Merge pull request 'Run as non-root by default via PUID/PGID' (#4 ) from dev-v1.1 into main

Reviewed-on: #4
Run as non-root by default via PUID/PGID
2026-08-23 15:18:11 +02:00 · 2026-08-23 15:10:17 +02:00 · 2026-08-22 22:13:27 +00:00 · 2026-08-23 00:08:24 +02:00 · 2026-08-22 22:05:22 +00:00 · 2026-08-23 00:04:45 +02:00
4 changed files with 9 additions and 109 deletions
@@ -18,21 +18,6 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      - name: Scan for secrets
-        run: |
-          # docker cp, not a build COPY: a repo's own .dockerignore (e.g. one that
-          # excludes .git for prod builds) would otherwise silently give an empty,
-          # falsely-clean scan.
-          CID=$(docker create zricethezav/gitleaks:v8.30.1 detect --source=/repo --no-banner -v)
-          docker cp . "$CID:/repo"
-          docker start -a "$CID"
-          STATUS=$?
-          docker rm "$CID" > /dev/null
-          exit $STATUS
-
-      - name: Lint Dockerfile with hadolint
-        run: docker run --rm -i hadolint/hadolint:v2.15.1-alpine hadolint --failure-threshold error - < Dockerfile
-
      - name: Build Docker image
        run: docker build -t socat-proxy:ci .

@@ -48,53 +33,12 @@ jobs:
        run: docker build --target lint -t socat-proxy:lint .

      - name: Scan with Trivy (critical - blocking)
-        id: trivy_critical
-        continue-on-error: true
        run: |
          docker run --rm \
            -e DOCKER_HOST=tcp://dockerhost:2375 \
            --add-host=dockerhost:host-gateway \
            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:ci

-      - name: Handle CRITICAL findings
-        if: steps.trivy_critical.outcome == 'failure'
-        run: |
-          if [ "${{ github.event_name }}" != "schedule" ]; then
-            echo "::error::CRITICAL vulnerabilities found, failing the build."
-            exit 1
-          fi
-
-          echo "Scheduled scan found CRITICAL vulnerabilities — attempting an automatic apk upgrade + rescan."
-
-          sed -i '/^FROM .* AS base$/a RUN apk upgrade --no-cache' Dockerfile
-          docker build -t socat-proxy:remediated .
-
-          if docker run --rm \
-            -e DOCKER_HOST=tcp://dockerhost:2375 \
-            --add-host=dockerhost:host-gateway \
-            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:remediated; then
-            echo "apk upgrade clears the CRITICAL finding(s) — opening a PR for review."
-
-            BRANCH="auto/cve-fix-$(date +%Y%m%d)-$(echo "${{ github.sha }}" | cut -c1-7)"
-            git config user.name "socat-proxy-ci"
-            git config user.email "[email protected]"
-            git checkout -b "$BRANCH"
-            git add Dockerfile
-            git commit -m "Auto-remediate CRITICAL CVE via apk upgrade"
-            git config --unset-all http.https://git.djeex.fr/.extraheader || true
-            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/socat-proxy.git" "HEAD:$BRANCH"
-
-            PR_JSON=$(curl -s -X POST \
-              -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
-              -H "Content-Type: application/json" \
-              -d "$(jq -n --arg head "$BRANCH" '{title: "🔒 Auto: remediate CRITICAL CVE via apk upgrade", head: $head, base: "main", body: "Opened automatically by the scheduled CVE scan. An `apk upgrade --no-cache` cleared the CRITICAL Trivy finding(s) in a rebuild — review the diff and merge to publish the fix."}')" \
-              "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/pulls")
-            echo "PR API response: $(echo "$PR_JSON" | jq -r '.html_url // .message // "unknown"')"
-          else
-            echo "::error::apk upgrade does not clear the CRITICAL finding(s) — no automatic fix available, needs manual review."
-            exit 1
-          fi
-
      - name: Scan with Trivy (high - informative)
        run: |
          docker run --rm \
@@ -107,11 +51,10 @@ jobs:
        run: |
          BEFORE="${{ github.event.before }}"
          if [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE" 2>/dev/null; then
-            BASE_REF="$BEFORE"
+            CHANGED=$(git diff --name-only "$BEFORE" "${{ github.sha }}")
          else
-            BASE_REF="HEAD~1"
+            CHANGED=$(git diff --name-only HEAD~1 HEAD)
          fi
-          CHANGED=$(git diff --name-only "$BASE_REF" "${{ github.sha }}")
          echo "Changed files:"
          echo "$CHANGED"

