Merge pull request 'chore(deps): update docker/login-action action to v4.7.0' (#96) from renovate/docker-login-action-4.x into master

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.drone.yml

@@ -1,290 +0,0 @@
----
-kind: pipeline
-type: kubernetes
-name: linter
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: markdown lint
-  commands:
-  - markdownlint *.md
-  image: docker.io/volkerraschek/markdownlint:0.28.1
-  resources:
-    limits:
-      cpu: 50
-      memory: 50M
-
-- name: email-notification
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  image: docker.io/drillster/drone-email:latest
-  resources:
-    limits:
-      cpu: 50
-      memory: 25M
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  event:
-    exclude:
-    - tag
----
-kind: pipeline
-type: docker
-name: latest-amd64
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  image: plugins/docker
-  settings:
-    dockerfile: Dockerfile
-    auto_tag: false
-    tags: latest-amd64
-    repo: volkerraschek/bind9
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-    no_cache: true
-  volumes:
-  - name: docker_socket
-    path: /var/run/docker.sock
-  when:
-    branch:
-    - master
-
-- name: notify
-  image: drillster/drone-email
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  when:
-    status:
-    - changed
-    - failure
-
-volumes:
-- name: docker_socket
-  host:
-    path: /var/run/docker.sock
-
-trigger:
-  event:
-    exclude:
-    - tag
-
----
-kind: pipeline
-type: kubernetes
-name: latest-manifest
-
-steps:
-- name: build-manifest
-  image: plugins/manifest
-  settings:
-    auto_tag: false
-    ignore_missing: true
-    spec: manifest.tmpl
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-
-- name: notify
-  image: docker.io/drillster/drone-email:latest
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  resources:
-    limits:
-      cpu: 50
-      memory: 25M
-  when:
-    status:
-    - changed
-    - failure
-
-depends_on:
-- latest-amd64
-
-trigger:
-  event:
-    exclude:
-    - tag
-
----
-kind: pipeline
-type: docker
-name: tagged-amd64
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  image: plugins/docker
-  settings:
-    dockerfile: Dockerfile
-    auto_tag: true
-    auto_tag_suffix: amd64
-    repo: volkerraschek/bind9
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-    no_cache: true
-  volumes:
-  - name: docker_socket
-    path: /var/run/docker.sock
-
-- name: notify
-  image: drillster/drone-email
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  when:
-    status:
-    - changed
-    - failure
-
-volumes:
-- name: docker_socket
-  host:
-    path: /var/run/docker.sock
-
-trigger:
-  event:
-  - tag
-  repo:
-  - volker.raschek/bind9-docker
-
----
-kind: pipeline
-type: kubernetes
-name: tagged-manifest
-
-steps:
-- name: build-manifest
-  image: plugins/manifest
-  settings:
-    auto_tag: true
-    ignore_missing: true
-    spec: manifest.tmpl
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-
-- name: notify
-  image: docker.io/drillster/drone-email:latest
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  resources:
-    limits:
-      cpu: 50
-      memory: 25M
-  when:
-    status:
-    - changed
-    - failure
-
-depends_on:
-- tagged-amd64
-
-trigger:
-  event:
-  - tag
-  repo:
-  - volker.raschek/bind9-docker
-
----
-kind: pipeline
-type: kubernetes
-name: sync
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: github
-  image: docker.io/appleboy/drone-git-push:latest
-  resources:
-    limits:
-      cpu: 50
-      memory: 25M
-  settings:
-    branch: master
-    remote: ssh://git@github.com/volker-raschek/bind9-docker.git
-    force: true
-    ssh_key:
-      from_secret: ssh_key
-
-- name: email-notification
-  environment:
-    PLUGIN_HOST:
-      from_secret: smtp_host
-    PLUGIN_USERNAME:
-      from_secret: smtp_username
-    PLUGIN_PASSWORD:
-      from_secret: smtp_password
-    PLUGIN_FROM:
-      from_secret: smtp_mail_address
-  image: docker.io/drillster/drone-email:latest
-  resources:
-    limits:
-      cpu: 50
-      memory: 25M
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  event:
-  - push
-  repo:
-  - volker.raschek/bind9-docker

