6 Commits

Include renames

Author	SHA1	Message	Date
Djeex	6eba3916b4	Add secret scanning, Dockerfile lint, ruff lint/format gate, coverage gate, and automatic CVE remediation PRs ... - gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR - new ruff lint stage (ruff.toml pins known-first-party for host/container consistency; F841/B007 in webui.py left un-fixed via per-file-ignores — app-logic changes, flagged for review rather than auto-fixed) - pytest --cov-fail-under=90 gate on the test stage (already had pytest-cov, never wired into CI until now) - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - ruff --fix/--format applied to existing code to start the gate clean	2026-08-26 14:49:45 +02:00
Djeex	1ce8da9fe6	Simplify release changelog: commits as description (link), drop divider lines	2026-08-26 13:54:25 +02:00
Djeex	ca4240c84a	Link each commit in the release changelog to its own commit page ... COMMIT_LIST only rendered the bare subject line per commit, with no way to jump to that specific commit — only the triggering commit (Source:) had a link. Each line now reads "- [<short-sha>](<repo>/commit/<sha>) <subject>", matching the same link style already used for Source.	2026-08-23 23:20:39 +02:00
Djeex	83d2dc7ee6	Match adguard-cidre's current template exactly (post 2026-08-23 update) ... adguard-cidre switched its release changelog from a changed-files list to a commits list (with --- dividers) after the previous commit here was written from an already-stale read of that file. Also drops the glob-based smoke test (never actually part of the real template, only of nvidia-stock-bot's own drift) for an explicit per-file check matching the canonical error-handling shape, and aligns the remaining step names/commit message wording.	2026-08-23 23:09:35 +02:00
Djeex	8f4d763048	Align CI release workflow with the adguard-cidre/nvidia-stock-bot template ... Pin Trivy to 0.74.0 instead of latest, make the deprecation check non-blocking (warning only), log the release API's HTTP status code so a failure is actually visible in the CI logs, drop the redundant Docker socket mount on the Trivy steps, and switch the version-bump push to the same URL-embedded-token approach and extraheader key the other repos use. Also generalizes the smoke test to every top-level .py file instead of a hardcoded list, and enriches the release body (changelog header, source links, changed files) to match the other repos' output. Adds the weekly Monday 6am schedule trigger too, so a Trivy scan still runs even on a week Renovate finds nothing to bump.	2026-08-23 22:47:27 +02:00
Djeex	142a48ad5e	Add pytest suite and Gitea Actions CI/CD pipeline ... 83 tests (94% coverage of src/py) covering the builder pipeline (gallery sync, HTML/CSS generation, image processing, full site build) and the Flask webui (routes, uploads, theme/font management). Dockerfile gains a `test` stage (pytest) between the wheel builder and the prod image, and pins the alpine base to a full patch tag so Renovate can classify updates. CI workflow builds, smoke-tests, runs the suite, scans with Trivy, and publishes/releases on merge to main, following the same pipeline already running on adguard-cidre.	2026-08-23 10:24:02 +02:00