@@ -159,16 +102,6 @@ jobs:
          docker push "$IMAGE:$MINOR_TAG"
          docker push "$IMAGE:$VERSION"

-          GHCR_IMAGE=ghcr.io/djeex/socat-proxy
-          echo "${{ secrets.GH_TOKEN }}" | docker login ghcr.io -u Djeex --password-stdin
-
-          docker tag socat-proxy:ci "$GHCR_IMAGE:latest"
-          docker tag socat-proxy:ci "$GHCR_IMAGE:$MINOR_TAG"
-          docker tag socat-proxy:ci "$GHCR_IMAGE:$VERSION"
-          docker push "$GHCR_IMAGE:latest"
-          docker push "$GHCR_IMAGE:$MINOR_TAG"
-          docker push "$GHCR_IMAGE:$VERSION"
-
          TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
          PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)

@@ -194,9 +127,9 @@ jobs:
            fi
          fi

-          REPO_URL="https://git.djeex.fr/Djeex/socat-proxy"
-          COMMIT_LIST=$(git log --no-merges --format="- %s ([%h](${REPO_URL}/commit/%H))" "$BASE_REF".."${{ github.sha }}")
+          CHANGED_LIST=$(echo "$CHANGED" | sed 's/^/- /')

+          REPO_URL="https://git.djeex.fr/Djeex/socat-proxy"
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          SOURCE_LINE="[${SHORT_SHA}](${REPO_URL}/commit/${{ github.sha }})"
          if [ -n "$PR_NUM" ]; then
@@ -212,8 +145,8 @@ jobs:
          **Source:** ${SOURCE_LINE}
          **Image:** \`${IMAGE}:${VERSION}\`

-          **Commits:**
-          ${COMMIT_LIST}
+          **Changed files:**
+          ${CHANGED_LIST}
          EOF
          )

@@ -228,32 +161,3 @@ jobs:
            -H "Content-Type: application/json" \
            -d "$JSON_PAYLOAD" \
            "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/releases"
-
-          MIRROR_NOTICE="_This github repo is a mirror of https://git.djeex.fr/Djeex/socat-proxy. You'll find full package, PR, history and release note there._"
-          GH_BODY=$(printf '%s\n\n%s' "$MIRROR_NOTICE" "$BODY")
-
-          GH_JSON_PAYLOAD=$(jq -n \
-            --arg tag "$VERSION" \
-            --arg name "$VERSION" \
-            --arg body "$GH_BODY" \
-            --arg sha "${{ github.sha }}" \
-            '{tag_name: $tag, name: $name, target_commitish: $sha, body: $body}')
-
-          GH_STATUS=0
-          for i in 1 2 3 4 5; do
-            GH_STATUS=$(curl -s -o /tmp/gh_release.json -w "%{http_code}" -X POST \
-              -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
-              -H "Accept: application/vnd.github+json" \
-              -H "Content-Type: application/json" \
-              -d "$GH_JSON_PAYLOAD" \
-              "https://api.github.com/repos/Djeex/socat-proxy/releases")
-            if [ "$GH_STATUS" = "201" ]; then
-              break
-            fi
-            echo "GitHub Release attempt $i failed (HTTP $GH_STATUS) — mirror may not have synced this commit yet, retrying in 15s..."
-            sleep 15
-          done
-          echo "GitHub Release API response: $GH_STATUS"
-          if [ "$GH_STATUS" != "201" ]; then
-            cat /tmp/gh_release.json 2>/dev/null || true
-          fi
@@ -1 +1 @@
-1.1.1
+1.1.0
@@ -145,7 +145,7 @@ fi