.gitea/workflows/markdown-linters.yaml

@@ -0,0 +1,22 @@
+name: 'Lint Markdown files'
+
+on:
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
+  push:
+    branches:
+    - master
+  workflow_dispatch: {}
+
+jobs:
+  markdown-lint:
+    runs-on:
+    - ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
+      with:
+        globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -0,0 +1,62 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  push-amd64:
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Build and push image
+        run: |
+          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+
+          docker buildx build \
+            --file Dockerfile \
+            --platform linux/amd64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/bind9:${TAG} \
+            .
+
+  sync-to-hub-docker-io:
+    needs:
+    - push-manifest
+    runs-on: ubuntu-latest
+    steps:
+    - name: Copy images to docker.io
+      run: |
+        TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+
+        apt-get update --yes
+        apt-get install --yes skopeo
+        skopeo copy \
+          --all \
+          --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+          --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+          --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+          --src-username volker.raschek \
+            docker://git.cryptic.systems/volker.raschek/bind9:${TAG} \
+            docker://docker.io/volkerraschek/bind9:${TAG}

.gitea/workflows/update-docker-hub-description.yaml

@@ -0,0 +1,22 @@
+name: Update Docker Hub Description
+
+on:
+  push:
+    branches:
+    - master
+    paths:
+    - README.md
+  workflow_dispatch: {}
+
+jobs:
+  update-description-on-hub-docker-io:
+    runs-on:
+    - ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+      with:
+        username: ${{ secrets.DOCKER_IO_USERNAME }}
+        password: ${{ secrets.DOCKER_IO_PASSWORD }}
+        repository: volkerraschek/bind9
+        readme-filepath: README.md

.markdownlint.yaml

@@ -45,19 +45,17 @@ MD012:
 # MD013/line-length - Line length
 MD013:
   # Number of characters
-  line_length: 80
+  line_length: 120
   # Number of characters for headings
-  heading_line_length: 80
+  heading_line_length: 120
   # Number of characters for code blocks
-  code_block_line_length: 80
+  code_block_line_length: 120
   # Include code blocks
   code_blocks: false
   # Include tables
   tables: false
   # Include headings
   headings: true
-  # Include headings
-  headers: true
   # Strict length checking
   strict: false
   # Stern length checking
@@ -70,11 +68,6 @@ MD022:
   # Blank lines below heading
   lines_below: 1
 
-# MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content
-MD024:
-  # Only check sibling headings
-  allow_different_nesting: true
-
 # MD025/single-title/single-h1 - Multiple top-level headings in the same document
 MD025:
   # Heading level
@@ -129,7 +122,6 @@ MD041:
 MD044:
   # List of proper names
   names: []
-  # - some-thing
   # Include code blocks
   code_blocks: false
 
@@ -141,4 +133,4 @@ MD046:
 # MD048/code-fence-style - Code fence style
 MD048:
   # Code fence syle
-  style: "backtick"
+  style: "backtick"

Dockerfile

@@ -4,7 +4,8 @@ RUN pacman \
       --sync \
       --sysupgrade \
       --refresh --noconfirm \
-        bind bind-tools
+        bind bind-tools && \
+    rm --recursive --force /var/cache/pacman/pkg
 
 RUN mkdir --parents /etc/bind/zones /var/log/bind && \
     mv /etc/named.conf /etc/bind/named.conf && \

Makefile

@@ -1,18 +1,17 @@
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a
 # container runtime. This is needed to start and run a container image.
-CONTAINER_RUNTIME?=$(shell which docker)
+CONTAINER_RUNTIME?=$(shell which podman)
 
