Pin Trivy to 0.74.0 instead of latest, make the deprecation check
non-blocking (warning only), log the release API's HTTP status code so
a failure is actually visible in the CI logs, drop the redundant
Docker socket mount on the Trivy steps, and switch the version-bump
push to the same URL-embedded-token approach and extraheader key the
other repos use. Also generalizes the smoke test to every top-level
.py file instead of a hardcoded list, and enriches the release body
(changelog header, source links, changed files) to match the other
repos' output.
Adds the weekly Monday 6am schedule trigger too, so a Trivy scan still
runs even on a week Renovate finds nothing to bump.
83 tests (94% coverage of src/py) covering the builder pipeline
(gallery sync, HTML/CSS generation, image processing, full site
build) and the Flask webui (routes, uploads, theme/font management).
Dockerfile gains a `test` stage (pytest) between the wheel builder
and the prod image, and pins the alpine base to a full patch tag so
Renovate can classify updates. CI workflow builds, smoke-tests, runs
the suite, scans with Trivy, and publishes/releases on merge to main,
following the same pipeline already running on adguard-cidre.
Djeex