chore(deps): update tonistiigi/binfmt docker tag to v10.2.3

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.gitea/workflows/build.yaml

@@ -15,9 +15,19 @@ jobs:
   build-arch-linux:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
     - name: Build image
       run: |
@@ -31,9 +41,19 @@ jobs:
   build-rocky-linux-8:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
     - name: Build image
       run: |
@@ -47,9 +67,19 @@ jobs:
   build-rocky-linux-9:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
     - name: Build image
       run: |

.gitea/workflows/markdown-linters.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: DavidAnson/markdownlint-cli2-action@v20.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -9,16 +9,26 @@ jobs:
   push-arch-linux:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: docker/login-action@v3.5.0
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: git.cryptic.systems
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
     - name: Build and push image
       run: |
         TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
@@ -32,16 +42,26 @@ jobs:
   push-rocky-linux-8:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: docker/login-action@v3.5.0
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: git.cryptic.systems
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
     - name: Build and push image
       run: |
         TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
@@ -55,16 +75,26 @@ jobs:
   push-rocky-linux-9:
     runs-on: ubuntu-latest-amd64
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: docker/setup-qemu-action@v3.6.0
-    - uses: docker/setup-buildx-action@v3.11.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - uses: docker/login-action@v3.5.0
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         registry: git.cryptic.systems
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: harbor.cryptic.systems
+        username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+        password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+    - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+      with:
+        image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
     - name: Build and push image
       run: |
         TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')

.gitea/workflows/update-docker-hub-description.yaml

@@ -13,8 +13,8 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.3.0
-    - uses: peter-evans/dockerhub-description@v4.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

Dockerfile.archlinux

@@ -12,6 +12,7 @@ RUN pacman --sync --sysupgrade --refresh --noconfirm && \
       python-boto3 \
       python-botocore \
       python-setuptools \
+      python-passlib \
       python-pip \
       python-pytest \
       python-yaml \

Dockerfile.rockylinux8

@@ -17,7 +17,7 @@ RUN dnf update --assumeyes && \
 RUN alternatives --set python3 /usr/bin/python3.12 && \
     curl --fail --silent --location https://bootstrap.pypa.io/get-pip.py --output get-pip.py && \
     python3 get-pip.py && \
-    pip install ansible-lint boto3
+    pip install ansible-lint boto3 passlib
 
 # Create default ansible inventory file
 RUN mkdir --parents /etc/ansible

Dockerfile.rockylinux9

@@ -15,7 +15,7 @@ RUN dnf update --assumeyes && \
 RUN ln --symbolic --force /usr/bin/python3.12 /usr/bin/python3 && \
     curl --fail --silent --location https://bootstrap.pypa.io/get-pip.py --output get-pip.py && \
     python3 get-pip.py && \
-    pip install ansible-lint boto3
+    pip install ansible-lint boto3 passlib
 
 # Create default ansible inventory file
 RUN mkdir --parents /etc/ansible