chore(deps): update actions/checkout action to v6.1.0

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.drone.yml

@@ -1,307 +0,0 @@
----
-kind: pipeline
-type: kubernetes
-name: linter
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: markdown lint
-  commands:
-  - markdownlint *.md
-  image: docker.io/volkerraschek/markdownlint:0.33.0
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  event:
-    exclude:
-    - tag
-
----
-kind: pipeline
-type: docker
-name: dry-run-amd64
-
-depends_on:
-- linter
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  image: docker.io/plugins/docker:latest
-  settings:
-    dockerfile: Dockerfile
-    auto_tag: false
-    dry_run: true
-    tags: latest-amd64
-    repo: volkerraschek/build-image
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-    no_cache: true
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  branch:
-    exclude:
-    - master
-  event:
-  - pull_request
-  - push
-  repo:
-  - volker.raschek/build-image
-
----
-kind: pipeline
-type: docker
-name: latest-amd64
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  image: docker.io/plugins/docker:latest
-  settings:
-    dockerfile: Dockerfile
-    auto_tag: false
-    tags: latest-amd64
-    repo: volkerraschek/build-image
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-    no_cache: true
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  when:
-    status:
-    - changed
-    - failure
-
-depends_on:
-- linter
-
-trigger:
-  branch:
-  - master
-  event:
-  - cron
-  - push
-  repo:
-  - volker.raschek/build-image
-
----
-kind: pipeline
-type: kubernetes
-name: latest-manifest
-
-depends_on:
-- latest-amd64
-
-steps:
-- name: build-manifest
-  image: docker.io/plugins/manifest:latest
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-  settings:
-    auto_tag: false
-    ignore_missing: true
-    spec: manifest.tmpl
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  branch:
-  - master
-  event:
-  - cron
-  - push
-  repo:
-  - volker.raschek/build-image
-
----
-kind: pipeline
-type: docker
-name: tagged-amd64
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  image: docker.io/plugins/docker:latest
-  settings:
-    dockerfile: Dockerfile
-    auto_tag: true
-    auto_tag_suffix: amd64
-    repo: volkerraschek/build-image
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-    no_cache: true
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  when:
-    status:
-    - changed
-    - failure
-
-trigger:
-  event:
-  - tag
-  repo:
-  - volker.raschek/build-image
-
----
-kind: pipeline
-type: kubernetes
-name: tagged-manifest
-
-steps:
-- name: build-manifest
-  image: docker.io/plugins/manifest:latest
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-  settings:
-    auto_tag: true
-    ignore_missing: true
-    spec: manifest.tmpl
-    username:
-      from_secret: container_image_registry_user
-    password:
-      from_secret: container_image_registry_password
-
-- name: email-notification
-  environment:
-    SMTP_FROM_ADDRESS:
-      from_secret: smtp_from_address
-    SMTP_FROM_NAME:
-      from_secret: smtp_from_name
-    SMTP_HOST:
-      from_secret: smtp_host
-    SMTP_USERNAME:
-      from_secret: smtp_username
-    SMTP_PASSWORD:
-      from_secret: smtp_password
-  image: docker.io/volkerraschek/drone-email:0.1.1
-  resources:
-    limits:
-      cpu: 150
-      memory: 150M
-  when:
-    status:
-    - changed
-    - failure
-
-depends_on:
-- tagged-amd64
-
-trigger:
-  event:
-  - tag
-  repo:
-  - volker.raschek/build-image

