4 Commits
Author SHA1 Message Date
Djeex 4acab3e3c6 CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing (#6)
CI / build-and-scan (push) Failing after 1m23s
- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth
2026-08-26 15:42:38 +02:00
Djeex c94da17686 Link each commit in the release changelog to its own commit page
CI / build-and-scan (pull_request) Successful in 2m11s
COMMIT_LIST only rendered the bare subject line per commit, with no
way to jump to that specific commit — only the triggering commit
(Source:) had a link. Each line now reads
"- [<short-sha>](<repo>/commit/<sha>) <subject>", matching the same
link style already used for Source.
2026-08-23 23:22:44 +02:00
Djeex 4903484aa4 Release notes: list commits instead of changed files 2026-08-23 23:22:44 +02:00
DjeexandClaude Sonnet 5 d75172dd62 Add Gitea Actions CI workflow
CI / build-and-scan (pull_request) Failing after 1m19s
Adapted from adguard-cidre's pipeline: build, syntax smoke-test, bats
unit tests, shellcheck lint, Trivy critical/high scans, then on push to
main a versioned publish (VERSION auto-bump, :latest/:X.Y/:X.Y.Z tags
retagged from the already-scanned image, and a categorized Gitea
Release). Requires the REGISTRY_TOKEN and CI_PUSH_TOKEN repo secrets
and branch protection on main (not yet configured on the Gitea side).

Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-08-22 23:50:47 +02:00