 log "[~] Testing connection to target..."
 # Test if we can reach the target before starting socat
-if ! nc -z -w 2 "$TARGET_HOST" "$TARGET_PORT" 2>/dev/null; then
+if ! nc -z "$TARGET_HOST" "$TARGET_PORT" 2>/dev/null; then
    log "[!] Cannot connect to $TARGET_HOST:$TARGET_PORT - socat will retry automatically"
 else
    log "[✓] Connection to $TARGET_HOST:$TARGET_PORT is working"
@@ -58,11 +58,7 @@ socat_pid() {
 wait_for_log() {
    pattern="$1"
    tries=0
-    # 40 * 0.25s = 10s — merge-triggered runs can land on a cold runner
-    # (evicted Docker cache, first container start), pushing the very first
-    # backgrounded entrypoint.sh past a tighter budget even though nothing's
-    # actually wrong; a rerun on a warm runner always passes.
-    while [ "$tries" -lt 40 ]; do
+    while [ "$tries" -lt 20 ]; do
        grep -qE "$pattern" "$LOG" 2>/dev/null && return 0
        tries=$((tries + 1))
        sleep 0.25
Author	SHA1	Message	Date
Djeex	db405d24e9	Merge pull request 'Run as non-root by default via PUID/PGID' (#4 ) from dev-v1.1 into main CI / build-and-scan (push) Successful in 1m11s Details Reviewed-on: #4	2026-08-23 15:18:11 +02:00
Djeex	fff6e49350	Run as non-root by default via PUID/PGID CI / build-and-scan (pull_request) Successful in 1m7s Details	2026-08-23 15:10:17 +02:00
socat-proxy-ci	ac1addca14	Bump build version to 1.0.1 [skip ci]	2026-08-22 22:13:27 +00:00
Djeex	01a863deed	Merge pull request 'Update alpine Docker tag to v3.24.1' (#2 ) from renovate/alpine-3.x into main CI / build-and-scan (push) Successful in 1m36s Details Reviewed-on: #2	2026-08-23 00:08:24 +02:00
Djeex	769462a028	Update alpine Docker tag to v3.24.1 CI / build-and-scan (pull_request) Successful in 2m42s Details	2026-08-22 22:05:22 +00:00
Djeex	ea467474d0	Merge pull request 'Dev ci' (#1 ) from dev-ci into main CI / build-and-scan (push) Failing after 40s Details Reviewed-on: #1	2026-08-23 00:04:45 +02:00
DjeexandClaude Sonnet 5	373dbfce2e	Add Renovate config CI / build-and-scan (pull_request) Failing after 40s Details Same policy as adguard-cidre: patch-level Dockerfile bumps automerge, minor/major get a labeled PR, vulnerability alerts labeled bug. No pip_requirements rule — this repo has no Python dependencies to manage. Still needed on the Gitea/Renovate side (manual, not done here): uncomment socat-proxy in the shared ~/renovate/config.js repositories array on stockeex, and create the bot/major/minor/bug labels in this repo's Issues → Labels (Renovate silently drops labels that don't already exist). Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-08-23 00:02:11 +02:00
DjeexandClaude Sonnet 5	d75172dd62	Add Gitea Actions CI workflow CI / build-and-scan (pull_request) Failing after 1m19s Details Adapted from adguard-cidre's pipeline: build, syntax smoke-test, bats unit tests, shellcheck lint, Trivy critical/high scans, then on push to main a versioned publish (VERSION auto-bump, :latest/:X.Y/:X.Y.Z tags retagged from the already-scanned image, and a categorized Gitea Release). Requires the REGISTRY_TOKEN and CI_PUSH_TOKEN repo secrets and branch protection on main (not yet configured on the Gitea side). Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-08-22 23:50:47 +02:00
DjeexandClaude Sonnet 5	b825dec8be	Multi-stage Dockerfile: pin base image, add test/lint stages Pin alpine:latest to the full patch-level tag alpine:3.22.1 so Renovate can classify patch/minor/major bumps on it. Add a `test` stage (bats) and a `lint` stage (shellcheck, severity=error) that build from `base` before ENTRYPOINT is set, so CI can run them without an --entrypoint override. A trailing `FROM base` keeps the lean prod image as the default `docker build .` target despite the extra stages. Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-08-22 23:50:40 +02:00
DjeexandClaude Sonnet 5	f6b27fe51c	Add bats test suite for entrypoint.sh Covers env-var validation, socket path preparation, target connectivity messaging, DEBUG_LEVEL to socat-flag mapping, and graceful shutdown vs. crash detection — run against the real socat/nc binaries rather than mocks, since UNIX-LISTEN binds without needing the TCP target reachable. Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-08-22 23:50:32 +02:00
@@ -1 +1 @@
 .1.1
 .1.0