.gitea/workflows/markdown-linters.yaml

@@ -0,0 +1,22 @@
+name: 'Lint Markdown files'
+
+on:
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
+  push:
+    branches:
+    - master
+  workflow_dispatch: {}
+
+jobs:
+  markdown-lint:
+    runs-on:
+    - ubuntu-latest
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
+      with:
+        globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -0,0 +1,62 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  push-amd64:
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Build and push image
+        run: |
+          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+
+          docker buildx build \
+            --file Dockerfile \
+            --platform linux/amd64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/build-image:${TAG} \
+            .
+
+  sync-to-hub-docker-io:
+    needs:
+    - push-manifest
+    runs-on: ubuntu-latest
+    steps:
+    - name: Copy images to docker.io
+      run: |
+        TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+
+        apt-get update --yes
+        apt-get install --yes skopeo
+        skopeo copy \
+          --all \
+          --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+          --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+          --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+          --src-username volker.raschek \
+            docker://git.cryptic.systems/volker.raschek/build-image:${TAG} \
+            docker://docker.io/volkerraschek/build-image:${TAG}

.gitea/workflows/update-docker-hub-description.yaml

@@ -0,0 +1,22 @@
+name: Update Docker Hub Description
+
+on:
+  push:
+    branches:
+    - master
+    paths:
+    - README.md
+  workflow_dispatch: {}
+
+jobs:
+  update-description-on-hub-docker-io:
+    runs-on:
+    - ubuntu-latest
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+      with:
+        username: ${{ secrets.DOCKER_IO_USERNAME }}
+        password: ${{ secrets.DOCKER_IO_PASSWORD }}
+        repository: volkerraschek/build-image
+        readme-filepath: README.md

.markdownlint.yaml

@@ -45,19 +45,17 @@ MD012:
 # MD013/line-length - Line length
 MD013:
   # Number of characters
-  line_length: 80
+  line_length: 120
   # Number of characters for headings
-  heading_line_length: 80
+  heading_line_length: 120
   # Number of characters for code blocks
-  code_block_line_length: 80
+  code_block_line_length: 120
   # Include code blocks
   code_blocks: false
   # Include tables
   tables: false
   # Include headings
   headings: true
-  # Include headings
-  headers: true
   # Strict length checking
   strict: false
   # Stern length checking
@@ -70,10 +68,8 @@ MD022:
   # Blank lines below heading
   lines_below: 1
 
-# MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content
 MD024:
-  # Only check sibling headings
-  allow_different_nesting: true
+  siblings_only: true
 
 # MD025/single-title/single-h1 - Multiple top-level headings in the same document
 MD025:
@@ -129,7 +125,6 @@ MD041:
 MD044:
   # List of proper names
   names: []
-  # - some-thing
   # Include code blocks
   code_blocks: false
 

Dockerfile

@@ -43,7 +43,8 @@ RUN sudo pacman --sync --refresh --noconfirm --sysupgrade \
       oracle-instantclient-sdk \
       oracle-instantclient-sqlplus \
       oracle-instantclient-tools \
-      rpm-builder
+      rpm-builder && \
+    sudo rm --recursive --force /var/cache/pacman/pkg
 
 RUN sudo mkdir /workspace && sudo chown ${BUILD_USER}:${BUILD_USER} /workspace
 WORKDIR /workspace

Makefile

@@ -5,13 +5,18 @@ CONTAINER_RUNTIME?=$(shell which podman)
 
 # CONTAINER_IMAGE
 # Defines the name of the new container to be built using several variables.
-BUILD_IMAGE_REGISTRY_HOST:=docker.io
-BUILD_IMAGE_REGISTRY_USER:=volkerraschek
+BUILD_IMAGE_REGISTRY_HOST?=git.cryptic.systems
+BUILD_IMAGE_REGISTRY_USER?=volker.raschek
 BUILD_IMAGE_NAMESPACE?=${BUILD_IMAGE_REGISTRY_USER}
 BUILD_IMAGE_REPOSITORY:=build-image
 BUILD_IMAGE_VERSION?=latest
 BUILD_IMAGE_FULLY_QUALIFIED=${BUILD_IMAGE_REGISTRY_HOST}/${BUILD_IMAGE_NAMESPACE}/${BUILD_IMAGE_REPOSITORY}:${BUILD_IMAGE_VERSION}
-BUILD_IMAGE_UNQUALIFIED=${BUILD_IMAGE_NAMESPACE}/${BUILD_IMAGE_REPOSITORY}:${BUILD_IMAGE_VERSION}
+
+# MARKDOWNLINT_IMAGE
+MARKDOWNLINT_IMAGE_REGISTRY_HOST?=git.cryptic.systems
+MARKDOWNLINT_IMAGE_REPOSITORY?=volker.raschek/markdownlint
+MARKDOWNLINT_IMAGE_VERSION?=0.43.0 # renovate: datasource=docker registryUrl=https://git.cryptic.systems depName=volker.raschek/markdownlint
+MARKDOWNLINT_IMAGE_FULLY_QUALIFIED=${MARKDOWNLINT_IMAGE_REGISTRY_HOST}/${MARKDOWNLINT_IMAGE_REPOSITORY}:${MARKDOWNLINT_IMAGE_VERSION}
 
