fix: device-agent v1.0.0-dev.28 - remove config file persistence (security fix)

Per Gitea tutorial: add RUNNER_TOOL_CACHE=/toolcache env, use actions/cache@v3
(not v4), and go-hashfiles instead of hashFiles() which is unsupported.

.gitea/workflows/build_dashboard.yaml

@@ -6,6 +6,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
     steps:
       - name: Configure git auth for submodules
         run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -21,6 +23,17 @@ jobs:
         with:
           node-version: '24'
 
+      - name: Hash package-lock
+        id: hash-npm
+        run: echo "hash=$(sha256sum apps/dashboard-ui/package-lock.json | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.npm
+          key: npm-dashboard-${{ steps.hash-npm.outputs.hash }}
+          restore-keys: npm-dashboard-
+
       - name: Install
         working-directory: apps/dashboard-ui
         run: npm ci || npm install

.gitea/workflows/build_device_agent.yaml

@@ -6,6 +6,8 @@ on:
 jobs:
   cross-build:
     runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
     steps:
       - name: Configure git auth for submodules
         run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -20,6 +22,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
+          cache: true
 
       - name: Build all platforms
         working-directory: apps/device-agent

.gitea/workflows/build_server_core.yaml

@@ -6,6 +6,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
     steps:
       - name: Configure git auth for submodules
         run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -20,10 +22,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
-
-      - name: Download Go modules
-        working-directory: apps/server-core
-        run: go mod download
+          cache: true
 
       - name: Generate Swagger docs
         working-directory: apps/server-core

.gitea/workflows/ci.yml

@@ -10,9 +10,9 @@ on:
       - 'v[0-9]*.[0-9]*.[0-9]'
 
 jobs:
-  # --- TESTS (only for test tags) ---
+  # --- TESTS (test tags + stable release tags) ---
   server-core-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -36,7 +36,7 @@ jobs:
         run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1
 
   device-agent-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -55,7 +55,7 @@ jobs:
         run: go test ./... -cover
 
   dashboard-test:
-    if: contains(gitea.ref_name, 'test')
+    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -76,35 +76,40 @@ jobs:
         working-directory: apps/dashboard-ui
         run: npm run build
 
-  # --- BUILD + RELEASE (only for dev/beta/release tags, no tests needed) ---
+  # --- BUILD + RELEASE (dev/beta/release tags) ---
   build-server-core:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_server_core.yaml
     secrets: inherit
 
   build-device-agent:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_device_agent.yaml
     secrets: inherit
 
   build-dashboard:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_dashboard.yaml
     secrets: inherit
 
   build-docs:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure()
+    needs: [server-core-test, device-agent-test, dashboard-test]
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/docs_call.yaml
     secrets: inherit
 
   release:
-    if: "!contains(gitea.ref_name, 'test')"
+    if: always() && !contains(gitea.ref_name, 'test') && !failure()
     needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
     uses: ./.gitea/workflows/release_call.yaml
     with:
-      prerelease: ${{ contains(gitea.ref_name, 'dev-') || contains(gitea.ref_name, 'beta') }}
+      prerelease: ${{ contains(gitea.ref_name, 'dev') }}
+      draft: ${{ contains(gitea.ref_name, 'beta') }}
     secrets: inherit

.gitea/workflows/release_call.yaml

@@ -8,6 +8,11 @@ on:
         required: false
         type: boolean
         default: false
+      draft:
+        description: 'Mark as draft'
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -65,7 +70,7 @@ jobs:
           fi
 
           # Create release
-          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":false,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.prerelease }}")
+          JSON_BODY=$(printf '{"tag_name":"%s","name":"%s","body":"Release %s","draft":%s,"prerelease":%s}' "$TAG" "$TAG" "$TAG" "${{ inputs.draft }}" "${{ inputs.prerelease }}")
           RELEASE_RESP=$(curl -s -X POST \
             -H "Authorization: token $TOKEN" \
             -H "Content-Type: application/json" \