From ada76ac00d7faeb5e8e4b2cf1f98ed689a4ef81a Mon Sep 17 00:00:00 2001 From: Djeex Date: Wed, 26 Aug 2026 13:54:24 +0200 Subject: [PATCH 1/3] Simplify release changelog: commits as description (link), drop divider lines --- .gitea/workflows/ci.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 1e10722..321de24 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -129,7 +129,7 @@ jobs: fi REPO_URL="https://git.djeex.fr/Djeex/socat-proxy" - COMMIT_LIST=$(git log --no-merges --format="- [%h](${REPO_URL}/commit/%H) %s" "$BASE_REF".."${{ github.sha }}") + COMMIT_LIST=$(git log --no-merges --format="- %s ([%h](${REPO_URL}/commit/%H))" "$BASE_REF".."${{ github.sha }}") SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7) SOURCE_LINE="[${SHORT_SHA}](${REPO_URL}/commit/${{ github.sha }})" @@ -139,10 +139,8 @@ jobs: BODY=$(cat < Date: Wed, 26 Aug 2026 14:49:32 +0200 Subject: [PATCH 2/3] Add secret scanning, Dockerfile lint, and automatic CVE remediation PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - gitleaks (via docker cp, dockerignore-agnostic — this repo's own .dockerignore excludes .git, which a build-context COPY would have missed) and hadolint scan every push/PR - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - no ruff/pytest-cov here (shell project, already has shellcheck/bats) --- .gitea/workflows/ci.yml | 56 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 321de24..131aac0 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -18,6 +18,21 @@ jobs: fetch-depth: 0 persist-credentials: false + - name: Scan for secrets + run: | + # docker cp, not a build COPY: a repo's own .dockerignore (e.g. one that + # excludes .git for prod builds) would otherwise silently give an empty, + # falsely-clean scan. + CID=$(docker create zricethezav/gitleaks:v8.30.1 detect --source=/repo --no-banner -v) + docker cp . "$CID:/repo" + docker start -a "$CID" + STATUS=$? + docker rm "$CID" > /dev/null + exit $STATUS + + - name: Lint Dockerfile with hadolint + run: docker run --rm -i hadolint/hadolint:v2.15.1-alpine hadolint --failure-threshold error - < Dockerfile + - name: Build Docker image run: docker build -t socat-proxy:ci . @@ -33,12 +48,53 @@ jobs: run: docker build --target lint -t socat-proxy:lint . - name: Scan with Trivy (critical - blocking) + id: trivy_critical + continue-on-error: true run: | docker run --rm \ -e DOCKER_HOST=tcp://dockerhost:2375 \ --add-host=dockerhost:host-gateway \ aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:ci + - name: Handle CRITICAL findings + if: steps.trivy_critical.outcome == 'failure' + run: | + if [ "${{ github.event_name }}" != "schedule" ]; then + echo "::error::CRITICAL vulnerabilities found, failing the build." + exit 1 + fi + + echo "Scheduled scan found CRITICAL vulnerabilities — attempting an automatic apk upgrade + rescan." + + sed -i '/^FROM .* AS base$/a RUN apk upgrade --no-cache' Dockerfile + docker build -t socat-proxy:remediated . + + if docker run --rm \ + -e DOCKER_HOST=tcp://dockerhost:2375 \ + --add-host=dockerhost:host-gateway \ + aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:remediated; then + echo "apk upgrade clears the CRITICAL finding(s) — opening a PR for review." + + BRANCH="auto/cve-fix-$(date +%Y%m%d)-$(echo "${{ github.sha }}" | cut -c1-7)" + git config user.name "socat-proxy-ci" + git config user.email "ci@git.djeex.fr" + git checkout -b "$BRANCH" + git add Dockerfile + git commit -m "Auto-remediate CRITICAL CVE via apk upgrade" + git config --unset-all http.https://git.djeex.fr/.extraheader || true + git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/socat-proxy.git" "HEAD:$BRANCH" + + PR_JSON=$(curl -s -X POST \ + -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \ + -H "Content-Type: application/json" \ + -d "$(jq -n --arg head "$BRANCH" '{title: "🔒 Auto: remediate CRITICAL CVE via apk upgrade", head: $head, base: "main", body: "Opened automatically by the scheduled CVE scan. An `apk upgrade --no-cache` cleared the CRITICAL Trivy finding(s) in a rebuild — review the diff and merge to publish the fix."