chore(deps): update alpine docker tag to v3.24 #41
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MIT | |
| # Copyright (c) 2026 Netresearch DTT GmbH | |
| # | |
| # Static checks for the glpi-docker-compose-stack repo. | |
| # | |
| # LINT + SECURITY surface. Where an org reusable in netresearch/.github | |
| # faithfully reproduces a check, we delegate to it (one call site, pinned | |
| # SHAs inside the leaf, harden-runner); where the repo needs a bespoke shape | |
| # the org leaf can't express, the job stays inline. The bespoke multi-arch | |
| # publish build (build.yml / _build-cell.yml), the smoke-test, the overlay- | |
| # hardening gate and the bats suite are deliberately NOT routed through the | |
| # org meta (docker-image-ci.yml) — its `build` job is unconditional and would | |
| # force a single-arch validation build on this native-multiarch repo. So we | |
| # call the granular org LEAVES directly instead of the meta. | |
| # | |
| # Jobs: | |
| # - container-lint → delegates Dockerfile (hadolint) + shellcheck on | |
| # shipped scripts to lint-container.yml@main. The leaf | |
| # pins hadolint v2.14.0, which handles Docker 25's | |
| # HEALTHCHECK --start-interval correctly. (Earlier | |
| # v2.12.0 pin was a bug — netresearch/.github#141 + | |
| # a4a763e.) | |
| # - lint-compose → delegates `docker compose config` validation to | |
| # lint-compose.yml@main. env-substitutions supplies the | |
| # two empty DB-password placeholders so interpolation | |
| # resolves without real secrets — same contract the | |
| # former inline compose-validate job had. | |
| # - overlay-hardening → stays inline. Calls tests/lint/hardening-check.sh | |
| # to enforce security_opt:[no-new-privileges:true] + | |
| # cap_drop:[ALL] on every long-running service that | |
| # an examples/compose.*.yml overlay introduces. | |
| # Background: an overlay can ship a service without | |
| # hardening because compose anchors do not survive | |
| # across separate overlay files — this gate catches it. | |
| # - yamllint → stays inline (NOT routed through lint-yaml.yml@main). | |
| # Three deliberate divergences: this gate is BLOCKING, | |
| # scoped to specific files, and uses truthy | |
| # check-keys:false. The org leaf scans the WHOLE repo, | |
| # uses different rules, and defaults to non-blocking | |
| # (strict=false) — adopting it would silently weaken a | |
| # required check and rename it. Kept bespoke. | |
| # - bats → regression suite for bin/env-set.sh + | |
| # bin/compose-file.sh under tests/bin/. Uses | |
| # bats-core/bats-action to install bats + bats-support | |
| # + bats-assert on the runner; failures block PRs. | |
| # - gitleaks → delegates secret scanning (betterleaks, full history, | |
| # SARIF → code scanning) to gitleaks.yml@main. | |
| # - dependency-review → delegates PR dependency-diff review to | |
| # dependency-review.yml@main (pull_request only). | |
| name: lint | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| container-lint: | |
| # hadolint (always) + shellcheck (because shell-scandirs is set). | |
| uses: netresearch/.github/.github/workflows/lint-container.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| shell-scandirs: ./rootfs/usr/local/bin ./bin | |
| lint-compose: | |
| # Delegates `docker compose config` validation to the org leaf. It copies | |
| # .env.example -> .env (env-from-example, default true) and fills the two | |
| # empty DB-password assignments with placeholders so interpolation | |
| # resolves — the same contract the former inline compose-validate job had. | |
| # GLPI's only .env secrets are the DB passwords; its crypt key is minted on | |
| # first boot inside the glpi-config volume. | |
| uses: netresearch/.github/.github/workflows/lint-compose.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| compose-files: compose.yml | |
| env-substitutions: | | |
| GLPI_DB_PASSWORD=ci-placeholder | |
| DB_ROOT_PASSWORD=ci-placeholder | |
| overlay-hardening: | |
| name: overlay hardening | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install yq (mikefarah) | |
| # The ubuntu-latest runner already has docker compose v2; some images | |
| # also ship a yq, but version + flavour (mikefarah vs kislyuk) vary. | |
| # Pin a specific mikefarah release for reproducibility — the script | |
| # only uses portable v4 syntax (// fallback, @tsv, map/any). | |
| run: | | |
| set -eu | |
| YQ_VERSION=v4.53.2 | |
| # SHA256 of yq_linux_amd64 v4.53.2 (verified manually 2026-05-25 | |
| # via sha256sum on the published binary; mikefarah/yq's published | |
| # `checksums` file mixes algorithms in a single column so we can't | |
| # parse it programmatically here). | |
| YQ_SHA256=d56bf5c6819e8e696340c312bd70f849dc1678a7cda9c2ad63eebd906371d56b | |
| tmp=$(mktemp) | |
| # --proto/--proto-redir '=https' pins the transfer (and any redirect, | |
| # e.g. github.com -> objects.githubusercontent.com) to HTTPS so a | |
| # crafted redirect can't downgrade to http (SonarCloud S6506). The | |
| # payload is SHA256-verified below regardless. | |
| curl --proto '=https' --proto-redir '=https' -fsSL \ | |
| "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \ | |
| -o "$tmp" | |
| actual=$(sha256sum "$tmp" | awk '{print $1}') | |
| if [ "$actual" != "$YQ_SHA256" ]; then | |
| echo "yq checksum mismatch: expected $YQ_SHA256, got $actual" >&2 | |
| exit 1 | |
| fi | |
| sudo install -m 0755 "$tmp" /usr/local/bin/yq | |
| rm -f "$tmp" | |
| yq --version | |
| - name: Check overlay hardening | |
| run: ./tests/lint/hardening-check.sh | |
| yamllint: | |
| name: yamllint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3 | |
| with: | |
| file_or_dir: .github/workflows .hadolint.yaml compose.yml compose.override.yml.example examples/ | |
| config_data: | | |
| extends: default | |
| rules: | |
| line-length: disable | |
| document-start: disable | |
| truthy: | |
| check-keys: false | |
| comments: | |
| min-spaces-from-content: 1 | |
| bats: | |
| name: bats tests/bin | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| persist-credentials: false | |
| # Installs bats, bats-support, bats-assert under /usr/lib/bats-*. | |
| # tests/bin/test_helper.bash sources support+assert from that path. | |
| - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # v4.0.0 | |
| with: | |
| # detik + file are kubernetes/filesystem helpers we don't use. | |
| detik-install: false | |
| file-install: false | |
| - name: Run regression suite | |
| run: bats tests/bin/ | |
| gitleaks: | |
| # Secret scanning over full git history (betterleaks), SARIF -> code | |
| # scanning. The leaf skips merge_group + dependabot internally. | |
| uses: netresearch/.github/.github/workflows/gitleaks.yml@main | |
| permissions: | |
| contents: read | |
| security-events: write | |
| dependency-review: | |
| # Reviews the dependency diff on pull requests. The leaf gates itself on | |
| # github.event_name == 'pull_request', so it no-ops on push. | |
| uses: netresearch/.github/.github/workflows/dependency-review.yml@main | |
| permissions: | |
| contents: read | |
| pull-requests: write |