 # BUILD CONTAINER IMAGE
 # ==============================================================================
@@ -22,15 +27,13 @@ container-image/build:
 		--no-cache \
 		--pull \
 		--tag ${BUILD_IMAGE_FULLY_QUALIFIED} \
-		--tag ${BUILD_IMAGE_UNQUALIFIED} \
 		.
 
 # DELETE CONTAINER IMAGE
 # ==============================================================================
 PHONY:=container-image/delete
 container-image/delete:
-	- ${CONTAINER_RUNTIME} image rm ${BUILD_IMAGE_FULLY_QUALIFIED} ${BUILD_IMAGE_UNQUALIFIED}
-	- ${CONTAINER_RUNTIME} image rm ${BASE_IMAGE_FULLY_QUALIFIED}
+	- ${CONTAINER_RUNTIME} image rm ${BUILD_IMAGE_FULLY_QUALIFIED}
 
 # PUSH CONTAINER IMAGE
 # ==============================================================================
@@ -39,6 +42,16 @@ container-image/push:
 	echo ${BUILD_IMAGE_REGISTRY_PASSWORD} | ${CONTAINER_RUNTIME} login ${BUILD_IMAGE_REGISTRY_HOST} --username ${BUILD_IMAGE_REGISTRY_USER} --password-stdin
 	${CONTAINER_RUNTIME} push ${BUILD_IMAGE_FULLY_QUALIFIED}
 
+# CONTAINER RUN - MARKDOWN-LINT
+# ==============================================================================
+PHONY+=container-run/markdown-lint
+container-run/markdown-lint:
+	${CONTAINER_RUNTIME} run \
+		--rm \
+		--volume $(shell pwd):/work \
+		${MARKDOWNLINT_IMAGE_FULLY_QUALIFIED} \
+			*.md
+
 # PHONY
 # ==============================================================================
 # Declare the contents of the PHONY variable as phony.  We keep that information

README.md

@@ -1,11 +1,9 @@
 # build-image
 
-[![Build Status](https://drone.cryptic.systems/api/badges/volker.raschek/build-image/status.svg)](https://drone.cryptic.systems/volker.raschek/build-image)
 [![Docker Pulls](https://img.shields.io/docker/pulls/volkerraschek/build-image)](https://hub.docker.com/r/volkerraschek/build-image)
 
-This project contains all sources to build the container image
-`docker.io/volkerraschek/build-image`. The primary goal of the image is only to
-provide an environment to compile source code for `go` or `rust` and package
+This project contains all sources to build the container image `git.cryptic.systems/volker.raschek/build-image`. The
+primary goal of the image is only to provide an environment to compile source code for `go` or `rust` and package
 compiled binaries as PKG for Arch Linux or as RPM for RHEL based distributions.
 
 ## Supported environment variables
@@ -14,8 +12,8 @@ compiled binaries as PKG for Arch Linux or as RPM for RHEL based distributions.
 
