence check during auto-sync

internal/staticsite/github_provider.go

@@ -0,0 +1,276 @@
+package staticsite
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// GitHubProvider implements GitProvider for GitHub repositories.
+type GitHubProvider struct {
+	apiBase    string // "https://api.github.com" for github.com
+	token      string
+	httpClient *http.Client
+}
+
+// NewGitHubProvider creates a new GitHub provider.
+// baseURL should be "https://github.com" or a GitHub Enterprise URL.
+func NewGitHubProvider(baseURL, token string) *GitHubProvider {
+	apiBase := "https://api.github.com"
+	base := strings.TrimRight(baseURL, "/")
+	if base != "https://github.com" && base != "http://github.com" {
+		// GitHub Enterprise: API is at {base}/api/v3
+		apiBase = base + "/api/v3"
+	}
+
+	return &GitHubProvider{
+		apiBase: apiBase,
+		token:   token,
+		httpClient: &http.Client{
+			Timeout: 60 * time.Second,
+		},
+	}
+}
+
+func (g *GitHubProvider) Name() string { return "github" }
+
+func (g *GitHubProvider) ListRepos(ctx context.Context, query string) ([]RepoInfo, error) {
+	var allRepos []RepoInfo
+
+	if query != "" {
+		// Use search API.
+		url := fmt.Sprintf("%s/search/repositories?q=%s&per_page=50", g.apiBase, query)
+		body, err := g.doGet(ctx, url)
+		if err != nil {
+			return nil, fmt.Errorf("search repos: %w", err)
+		}
+
+		var result struct {
+			Items []struct {
+				Owner struct {
+					Login string `json:"login"`
+				} `json:"owner"`
+				Name        string `json:"name"`
+				FullName    string `json:"full_name"`
+				Description string `json:"description"`
+				Private     bool   `json:"private"`
+				HTMLURL     string `json:"html_url"`
+			} `json:"items"`
+		}
+		if err := json.Unmarshal(body, &result); err != nil {
+			return nil, fmt.Errorf("decode search: %w", err)
+		}
+		for _, r := range result.Items {
+			allRepos = append(allRepos, RepoInfo{
+				Owner: r.Owner.Login, Name: r.Name, FullName: r.FullName,
+				Description: r.Description, Private: r.Private, HTMLURL: r.HTMLURL,
+			})
+		}
+		return allRepos, nil
+	}
+
+	// List authenticated user's repos.
+	page := 1
+	for {
+		url := fmt.Sprintf("%s/user/repos?per_page=100&page=%d&sort=updated", g.apiBase, page)
+		body, err := g.doGet(ctx, url)
+		if err != nil {
+			return nil, fmt.Errorf("list repos: %w", err)
+		}
+
+		var repos []struct {
+			Owner struct {
+				Login string `json:"login"`
+			} `json:"owner"`
+			Name        string `json:"name"`
+			FullName    string `json:"full_name"`
+			Description string `json:"description"`
+			Private     bool   `json:"private"`
+			HTMLURL     string `json:"html_url"`
+		}
+		if err := json.Unmarshal(body, &repos); err != nil {
+			return nil, fmt.Errorf("decode repos: %w", err)
+		}
+		for _, r := range repos {
+			allRepos = append(allRepos, RepoInfo{
+				Owner: r.Owner.Login, Name: r.Name, FullName: r.FullName,
+				Description: r.Description, Private: r.Private, HTMLURL: r.HTMLURL,
+			})
+		}
+		if len(repos) < 100 {
+			break
+		}
+		page++
+	}
+	return allRepos, nil
+}
+
+func (g *GitHubProvider) TestConnection(ctx context.Context, owner, repo string) error {
+	url := fmt.Sprintf("%s/repos/%s/%s", g.apiBase, owner, repo)
+	_, err := g.doGet(ctx, url)
+	return err
+}
+
+func (g *GitHubProvider) ListBranches(ctx context.Context, owner, repo string) ([]string, error) {
+	var allBranches []string
+	page := 1
+
+	for {
+		url := fmt.Sprintf("%s/repos/%s/%s/branches?per_page=100&page=%d",
+			g.apiBase, owner, repo, page)
+
+		body, err := g.doGet(ctx, url)
+		if err != nil {
+			return nil, fmt.Errorf("list branches: %w", err)
