Skip to content

v7.0.0 馃寛

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 03:28
· 3 commits to refs/heads/main since this release
v7.0.0
e0d0863
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes

Bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 in /.github/workflows @[dependabot[bot]](https://github.com/apps/dependabot) (#36)

Bumps aquasecurity/trivy-action from 0.33.1 to 0.34.0.

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.34.0

What's Changed

Full Changelog: aquasecurity/trivy-action@0.33.1...0.34.0

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

馃摑 Documentation

馃О mise-fy: tasks, linters, pre-commit hooks, CI + 馃挜 dev HTTPS on :8443 @sherifabdlnaby (#37)

Summary

Adopt mise as the single source of truth for dev tools and tasks, add an hk pre-commit hook running a full recommended linter set, and migrate CI to run that same check. Big-bang: the Makefile is gone, its tasks now live in mise.toml. Also fixes the dev HTTPS server, which never started under the non-root image.

Changes

  • New: mise.toml pins 13 linters/formatters + hk and defines all tasks (the docker-compose wrappers + demo:*, migrated from the Makefile). mise.lock committed.
  • New: hk.pkl pre-commit + CI hook: hadolint, shellcheck, shfmt, dclint, actionlint, zizmor, pinact, taplo, yamllint, typos, betterleaks, lychee, rumdl, plus hygiene checks. Runs hermetically (no GitHub token needed: pinact drops --verify, lychee runs --offline).
  • CI: lint.yml now runs mise run check with a sticky PR comment; all workflow actions pinned to SHAs with scoped permissions and persist-credentials: false; ${{ }} moved out of run: blocks.
  • Breaking: the dev HTTPS endpoint moves from https://localhost:443 to https://localhost:8443. Nginx runs as non-root www-data and cannot bind privileged ports (<1024), so listen 443 failed to start; it now listens on 8443 (published in docker-compose.yml), keeping the dev stack compatible with rootless runtimes (Podman, rootless Docker).
  • Fixed: real typos across Dockerfile/scripts; broken LICENSE/source links (blob/master -> main); docker-compose project name + loopback port binding.
  • Docs: README mise section + make -> mise run; documented the :8443 dev HTTPS endpoint; new AGENTS.md.

[!WARNING]
Breaking for contributors: the Makefile is removed. Install mise (brew install mise), then mise trust && mise run setup. make <x> becomes mise run <x> (run mise tasks to list).

[!WARNING]
Breaking for users: local HTTPS is now https://localhost:8443 (was :443). This PR is labeled major, so the next release is v7.0.0.

Review guide
Start in mise.toml (tools + tasks) and hk.pkl (lint steps), then .github/workflows/lint.yml. The dev HTTPS fix is docker/nginx/dev/dev-https.conf + docker-compose.yml. The 30+ touched files under docker/ are mechanical lint autofixes (final newlines, formatting).

Validation
  • mise install + mise doctor: clean; all 14 tools resolve.
  • mise run check --all: green, exit 0, hermetic (verified with GITHUB_TOKEN/GH_TOKEN unset). All 22 steps pass.
  • actionlint / zizmor / pinact clean on all three workflows.
  • Pre-commit hook fires and passes on each commit.
Design notes
  • dev HTTPS on 8443, not 443: binding 443 would require either running Nginx as root or granting NET_BIND_SERVICE / a host sysctl, all of which fight the non-root, rootless-friendly design. A high port plus a self-signed cert keeps the happy path one command on Docker, rootless Docker, and Podman alike. (Production terminates TLS at the k8s Ingress, not in this image.)
  • pinact without --verify: keeps the security-critical "all actions pinned to SHA" enforcement (still exits non-zero on an unpinned ref) without needing a GitHub API token on every commit. zizmor's unpinned-uses backstops it.
  • lychee --offline: the repo is full of example URLs (localhost:8080, domain.tld, php://input); offline scopes the check to local/relative links so CI isn't network-flaky.
  • Suppressions are intentional, not escape hatches: only the author's name (Sherif) in typos.toml, the self-signed dev cert in .betterleaks.toml, vendored reference.*.ini.dist dumps, and the documented Alpine-unpinned hadolint rules.

馃 Created with Claude (Opus 4.8) on behalf of @sherifabdlnaby

Contributors

sherifabdlnaby
Assets 2
Loading