 #### GNUPG_KEY
 
-Import private gpg key via `GPG_KEY`. The private key must be escaped to import
-the key inside the container image correctly. For example:
+Import private gpg key via `GPG_KEY`. The private key must be escaped to import the key inside the container image
+correctly. For example:
 
 ```bash
 GPG_FPR=YOUR_GPG_FINGERPRINT
@@ -24,8 +22,8 @@ GPG_KEY=$(gpg --armor --export-secret-keys ${GPG_FPR} | cat -e | sed -e 's/\$/\\
 
 ### makepkg
 
-The `makepkg.conf` configuration is composed from the environment variables with
-the prefix `MAKEPKG_`. Below are some examples:
+The `makepkg.conf` configuration is composed from the environment variables with the prefix `MAKEPKG_`. Below are some
+examples:
 
 `MAKEPKG_PACKAGER="Hugo McKinnock <hugo.mckinnock@example.local>"`
 `MAKEPKG_GPGKEY="0123456789"`
@@ -35,8 +33,8 @@ the prefix `MAKEPKG_`. Below are some examples:
 
 #### SSH_KEY
 
-Import private ssh key via `SSH_KEY`. The private key must be escaped to import
-the key inside the container image correctly. For example:
+Import private ssh key via `SSH_KEY`. The private key must be escaped to import the key inside the container image
+correctly. For example:
 
 ```bash
 SSH_KEY=$(cat -e ${HOME}/.ssh/id_rsa | sed -e 's/\$/\\n/g')
@@ -46,41 +44,38 @@ SSH_KEY=$(cat -e ${HOME}/.ssh/id_rsa | sed -e 's/\$/\\n/g')
 
 ### golang
 
-To use this image for building golang applications execute this in your root
-folder of your go project.
+To use this image for building golang applications execute this in your root folder of your go project.
 
 ```bash
 $ docker run \
     --rm \
     --volume ${PWD}:/workspace \
-    volkerraschek/build-image:latest \
+    git.cryptic.systems/volker.raschek/build-image:latest \
       go build
 ```
 
 ### makepkg
 
-With the following example will be an package be build for Arch Linux. Execute
-the commond in the root directory of the project, where the `PKGBUILD` file is
-located.
+With the following example will be an package be build for Arch Linux. Execute the commond in the root directory of the
+project, where the `PKGBUILD` file is located.
 
 ```bash
 $ docker run \
     --env MAKEPKG_PACKAGER="Max Mustermann <max.mustermann@example.com" \
     --rm \
     --volume ${PWD}:/workspace \
-    volkerraschek/build-image:latest \
+    git.cryptic.systems/volker.raschek/build-image:latest \
       makepkg
 ```
 
 ### rust
 
-If you want to compile instead go rust sourcecode, than you can do it similar to
-the golang example.
+If you want to compile instead go rust sourcecode, than you can do it similar to the golang example.
 
 ```bash
 $ docker run \
     --rm \
     --volume ${PWD}:/workspace \
-    volkerraschek/build-image:latest \
+    git.cryptic.systems/volker.raschek/build-image:latest \
       cargo build --release
 ```

manifest.tmpl

@@ -1,14 +0,0 @@
-image: volkerraschek/build-image:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  - {{this}}
-{{/each}}
-  - "latest"
-{{/if}}
-manifests:
-  -
-    image: volkerraschek/build-image:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-amd64
-    platform:
-      architecture: amd64
-      os: linux

renovate.json

@@ -1,17 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "assignees": [ "volker.raschek" ],
-  "automergeStrategy": "merge-commit",
-  "automergeType": "pr",
-  "labels": [ "renovate" ],
-  "packageRules": [
-    {
-      "addLabels": [ "renovate/droneci", "renovate/automerge" ],
-      "automerge": true,
-      "matchManagers": "droneci",
-      "matchUpdateTypes": [ "minor", "patch"]
-    }
-  ],
-  "rebaseLabel": "renovate/rebase",
-  "rebaseWhen": "behind-base-branch"
+  "extends": [
+    "local>volker.raschek/renovate-config:default#master",
+    "local>volker.raschek/renovate-config:container#master",
+    "local>volker.raschek/renovate-config:actions#master",
+    "local>volker.raschek/renovate-config:regexp#master"
+  ]
 }