- retag+push the same :latest/:X.Y/:X.Y.Z tags to ghcr.io/djeex/lumeex
- create a matching GitHub Release on the Djeex/lumeex mirror, same changelog
body prefixed with a notice pointing back to the git.djeex.fr source repo
- targets the exact commit SHA (not the branch) with retries, since the
Gitea->GitHub push mirror can lag behind this job
- requires a new GH_TOKEN secret (repo + write:packages) — not created yet
- first GHCR push per repo will be private by default; GitHub has no API to
default it public for a personal account, needs a one-time manual toggle
- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR
- new ruff lint stage (ruff.toml pins known-first-party for host/container
consistency; F841/B007 in webui.py left un-fixed via per-file-ignores —
app-logic changes, flagged for review rather than auto-fixed)
- pytest --cov-fail-under=90 gate on the test stage (already had pytest-cov,
never wired into CI until now)
- scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR
if it clears the finding, instead of just failing red
- ruff --fix/--format applied to existing code to start the gate clean
COMMIT_LIST only rendered the bare subject line per commit, with no
way to jump to that specific commit — only the triggering commit
(Source:) had a link. Each line now reads
"- [<short-sha>](<repo>/commit/<sha>) <subject>", matching the same
link style already used for Source.
adguard-cidre switched its release changelog from a changed-files list
to a commits list (with --- dividers) after the previous commit here
was written from an already-stale read of that file. Also drops the
glob-based smoke test (never actually part of the real template, only
of nvidia-stock-bot's own drift) for an explicit per-file check
matching the canonical error-handling shape, and aligns the remaining
step names/commit message wording.
Pin Trivy to 0.74.0 instead of latest, make the deprecation check
non-blocking (warning only), log the release API's HTTP status code so
a failure is actually visible in the CI logs, drop the redundant
Docker socket mount on the Trivy steps, and switch the version-bump
push to the same URL-embedded-token approach and extraheader key the
other repos use. Also generalizes the smoke test to every top-level
.py file instead of a hardcoded list, and enriches the release body
(changelog header, source links, changed files) to match the other
repos' output.
Adds the weekly Monday 6am schedule trigger too, so a Trivy scan still
runs even on a week Renovate finds nothing to bump.
83 tests (94% coverage of src/py) covering the builder pipeline
(gallery sync, HTML/CSS generation, image processing, full site
build) and the Flask webui (routes, uploads, theme/font management).
Dockerfile gains a `test` stage (pytest) between the wheel builder
and the prod image, and pins the alpine base to a full patch tag so
Renovate can classify updates. CI workflow builds, smoke-tests, runs
the suite, scans with Trivy, and publishes/releases on merge to main,
following the same pipeline already running on adguard-cidre.
Djeex