 # BIND9_IMAGE_REGISTRY_NAME
 # Defines the name of the new container to be built using several variables.
-BIND9_IMAGE_REGISTRY_NAME:=docker.io
-BIND9_IMAGE_REGISTRY_USER:=volkerraschek
+BIND9_IMAGE_REGISTRY_NAME?=git.cryptic.systems
+BIND9_IMAGE_REGISTRY_USER?=volker.raschek
 
 BIND9_IMAGE_NAMESPACE?=${BIND9_IMAGE_REGISTRY_USER}
 BIND9_IMAGE_NAME:=bind9
 BIND9_IMAGE_VERSION?=latest
 BIND9_IMAGE_FULLY_QUALIFIED=${BIND9_IMAGE_REGISTRY_NAME}/${BIND9_IMAGE_NAMESPACE}/${BIND9_IMAGE_NAME}:${BIND9_IMAGE_VERSION}
-BIND9_IMAGE_UNQUALIFIED=${BIND9_IMAGE_NAMESPACE}/${BIND9_IMAGE_NAME}:${BIND9_IMAGE_VERSION}
 
 # BUILD CONTAINER IMAGE
 # ==============================================================================
@@ -23,15 +22,13 @@ container-image/build:
 		--no-cache \
 		--pull \
 		--tag ${BIND9_IMAGE_FULLY_QUALIFIED} \
-		--tag ${BIND9_IMAGE_UNQUALIFIED} \
 		.
 
 # DELETE CONTAINER IMAGE
 # ==============================================================================
 PHONY:=container-image/delete
 container-image/delete:
-	- ${CONTAINER_RUNTIME} image rm ${BIND9_IMAGE_FULLY_QUALIFIED} ${BIND9_IMAGE_UNQUALIFIED}
-	- ${CONTAINER_RUNTIME} image rm ${BASE_IMAGE_FULL}
+	- ${CONTAINER_RUNTIME} image rm ${BIND9_IMAGE_FULLY_QUALIFIED}
 
 # PUSH CONTAINER IMAGE
 # ==============================================================================

README.md

@@ -1,10 +1,9 @@
 # bind9-docker
 
-[![Build Status](https://drone.cryptic.systems/api/badges/volker.raschek/bind9-docker/status.svg)](https://drone.cryptic.systems/volker.raschek/bind9-docker)
 [![Docker Pulls](https://img.shields.io/docker/pulls/volkerraschek/bind9)](https://hub.docker.com/r/volkerraschek/bind9)
 
 This project contains all sources to build the container image
-`docker.io/volkerraschek/bind9`. The primary goal of the image is only
+`git.cryptic.systems/volker.raschek/bind9`. The primary goal of the image is only
 to start a simple bind9 dns server.
 
 The configuration files must be manually mounted into the container.
@@ -20,7 +19,7 @@ docker run \
   --publish 53:53/tcp \
   --publish 53:53/udp \
   --volume <config/path>:/etc/bind \
-  volkerraschek/bind9
+  git.cryptic.systems/volker.raschek/bind9
 ```
 
 ## Build image manually

docker-compose.yml

@@ -1,7 +1,7 @@
 version: "3"
 services:
   bind9:
-    image: volkerraschek/bind9-docker:latest
+    image: git.cryptic.systems/volker.raschek/bind9-docker:latest
     ports:
     - 10053:53/tcp
     - 10053:53/udp

manifest.tmpl

@@ -1,14 +0,0 @@
-image: volkerraschek/bind9:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  - {{this}}
-{{/each}}
-  - "latest"
-{{/if}}
-manifests:
-  -
-    image: volkerraschek/bind9:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-amd64
-    platform:
-      architecture: amd64
-      os: linux

renovate.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>volker.raschek/renovate-config:default#master",
+    "local>volker.raschek/renovate-config:container#master",
+    "local>volker.raschek/renovate-config:actions#master",
+    "local>volker.raschek/renovate-config:regexp#master"
+  ]
+}