diff --git a/.github/workflows/base-images.yml b/.github/workflows/base-images.yml index d0c8e7ac..a9bf872e 100644 --- a/.github/workflows/base-images.yml +++ b/.github/workflows/base-images.yml @@ -22,7 +22,14 @@ jobs: driver: docker - name: Create .env File - run: echo "${{ secrets.ENV_FILE_CONTENT }}" > .env + # Build-only defaults work for Dependabot PRs without deployment secrets. + run: | + cat > .env <<'EOF' + CADDY_LOGS_PATH=./storage/logs/caddy + ENV_HTTP_PORT=8080 + ENV_DOCKER_USER=appuser + ENV_DOCKER_USER_GROUP=appgroup + EOF shell: bash - name: Build Base Images diff --git a/go.mod b/go.mod index b2e6c50a..a7457d30 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/go-playground/validator/v10 v10.30.2 github.com/google/uuid v1.6.0 github.com/joho/godotenv v1.5.1 - github.com/klauspost/compress v1.18.6 + github.com/klauspost/compress v1.18.7 github.com/lib/pq v1.12.3 github.com/prometheus/client_golang v1.23.2 github.com/testcontainers/testcontainers-go v0.42.0 @@ -59,10 +59,10 @@ require ( github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e // indirect github.com/magiconair/properties v1.8.10 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect - github.com/moby/go-archive v0.2.0 // indirect + github.com/moby/go-archive v0.3.0 // indirect github.com/moby/patternmatcher v0.6.1 // indirect - github.com/moby/sys/sequential v0.6.0 // indirect - github.com/moby/sys/user v0.4.0 // indirect + github.com/moby/sys/sequential v0.7.0 // indirect + github.com/moby/sys/user v0.4.1 // indirect github.com/moby/sys/userns v0.1.0 // indirect github.com/moby/term v0.5.2 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/go.sum b/go.sum index 2ad6c3ea..e16101ab 100644 --- a/go.sum +++ b/go.sum @@ -86,8 +86,8 @@ github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/ github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -106,18 +106,18 @@ github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5L github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= -github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8= -github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU= +github.com/moby/go-archive v0.3.0 h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c= +github.com/moby/go-archive v0.3.0/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE= github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg= github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY= github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ= github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U= github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= -github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= -github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= -github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= -github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= +github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8= +github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o= +github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0= +github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y= github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g= github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= diff --git a/infra/docker/base-images/Dockerfile.builder b/infra/docker/base-images/Dockerfile.builder index b7907c7a..bb7a9fc1 100644 --- a/infra/docker/base-images/Dockerfile.builder +++ b/infra/docker/base-images/Dockerfile.builder @@ -37,8 +37,8 @@ COPY checksums/ /tmp/checksums/ # fortify-headers separately (it must be added by path because its virtual # provider name conflicts with the musl-provided headers already present). # 6. Clean up all temporary artifacts. -RUN apk add --no-cache openssl=3.5.7-r0 && \ - target_arch="${TARGETARCH}"; \ +RUN apk add --no-cache openssl=3.5.9-r0 && \ + target_arch="${TARGETARCH}" && \ if [ -z "${target_arch}" ]; then \ case "$(apk --print-arch)" in \ aarch64) target_arch="arm64" ;; \ diff --git a/infra/docker/base-images/Dockerfile.runtime b/infra/docker/base-images/Dockerfile.runtime index 12e51a46..e08723e6 100644 --- a/infra/docker/base-images/Dockerfile.runtime +++ b/infra/docker/base-images/Dockerfile.runtime @@ -30,8 +30,8 @@ COPY checksums/ /tmp/checksums/ # 4. Remove openssl — it is only needed for the signing step and should not # remain in the runtime image. # 5. Clean up all temporary artifacts. -RUN apk add --no-cache openssl=3.5.7-r0 && \ - target_arch="${TARGETARCH}"; \ +RUN apk add --no-cache openssl=3.5.9-r0 && \ + target_arch="${TARGETARCH}" && \ if [ -z "${target_arch}" ]; then \ case "$(apk --print-arch)" in \ aarch64) target_arch="arm64" ;; \ @@ -48,7 +48,7 @@ RUN apk add --no-cache openssl=3.5.7-r0 && \ libsharpyuv-1.6.0-r0.apk \ libwebp-1.6.0-r0.apk \ musl-1.2.5-r23.apk \ - tzdata-2026c-r0.apk \ + tzdata-2026d-r0.apk \ zlib-1.3.2-r0.apk \ ; do \ wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \ @@ -68,6 +68,6 @@ RUN apk add --no-cache openssl=3.5.7-r0 && \ | cat - /tmp/APKINDEX.unsigned.tar.gz \ > "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && \ apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r23 libwebp && \ - apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026c-r0.apk" && \ + apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026d-r0.apk" && \ apk del --no-cache openssl && \ rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub diff --git a/infra/docker/base-images/checksums/runtime-aarch64.sha256 b/infra/docker/base-images/checksums/runtime-aarch64.sha256 index fea807ae..31dcb191 100644 --- a/infra/docker/base-images/checksums/runtime-aarch64.sha256 +++ b/infra/docker/base-images/checksums/runtime-aarch64.sha256 @@ -1,5 +1,5 @@ 5b5009c66c47bd7a49a1b0eb236b526a14b2ed6c0802cb82d41eb6f9ea852a59 libsharpyuv-1.6.0-r0.apk 808eac0eba50a5a7de86e280f4337281eace15a6b10301ee04de3d39f212cfb9 libwebp-1.6.0-r0.apk 6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e musl-1.2.5-r23.apk -b274132e7e9d36985b9d3324c7e2d724b5b70610743b69f7fe5bc9082bd085aa tzdata-2026c-r0.apk +b9421d401a00c7d88503bd22646a5d09df7ba7e34949a5cc009e54de93a1e25f tzdata-2026d-r0.apk ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8 zlib-1.3.2-r0.apk diff --git a/infra/docker/base-images/checksums/runtime-x86_64.sha256 b/infra/docker/base-images/checksums/runtime-x86_64.sha256 index dedb729e..7e77d348 100644 --- a/infra/docker/base-images/checksums/runtime-x86_64.sha256 +++ b/infra/docker/base-images/checksums/runtime-x86_64.sha256 @@ -1,5 +1,5 @@ 68b1787f41c36e7b6d9def855c5663f2f1ab62fbcc599d38ce3487e75fc883ec libsharpyuv-1.6.0-r0.apk 4d5303958ee38a978501c330c23b62ef98993ae3c30afcd62444723f33da2477 libwebp-1.6.0-r0.apk 4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d musl-1.2.5-r23.apk -50fbca92f9e6c5d003a291587c67b7bd9c084cb54d1b0b0f04e0ac5715b5ab72 tzdata-2026c-r0.apk +4967fbaa3919df716ec7a21c2a0465479425b34a99d5165b80fc3d677ed34ee8 tzdata-2026d-r0.apk f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56 zlib-1.3.2-r0.apk diff --git a/infra/docker/base-images/generate-checksums.sh b/infra/docker/base-images/generate-checksums.sh index cf7d04b3..ee194c60 100755 --- a/infra/docker/base-images/generate-checksums.sh +++ b/infra/docker/base-images/generate-checksums.sh @@ -57,7 +57,7 @@ RUNTIME_PACKAGES=( libsharpyuv-1.6.0-r0.apk libwebp-1.6.0-r0.apk musl-1.2.5-r23.apk - tzdata-2026c-r0.apk + tzdata-2026d-r0.apk zlib-1.3.2-r0.apk ) diff --git a/infra/makefile/build.mk b/infra/makefile/build.mk index 10120432..3fb5efda 100644 --- a/infra/makefile/build.mk +++ b/infra/makefile/build.mk @@ -3,7 +3,7 @@ BUILD_VERSION ?= latest BASE_GO_VERSION ?= 1.26.3 BASE_ALPINE_VERSION ?= 3.23 -BASE_IMAGE_REVISION ?= 5 +BASE_IMAGE_REVISION ?= 6 BASE_GO_IMAGE_VARIANT ?= alpine$(BASE_ALPINE_VERSION) BASE_GO_IMAGE_DIGEST ?= sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d BASE_ALPINE_IMAGE_DIGEST ?= sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11