nvidia-stock-bot

7 Commits

Author	SHA1	Message	Date
Djeex	30c9b83c17	Add secret scanning, Dockerfile lint, ruff lint/format gate, coverage gate, and automatic CVE remediation PRs - gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR - new ruff lint stage (ruff.toml pins known-first-party for host/container consistency; B905 in env_config.py's zip() left un-fixed — app-logic change, see feedback-no-app-logic-changes) - pytest --cov-fail-under=75 gate on the test stage - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - ruff --fix/--format applied to existing code to start the gate clean	2026-08-26 14:49:38 +02:00
Djeex	d6cf5bb41f	Simplify release changelog: commits as description (link), drop divider lines	2026-08-26 13:54:24 +02:00
Djeex	b0a220e7a2	Link each commit in the release changelog to its own commit page CI / build-and-scan (pull_request) Successful in 56s Details COMMIT_LIST only rendered the bare subject line per commit, with no way to jump to that specific commit — only the triggering commit (Source:) had a link. Each line now reads "- [<short-sha>](<repo>/commit/<sha>) <subject>", matching the same link style already used for Source.	2026-08-23 23:20:51 +02:00
Djeex	ae737c0bd0	Align CI release workflow with adguard-cidre/socat-proxy template CI / build-and-scan (pull_request) Successful in 1m59s Details The publish/release step had drifted from the sibling repos' reference template: PR-number extraction relied on the local commit log after the version-bump commit was already made, so it could never find the triggering PR (that commit's own message has no PR reference) — fixed by keying off github.sha, the fixed triggering commit, instead. Also aligned: docker login casing (Djeex, not djeex), Trivy pinned to 0.74.0, deprecation check made informative instead of build-blocking, publish skipped entirely when no container-relevant file changed, and the release body now lists the individual commits (with a --- divider under each heading) instead of the raw changed-files list.	2026-08-23 22:39:58 +02:00
Djeex	5f66d1e1e0	Run as non-root (911:911), bump to 4.1.0 CI / build-and-scan (pull_request) Successful in 58s Details	2026-08-23 14:35:41 +02:00
Djeex	7fb3663097	Cover notifier.py error paths (TEST_MODE, HTTP error, connection error) Brings app/notifier.py from 73% to 100% test coverage by exercising the three notification functions' TEST_MODE early-return, non-204 response, and requests exception branches — the exact paths a requests upgrade regression would break silently.	2026-08-22 23:08:33 +02:00
Djeex	530aeba667	Add Gitea Actions CI/CD pipeline Bring nvidia-stock-bot up to the same CI/CD maturity as adguard-cidre: pytest suite (19 tests), multi-stage Dockerfile with a dedicated test stage, pinned requests dependency, Gitea Actions workflow (build, smoke test, unit tests, deprecation check, Trivy critical/high scan, version bump + registry publish + release), and a Renovate config for automated dependency updates.	2026-08-22 22:54:18 +02:00