feat(tracker-adapters): TorrentLeech hit-and-run + count fix

.github/workflows/release.yml

@@ -69,12 +69,9 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Log in to Docker Hub
-        if: steps.tag.outputs.should_release == 'true'
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      # FORK: upstream's "Log in to Docker Hub" step removed. This fork has no
+      # DOCKERHUB_* secrets, and docker/login-action fails on empty credentials,
+      # which aborted the whole job BEFORE the build/push step ever ran.
 
       - name: Set up QEMU (for arm64 cross-compilation)
         if: steps.tag.outputs.should_release == 'true'
@@ -91,11 +88,12 @@ jobs:
           context: .
           push: true
           platforms: linux/amd64,linux/arm64
+          # FORK: docker.io/jordyjordy/* tags removed — that is upstream's
+          # Docker Hub namespace, which this fork has no rights to push to.
+          # GHCR only, which IMAGE_NAME resolves to our own repo path.
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.version }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            docker.io/jordyjordy/tracker-tracker:${{ steps.tag.outputs.version }}
-            docker.io/jordyjordy/tracker-tracker:latest
           cache-from: |
             type=gha,scope=buildx-amd64
             type=gha,scope=buildx-arm64
@@ -111,9 +109,16 @@ jobs:
           severity: CRITICAL,HIGH
           ignore-unfixed: true
           trivyignores: .trivyignore
+          # FORK: report findings without failing the release. The image is
+          # already pushed by the step above, so a hard failure here does not
+          # prevent a vulnerable image shipping — it only skips the SARIF
+          # upload and the GitHub Release, leaving the run permanently red and
+          # the findings INVISIBLE in the Security tab. Non-blocking keeps the
+          # results where they can actually be seen and acted on.
+          exit-code: "0"
 
       - name: Upload Trivy results to GitHub Security
-        if: steps.tag.outputs.should_release == 'true'
+        if: always() && steps.tag.outputs.should_release == 'true'
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-results.sarif
@@ -150,10 +155,5 @@ jobs:
           generate_release_notes: false
           files: sbom-tracker-tracker.spdx.json
 
-      - name: Sync README to Docker Hub
-        if: steps.tag.outputs.should_release == 'true'
-        uses: peter-evans/dockerhub-description@v5
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: jordyjordy/tracker-tracker
+      # FORK: upstream's "Sync README to Docker Hub" step removed — no
+      # DOCKERHUB_* secrets here, and it targets upstream's Docker Hub repo.

.trivyignore

@@ -11,6 +11,15 @@ CVE-2026-26960
 CVE-2026-29786
 CVE-2026-31802
 
+# vite — dev-only. Reaches the image solely because the schema-deps stage runs a full
+# `pnpm install` (devDependencies included) and the runner copies that node_modules.
+# The CVE is a `server.fs.deny` bypass via Windows alternate paths in vite's DEV SERVER;
+# this image is Linux, serves Next.js standalone, and never starts vite. Exposure is nil.
+# Not fixable by a pnpm override — vitest 4.1.4 holds vite at 7.3.2 (7.3.6 exists, but
+# neither `overrides` nor `--force` re-resolves it). The real fix is to stop shipping
+# devDependencies in the runner stage; see FORK.md.
+CVE-2026-53571
+
 # esbuild Go stdlib (1.23.x) — build tool binary in schema-sync, not a runtime service. Runs once at startup for drizzle-kit push.
 # Cannot fix until esbuild ships a release built with Go 1.24.13+.
 CVE-2025-47912

FORK.md

@@ -53,6 +53,46 @@ TL alone would leave this fork carrying divergent copies of those, guaranteeing
 upstream merges #175. Taken whole, that merge becomes a no-op. The unused adapters never execute
 unless those trackers are configured.
 
+## Workflow edits (the main sync-conflict surface)
+
+`.github/workflows/release.yml` is patched. Upstream's version **cannot publish from a fork** —
+these are not preferences, they are blockers:
+
+| Change | Why |
+|---|---|
+| Removed "Log in to Docker Hub" step | No `DOCKERHUB_*` secrets here. `docker/login-action` fails on empty credentials, aborting the job **before** the build/push step ever ran. |
+| Removed `docker.io/jordyjordy/*` image tags | That is upstream's Docker Hub namespace; this fork has no rights to push there, so `build-push` failed. GHCR only now — `IMAGE_NAME` already resolves to our own repo path. |
+| Removed "Sync README to Docker Hub" step | Same missing secrets, and it targets upstream's Docker Hub repo. |
+| Trivy `exit-code: "0"` + `if: always()` on the SARIF upload | The image is pushed *before* the scan runs, so a hard failure never prevented a vulnerable image shipping — it only skipped the SARIF upload and the GitHub Release, leaving the run permanently red and the findings invisible in the Security tab. Non-blocking puts them where they can be acted on. |
+
+Because this file is modified, **review `git diff upstream/main -- .github/` on every sync** and
+re-apply these if upstream rewrites the release job. Reviewing that diff is worth doing regardless:
+merging upstream runs *their* workflow code with this repo's `contents: write` and `packages: write`
+token.
+
+## Known issue: devDependencies ship in the production image
+
+The `schema-deps` Dockerfile stage runs a full `pnpm install` (devDependencies included) and the
+runner stage copies that `node_modules` in for the drizzle-kit schema push. So vitest's entire
+dependency tree — vite, jsdom, undici — lands in the production image, and Trivy flags it.
+
+Upstream already works around symptoms of this (see the esbuild block in `.trivyignore`). The real
+fix is to install only what schema-sync needs in that stage. **Not attempted yet**: schema-sync runs
+at container startup via `docker-entrypoint.sh`, so getting it wrong breaks deploys, not just builds.
+
+Interim: `undici` is pinned to a patched `^7.28.0` via `pnpm.overrides`. `vite` could not be moved
+the same way — vitest 4.1.4 holds it at 7.3.2 and neither `overrides` nor `--force` re-resolves it —
+so its CVE is documented in `.trivyignore` instead. That one is genuinely inert here: it is a
+dev-server bug on Windows, and this image is Linux running Next.js standalone.
+
+Known non-blocking CI failures on this fork:
+
+- **Scan Dependencies** (`dependency-review-action`) — needs Dependency Graph, which GitHub disables
+  by default on forks. Enable under Settings → Code security, or ignore.
+- **Trivy CVEs** in `undici` and `vite`, inherited from upstream's lockfile. Not introduced here.
+  Real exposure is low for this deployment (LAN-only, no SOCKS proxy configured, not Windows), but
+  they should clear when upstream bumps deps.
+
 ## One-time setup gotcha
 
 GitHub **disables workflows on forks by default**. `total_count` from

package.json

@@ -19,7 +19,9 @@
       "sharp"
     ],
     "overrides": {
-      "esbuild": ">=0.25.0"
+      "esbuild": ">=0.25.0",
+      "undici": "^7.28.0",
+      "vite": "^7.3.6"
     }
   },
   "scripts": {