+		}
+
+		var branches []struct {
+			Name string `json:"name"`
+		}
+		if err := json.Unmarshal(body, &branches); err != nil {
+			return nil, fmt.Errorf("decode branches: %w", err)
+		}
+
+		for _, b := range branches {
+			allBranches = append(allBranches, b.Name)
+		}
+
+		if len(branches) < 100 {
+			break
+		}
+		page++
+	}
+
+	return allBranches, nil
+}
+
+func (g *GitHubProvider) GetLatestCommitSHA(ctx context.Context, owner, repo, branch string) (string, error) {
+	url := fmt.Sprintf("%s/repos/%s/%s/branches/%s", g.apiBase, owner, repo, branch)
+
+	body, err := g.doGet(ctx, url)
+	if err != nil {
+		return "", fmt.Errorf("get branch: %w", err)
+	}
+
+	var result struct {
+		Commit struct {
+			SHA string `json:"sha"`
+		} `json:"commit"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return "", fmt.Errorf("decode branch: %w", err)
+	}
+
+	return result.Commit.SHA, nil
+}
+
+func (g *GitHubProvider) ListTree(ctx context.Context, owner, repo, branch string) ([]FolderEntry, error) {
+	url := fmt.Sprintf("%s/repos/%s/%s/git/trees/%s?recursive=1",
+		g.apiBase, owner, repo, branch)
+
+	body, err := g.doGet(ctx, url)
+	if err != nil {
+		return nil, fmt.Errorf("list tree: %w", err)
+	}
+
+	var tree struct {
+		Tree []struct {
+			Path string `json:"path"`
+			Type string `json:"type"` // "blob" or "tree"
+		} `json:"tree"`
+	}
+	if err := json.Unmarshal(body, &tree); err != nil {
+		return nil, fmt.Errorf("decode tree: %w", err)
+	}
+
+	entries := make([]FolderEntry, 0, len(tree.Tree))
+	for _, e := range tree.Tree {
+		entries = append(entries, FolderEntry{
+			Path:  e.Path,
+			IsDir: e.Type == "tree",
+		})
+	}
+
+	return entries, nil
+}
+
+func (g *GitHubProvider) DownloadFolder(ctx context.Context, owner, repo, branch, folderPath, destDir string) error {
+	// Get tree to find files in folder.
+	entries, err := g.ListTree(ctx, owner, repo, branch)
+	if err != nil {
+		return fmt.Errorf("list tree: %w", err)
+	}
+
+	folderPath = strings.TrimPrefix(folderPath, "/")
+	folderPath = strings.TrimSuffix(folderPath, "/")
+	prefix := folderPath + "/"
+
+	for _, entry := range entries {
+		if entry.IsDir {
+			continue
+		}
+		if !strings.HasPrefix(entry.Path, prefix) {
+			continue
+		}
+
+		relativePath := strings.TrimPrefix(entry.Path, prefix)
+		localPath := filepath.Join(destDir, filepath.FromSlash(relativePath))
+
+		// GitHub raw content URL.
+		// For github.com: https://raw.githubusercontent.com/{owner}/{repo}/{branch}/{path}
+		// For GHE: {baseURL}/{owner}/{repo}/raw/{branch}/{path}
+		var fileURL string
+		if g.apiBase == "https://api.github.com" {
+			fileURL = fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/%s",
+				owner, repo, branch, entry.Path)
+		} else {
+			// GHE: use API contents endpoint.
+			fileURL = fmt.Sprintf("%s/repos/%s/%s/contents/%s?ref=%s",
+				g.apiBase, owner, repo, entry.Path, branch)
+		}
+
+		if err := downloadFileHTTP(ctx, g.httpClient, fileURL, localPath, g.setAuth); err != nil {
+			return fmt.Errorf("download %s: %w", relativePath, err)
+		}
+	}
+
+	return nil
+}
+
+func (g *GitHubProvider) doGet(ctx context.Context, url string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	g.setAuth(req)
+	req.Header.Set("Accept", "application/vnd.github+json")
+
+	resp, err := g.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("execute request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(body))
+	}
+
+	return body, nil
+}
+
+func (g *GitHubProvider) setAuth(req *http.Request) {
+	if g.token != "" {
+		req.Header.Set("Authorization", "Bearer "+g.token)
+	}
+}