sec-actions

Author	SHA1	Message	Date
t.behrendt	2616391b42	Revert "refactor(setup-db): to run trivy in docker (#54 )" (#56 ) CD / Release (push) Successful in 5s Details This reverts commit `81eda53a59`. Reviewed-on: #56 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>	2026-04-10 19:36:38 +02:00
t.behrendt	81eda53a59	refactor(setup-db): to run trivy in docker (#54 ) CD / Release (push) Successful in 4s Details As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised. Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date. Reviewed-on: #54 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>	2026-04-10 18:43:03 +02:00
renovate-bot	a9ff551b88	chore(deps): update https://gitea.t000-n.de/t.behrendt/actions action to v0.2.1 (#49 ) CD / Release (push) Successful in 1m14s Details This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [https://gitea.t000-n.de/t.behrendt/actions](https://gitea.t000-n.de/t.behrendt/actions) \| action \| minor \| `0.1.5` → `0.2.1` \| --- > ⚠️ Warning > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>t.behrendt/actions (https://gitea.t000-n.de/t.behrendt/actions)</summary> ### [`v0.2.1`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.0...0.2.1) [Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.2.0...0.2.1) ### [`v0.2.0`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.7...0.2.0) [Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.7...0.2.0) ### [`v0.1.7`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.6...0.1.7) [Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.6...0.1.7) ### [`v0.1.6`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.5...0.1.6) [Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.5...0.1.6) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=--> Reviewed-on: t.behrendt/trivy-actions#49 Reviewed-by: t.behrendt <t.behrendt@noreply.localhost> Co-authored-by: Renovate Bot <renovate@t00n.de> Co-committed-by: Renovate Bot <renovate@t00n.de>	2026-03-15 21:52:37 +01:00
renovate-bot	a6508d695d	chore(deps): update https://gitea.t000-n.de/t.behrendt/actions action to v0.1.5 (#47 ) CD / Release (push) Successful in 6s Details This PR contains the following updates: \| Package \| Type \| Update \| Change \| Pending \| \|---\|---\|---\|---\|---\| \| [https://gitea.t000-n.de/t.behrendt/actions](https://gitea.t000-n.de/t.behrendt/actions) \| action \| patch \| `0.1.4` → `0.1.5` \| `0.2.1` (+3) \| --- > ⚠️ Warning > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>t.behrendt/actions (https://gitea.t000-n.de/t.behrendt/actions)</summary> ### [`v0.1.5`](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.4...0.1.5) [Compare Source](https://gitea.t000-n.de/t.behrendt/actions/compare/0.1.4...0.1.5) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=--> Reviewed-on: t.behrendt/trivy-actions#47 Reviewed-by: t.behrendt <t.behrendt@noreply.localhost> Co-authored-by: Renovate Bot <renovate@t00n.de> Co-committed-by: Renovate Bot <renovate@t00n.de>	2026-02-27 19:10:36 +01:00
renovate-bot	6122c9ee30	chore(deps): update https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment action to v0.1.29 (#48 ) CD / Release (push) Successful in 5s Details This PR contains the following updates: \| Package \| Type \| Update \| Change \| \|---\|---\|---\|---\| \| [https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment) \| action \| patch \| `0.1.28` → `0.1.29` \| --- > ⚠️ Warning > > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>t.behrendt/conventional-semantic-git-tag-increment (https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment)</summary> ### [`v0.1.29`](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.28...0.1.29) [Compare Source](https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment/compare/0.1.28...0.1.29) </details> --- ### Configuration 📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjQiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImFjdGlvbiIsImRlcHMiXX0=--> Reviewed-on: t.behrendt/trivy-actions#48 Reviewed-by: t.behrendt <t.behrendt@noreply.localhost> Co-authored-by: Renovate Bot <renovate@t00n.de> Co-committed-by: Renovate Bot <renovate@t00n.de>	2026-02-27 19:09:18 +01:00

2 changed files with 4 additions and 4 deletions

									
										.gitea/workflows/cd.yaml
									
		+2
		-2
	
												View File
												
					@@ -15,10 +15,10 @@ jobs:

					          fetch-depth: 0

					          fetch-depth: 0

					      - name: Increment tag

					      - name: Increment tag

					        id: tag

					        id: tag

					        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28

					        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29

					        with:

					        with:

					          token: ${{ secrets.GITEA_TOKEN }}

					          token: ${{ secrets.GITEA_TOKEN }}

					      - name: Push tag

					      - name: Push tag

					        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4

					        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1

					        with:

					        with:

					          tag: ${{ steps.tag.outputs.new-tag }}

					          tag: ${{ steps.tag.outputs.new-tag }}

									
										.gitea/workflows/prerelease.yaml
									
		+2
		-2
	
												View File
												
					@@ -13,11 +13,11 @@ jobs:

					          fetch-depth: 0

					          fetch-depth: 0

					      - name: Increment tag

					      - name: Increment tag

					        id: tag

					        id: tag

					        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@8d27605e8e6b2990e92e5aa75d703e602b8c4b2a # 0.1.28

					        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29

					        with:

					        with:

					          token: ${{ secrets.GITEA_TOKEN }}

					          token: ${{ secrets.GITEA_TOKEN }}

					          prerelease: true

					          prerelease: true

					      - name: Push tag

					      - name: Push tag

					        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@8973a9f9ff51c16b937364e0047e7ad07e937d3f # 0.1.4

					        uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1

					        with:

					        with:

					          tag: ${{ steps.tag.outputs.new-tag }}

					          tag: ${{ steps.tag.outputs.new-tag }}

Compare commits

5 Commits

db1011147f ... 0.0.2

Compare commits

5 Commits db1011147f ... 0.0.2

5 Commits

db1011147f ... 0.0.2