}')" \ + "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/pulls") + echo "PR API response: $(echo "$PR_JSON" | jq -r '.html_url // .message // "unknown"')" + else + echo "::error::apk upgrade does not clear the CRITICAL finding(s) — no automatic fix available, needs manual review." + exit 1 + fi + - name: Scan with Trivy (high - informative) run: | docker run --rm \ -- 2.54.0 From 8c53ba4c79ffa5cfb8e3d3cb63222d7ad077f908 Mon Sep 17 00:00:00 2001 From: Djeex Date: Wed, 26 Aug 2026 15:04:28 +0200 Subject: [PATCH 3/3] Publish images to GHCR and releases to the GitHub mirror MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - retag+push the same :latest/:X.Y/:X.Y.Z tags to ghcr.io/djeex/socat-proxy - create a matching GitHub Release on the Djeex/socat-proxy mirror, same changelog body prefixed with a notice pointing back to the git.djeex.fr source repo - targets the exact commit SHA (not the branch) with retries, since the Gitea->GitHub push mirror can lag behind this job - requires a new GH_TOKEN secret (repo + write:packages) — not created yet - first GHCR push per repo will be private by default; GitHub has no API to default it public for a personal account, needs a one-time manual toggle --- .gitea/workflows/ci.yml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 131aac0..c0487a4 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -159,6 +159,16 @@ jobs: docker push "$IMAGE:$MINOR_TAG" docker push "$IMAGE:$VERSION" + GHCR_IMAGE=ghcr.io/djeex/socat-proxy + echo "${{ secrets.GH_TOKEN }}" | docker login ghcr.io -u Djeex --password-stdin + + docker tag socat-proxy:ci "$GHCR_IMAGE:latest" + docker tag socat-proxy:ci "$GHCR_IMAGE:$MINOR_TAG" + docker tag socat-proxy:ci "$GHCR_IMAGE:$VERSION" + docker push "$GHCR_IMAGE:latest" + docker push "$GHCR_IMAGE:$MINOR_TAG" + docker push "$GHCR_IMAGE:$VERSION" + TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}") PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true) @@ -218,3 +228,32 @@ jobs: -H "Content-Type: application/json" \ -d "$JSON_PAYLOAD" \ "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/releases" + + MIRROR_NOTICE="_This github repo is a mirror of https://git.djeex.fr/Djeex/socat-proxy. You'll find full package, PR, history and release note there._" + GH_BODY=$(printf '%s\n\n%s' "$MIRROR_NOTICE" "$BODY") + + GH_JSON_PAYLOAD=$(jq -n \ + --arg tag "$VERSION" \ + --arg name "$VERSION" \ + --arg body "$GH_BODY" \ + --arg sha "${{ github.sha }}" \ + '{tag_name: $tag, name: $name, target_commitish: $sha, body: $body}') + + GH_STATUS=0 + for i in 1 2 3 4 5; do + GH_STATUS=$(curl -s -o /tmp/gh_release.json -w "%{http_code}" -X POST \ + -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \ + -H "Accept: application/vnd.github+json" \ + -H "Content-Type: application/json" \ + -d "$GH_JSON_PAYLOAD" \ + "https://api.github.com/repos/Djeex/socat-proxy/releases") + if [ "$GH_STATUS" = "201" ]; then + break + fi + echo "GitHub Release attempt $i failed (HTTP $GH_STATUS) — mirror may not have synced this commit yet, retrying in 15s..." + sleep 15 + done + echo "GitHub Release API response: $GH_STATUS" + if [ "$GH_STATUS" != "201" ]; then + cat /tmp/gh_release.json 2>/dev/null || true + fi -- 2.54.0