CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing

Conversation 0 Commits 3 Files Changed 1

+96 -3

3 Commits

Author	SHA1	Message	Date
Djeex	8c53ba4c79	Publish images to GHCR and releases to the GitHub mirror CI / build-and-scan (pull_request) Successful in 57s Details - retag+push the same :latest/:X.Y/:X.Y.Z tags to ghcr.io/djeex/socat-proxy - create a matching GitHub Release on the Djeex/socat-proxy mirror, same changelog body prefixed with a notice pointing back to the git.djeex.fr source repo - targets the exact commit SHA (not the branch) with retries, since the Gitea->GitHub push mirror can lag behind this job - requires a new GH_TOKEN secret (repo + write:packages) — not created yet - first GHCR push per repo will be private by default; GitHub has no API to default it public for a personal account, needs a one-time manual toggle	2026-08-26 15:04:28 +02:00
Djeex	adf4e8c8a3	Add secret scanning, Dockerfile lint, and automatic CVE remediation PRs - gitleaks (via docker cp, dockerignore-agnostic — this repo's own .dockerignore excludes .git, which a build-context COPY would have missed) and hadolint scan every push/PR - scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR if it clears the finding, instead of just failing red - no ruff/pytest-cov here (shell project, already has shellcheck/bats)	2026-08-26 14:49:32 +02:00
Djeex	ada76ac00d	Simplify release changelog: commits as description (link), drop divider lines	2026-08-26 13:54:24 +02:00

Author

SHA1

Message

Date

Djeex

8c53ba4c79

Publish images to GHCR and releases to the GitHub mirror

CI / build-and-scan (pull_request) Successful in 57s

Details

- retag+push the same :latest/:X.Y/:X.Y.Z tags to ghcr.io/djeex/socat-proxy
- create a matching GitHub Release on the Djeex/socat-proxy mirror, same changelog
  body prefixed with a notice pointing back to the git.djeex.fr source repo
- targets the exact commit SHA (not the branch) with retries, since the
  Gitea->GitHub push mirror can lag behind this job
- requires a new GH_TOKEN secret (repo + write:packages) — not created yet
- first GHCR push per repo will be private by default; GitHub has no API to
  default it public for a personal account, needs a one-time manual toggle

2026-08-26 15:04:28 +02:00

Djeex

adf4e8c8a3

Add secret scanning, Dockerfile lint, and automatic CVE remediation PRs

- gitleaks (via docker cp, dockerignore-agnostic — this repo's own
  .dockerignore excludes .git, which a build-context COPY would have missed)
  and hadolint scan every push/PR
- scheduled Trivy critical failures now attempt an apk upgrade rebuild and open
  a PR if it clears the finding, instead of just failing red
- no ruff/pytest-cov here (shell project, already has shellcheck/bats)

2026-08-26 14:49:32 +02:00

Djeex

ada76ac00d

Simplify release changelog: commits as description (link), drop divider lines

2026-08-26 13:54:24 +02:00

CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing #6