chore(deps): pin dependencies

This reverts commit fa51e930e0.

.gitea/workflows/artifacthub-metadata.yaml

@@ -0,0 +1,41 @@
+name: Upload ArtifactHub Metadata
+
+on:
+  schedule:
+    - cron: '0 3 1 * *'
+  workflow_dispatch:
+
+jobs:
+  upload-metadata:
+    name: "Upload artifacthub-repo.yml to OCI registry"
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      with:
+        registry: ${{ github.server_url }}
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+    - uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
+      with:
+        version: 1.3.2 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
+    - name: Extract meta information
+      run: |
+        echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV
+        echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+        echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV
+        echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 1)" >> $GITHUB_ENV
+    - name: Push artifacthub-repo.yml
+      run: |
+        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:artifacthub.io \
+          --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
+          artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
+    - name: Push public cosign key
+      env:
+        COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }}
+      run: |
+        echo "${COSIGN_PUBLIC_KEY}" > cosign.pub
+        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:cosign.pub \
+          --artifact-type application/vnd.dev.cosign.public-key.v1 \
+          --annotation org.opencontainers.image.title=cosign.pub \
+          cosign.pub:application/vnd.dev.cosign.public-key.v1

.gitea/workflows/auto-release.yaml

@@ -1,10 +1,10 @@
-name: Auto release
+name: Auto release tagged
 
 on:
   push:
     branches: [ "master" ]
     paths:
-    - Makefile
+    - Dockerfile
 
 env:
   GIT_EMAIL: noreply@cryptic.systems
@@ -13,10 +13,12 @@ env:
 jobs:
   tag_on_change:
     permissions:
+      actions: write
       contents: write
+
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
@@ -25,8 +27,8 @@ jobs:
         run: |
           echo "changed=false" >> $GITHUB_OUTPUT
 
-          for file in Makefile; do
-            if git diff HEAD~1 HEAD -- "${file}" | grep --quiet '^[+-]DC_VERSION'; then
+          for file in Dockerfile; do
+            if git diff HEAD~1 HEAD -- "${file}" | grep --quiet '^[+-]ARG DC_VERSION'; then
               echo "DC_VERSION line changed."
               echo "changed=true" >> $GITHUB_OUTPUT
               break
@@ -37,44 +39,35 @@ jobs:
         if: steps.check_change.outputs.changed == 'false'
         run: echo "No DC_VERSION change. Exiting..."
 
-      - name: Get latest tag
-        if: steps.check_change.outputs.changed == 'true'
-        id: get_tag
-        run: |
-          latest_tag=$(git tag --sort=-v:refname | grep --extended-regexp '^v[0-9]+\.[0-9]+\.[0-9]+$' | head --lines 1 || echo "0.0.0")
-          echo "latest_tag=$latest_tag" >> $GITHUB_OUTPUT
-          echo "Latest tag: $latest_tag"
-
-
-      - name: Increment patch version
-        if: steps.check_change.outputs.changed == 'true'
-        id: bump
-        run: |
-          latest_tag=${{ steps.get_tag.outputs.latest_tag }}
-          IFS='.' read -r major minor patch <<< "$latest_tag"
-          patch=$((patch + 1))
-          new_tag="${major}.${minor}.${patch}"
-          echo "new_tag=$new_tag" >> $GITHUB_OUTPUT
-          echo "New tag: $new_tag"
-
       - name: Create and push new tag
+        id: create_tag
         if: steps.check_change.outputs.changed == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          new_tag=${{ steps.bump.outputs.new_tag }}
+          defined_tag="$(grep --only-matching --perl-regexp 'ARG DC_VERSION=v?[\d]*(\.[\d]*){0,2}' Dockerfile | head --lines 1 | cut --delimiter='=' --fields=2)"
+
+          echo "defined_tag=${defined_tag}" >> $GITHUB_OUTPUT
+          echo "New tag: ${defined_tag}"
+
           git config --local user.name "${GIT_USER}"
           git config --local user.email "${GIT_EMAIL}"
-          git tag -a "${new_tag}" -m "${new_tag}"
-          git push origin "${new_tag}"
+          git tag -a "${defined_tag}" -m "${defined_tag}"
+          git push origin "${defined_tag}"
 
       - name: Trigger "Push tagged images" workflow
         if: steps.check_change.outputs.changed == 'true'
-        uses: peter-evans/repository-dispatch@v4.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          event-type: push-tagged-images
-          client-payload: |
-            {
-              "tag": "${{ steps.bump.outputs.new_tag }}"
-            }
+          script: |
+            const workflowFileName = 'release-tagged.yaml';
+            const defaultBranch = context.payload.repository.default_branch;
+            const definedTag = '${{ steps.create_tag.outputs.defined_tag }}';
+
+            await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowFileName,
+                ref: defaultBranch,
+                inputs: {
+                  tag: definedTag
+                }
+            });

.gitea/workflows/build.yaml

@@ -3,21 +3,18 @@ name: Build
 on:
   pull_request:
     types:
-    - "opened"
-    - "reopened"
-    - "synchronize"
-  push:
-    branches:
-    - master
+    - opened
+    - reopened
+    - synchronize
   workflow_dispatch: {}
 
 jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v5.0.0
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |
@@ -33,9 +30,9 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v5.0.0
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -15,7 +15,7 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5.0.0
-    - uses: DavidAnson/markdownlint-cli2-action@v19.1.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release-latest.yaml

@@ -0,0 +1,95 @@
+name: Release latest
+
+on:
+  push:
+    branches: [ "master" ]
+  workflow_dispatch: {}
+
+jobs:
+  push-arm64:
+    runs-on: ubuntu-latest-arm64
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --file Dockerfile \
+            --platform linux/arm64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-arm64 \
+            .
+
+  push-amd64:
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --file Dockerfile \
+            --platform linux/amd64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
+            .
+
+  push-manifest:
+    runs-on: ubuntu-latest
+    needs:
+    - push-arm64
+    - push-amd64
+    steps:
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Create and push manifest
+        run: |
+          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:latest \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-arm64
+
+          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:latest
+
+  sync-to-hub-docker-io:
+    needs:
+    - push-manifest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Copy images to docker.io
+        run: |
+          apt-get update --yes
+          apt-get install --yes skopeo
+          skopeo copy \
+            --all \
+            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+            --src-username volker.raschek \
+              docker://git.cryptic.systems/volker.raschek/docker-compose:latest \
+              docker://docker.io/volkerraschek/docker-compose:latest

.gitea/workflows/release-tagged.yaml

@@ -0,0 +1,157 @@
+name: Release tagged
+
+on:
+  push:
+    tags:
+    - "**"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag which should be released"
+        type: string
+        required: true
+
+jobs:
+  push-arm64:
+    runs-on: ubuntu-latest-arm64
+    steps:
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
+
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-tags: true
+          ref: "${{ steps.version_extraction.outputs.version_raw }}"
+
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
+            --file Dockerfile \
+            --platform linux/arm64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-arm64 \
+            .
+
+  push-amd64:
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
+
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-tags: true
+          ref: "${{ steps.version_extraction.outputs.version_raw }}"
+
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
+            --file Dockerfile \
+            --platform linux/amd64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
+            .
+
+  push-manifest:
+    runs-on: ubuntu-latest
+    needs:
+    - push-arm64
+    - push-amd64
+    steps:
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
+
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Create and push manifest
+        run: |
+          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }} \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-arm64
+
+          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}
+
+  sync-to-hub-docker-io:
+    needs:
+    - push-manifest
+    runs-on: ubuntu-latest
+    steps:
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
+
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - name: Copy images to docker.io
+        run: |
+          apt-get update --yes
+          apt-get install --yes skopeo
+          skopeo copy \
+            --all \
+            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+            --src-username volker.raschek \
+              docker://git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }} \
+              docker://docker.io/volkerraschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}

.gitea/workflows/release.yaml

@@ -1,135 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-    - "**"
-  repository_dispatch:
-    types: [ push-tagged-images ]
-
-jobs:
-  push-arm64:
-    runs-on: ubuntu-latest-arm64
-    steps:
-      - id: version_extraction
-        name: Extract git tag
-        run: |
-          VERSION="${{ github.event.client_payload.tag || github.ref_name }}"
-          VERSION="${VERSION#refs/*/}"
-          echo "Version: ${VERSION}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - uses: actions/checkout@v5.0.0
-        with:
-          fetch-tags: true
-          ref: "${{ steps.version_extraction.outputs.version }}"
-
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.1
-
-      - uses: docker/login-action@v3.6.0
-        with:
-          registry: git.cryptic.systems
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
-
-      - name: Build and push image
-        run: |
-          docker buildx build \
-            --platform linux/arm64 \
-            --file Dockerfile \
-            --provenance false \
-            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }}-arm64 \
-            --push \
-            .
-
-  push-amd64:
-    runs-on: ubuntu-latest-amd64
-    steps:
-      - id: version_extraction
-        name: Extract git tag
-        run: |
-          VERSION="${{ github.event.client_payload.tag || github.ref_name }}"
-          VERSION="${VERSION#refs/*/}"
-          echo "Version: ${VERSION}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - uses: actions/checkout@v5.0.0
-        with:
-          fetch-tags: true
-          ref: "${{ steps.version_extraction.outputs.version }}"
-
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.1
-
-      - uses: docker/login-action@v3.6.0
-        with:
-          registry: git.cryptic.systems
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
-
-      - name: Build and push image
-        run: |
-          docker buildx build \
-            --platform linux/amd64 \
-            --file Dockerfile \
-            --provenance false \
-            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }}-amd64 \
-            --push \
-            .
-
-  push-manifest:
-    runs-on: ubuntu-latest
-    needs:
-    - push-arm64
-    - push-amd64
-    steps:
-      - id: version_extraction
-        name: Extract git tag
-        run: |
-          VERSION="${{ github.event.client_payload.tag || github.ref_name }}"
-          VERSION="${VERSION#refs/*/}"
-          echo "Version: ${VERSION}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - uses: docker/login-action@v3.6.0
-        with:
-          registry: git.cryptic.systems
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
-
-      - name: Create and push manifest
-        run: |
-          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }} \
-            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }}-amd64 \
-            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }}-arm64
-
-          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }}
-
-  sync-to-hub-docker-io:
-    needs:
-    - push-manifest
-    runs-on: ubuntu-latest
-    steps:
-      - id: version_extraction
-        name: Extract git tag
-        run: |
-          VERSION="${{ github.event.client_payload.tag || github.ref_name }}"
-          VERSION="${VERSION#refs/*/}"
-          echo "Version: ${VERSION}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Copy images to docker.io
-        run: |
-          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
-
-          apt-get update --yes
-          apt-get install --yes skopeo
-          skopeo copy \
-            --all \
-            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
-            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
-            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
-            --src-username volker.raschek \
-              docker://git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version }} \
-              docker://docker.io/volkerraschek/docker-compose:${{ steps.version_extraction.outputs.version }}

.gitea/workflows/update-docker-hub-description.yaml

@@ -10,11 +10,10 @@ on:
 
 jobs:
   update-description-on-hub-docker-io:
-    runs-on:
-    - ubuntu-latest
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5.0.0
-    - uses: peter-evans/dockerhub-description@v5.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

Dockerfile

@@ -1,21 +1,31 @@
-FROM docker.io/library/golang:1.25.3-alpine3.21 AS build
+FROM docker.io/library/ubuntu:26.04 AS download
 
-ARG DC_VERSION=main
-ARG GONOSUMDB
-ARG GOPRIVATE
-ARG GOPROXY
+ARG DC_VERSION=v5.1.4
 
-RUN set -ex && \
-    apk update && \
-    apk upgrade && \
-    apk add git make
+RUN NAME=docker-compose-$(uname | tr [:upper:] [:lower:])-$(uname -m); \
+    apt update --yes && \
+    apt install --yes curl && \
+    curl \
+      --fail \
+      --output "/tmp/${NAME}" \
+      --location "https://github.com/docker/compose/releases/download/${DC_VERSION}/${NAME}" && \
+    curl \
+      --fail \
+      --output /tmp/checksums.txt \
+      --location "https://github.com/docker/compose/releases/download/${DC_VERSION}/checksums.txt" && \
+    (cd /tmp && sha256sum --ignore-missing --check checksums.txt) && \
+    ln -s "${NAME}" /tmp/docker-compose && \
+    chmod +x /tmp/docker-compose
 
-RUN git clone https://github.com/docker/compose.git --branch ${DC_VERSION} docker-compose && \
-    cd docker-compose && \
-    make DESTDIR=/cache
+FROM scratch
 
-FROM docker.io/library/alpine:3.22
+ARG DC_VERSION=v5.1.4
+ARG BUILD_DATE
 
-COPY --from=build /cache/docker-compose /usr/bin/docker-compose
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/docker/compose/refs/tags/${DC_VERSION}/README.md" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.description="Define and run multi-container applications with Docker" \
+      org.opencontainers.image.version=${DC_VERSION}
 
+COPY --from=download /tmp/docker-compose /usr/bin/docker-compose
 ENTRYPOINT [ "/usr/bin/docker-compose" ]

Makefile

@@ -1,7 +1,3 @@
-# DC_VERSION
-# Only required to install a specify version
-DC_VERSION?=v2.40.0 # renovate: datasource=github-releases depName=docker/compose
-
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a container runtime. This is needed to start and
 # run a container image.
@@ -17,20 +13,12 @@ DC_IMAGE_NAME:=docker-compose
 DC_IMAGE_VERSION?=latest
 DC_IMAGE_FULLY_QUALIFIED=${DC_IMAGE_REGISTRY_NAME}/${DC_IMAGE_NAMESPACE}/${DC_IMAGE_NAME}:${DC_IMAGE_VERSION}
 
-# Golang related environment variables
-GONOSUMDB?=
-GOPRIVATE?=
-GOPROXY?=
-
 # BUILD CONTAINER IMAGE
 # =====================================================================================================================
 PHONY:=container-image/build
 container-image/build:
 	${CONTAINER_RUNTIME} build \
-		--build-arg DC_VERSION=${DC_VERSION} \
-		--build-arg GONOSUMDB=${GONOSUMDB} \
-		--build-arg GOPRIVATE=${GOPRIVATE} \
-		--build-arg GOPROXY=${GOPROXY} \
+		--build-arg BUILD_DATE="$(shell date -u +"%Y-%m-%dT%H:%M:%SZ")" \
 		--file Dockerfile \
 		--no-cache \
 		--pull \

README.md

@@ -11,12 +11,12 @@ The workflow or how `docker-compose` can in general be used is documented at
 image.
 
 ```bash
-IMAGE_VERSION=2.34.0
+IMAGE_VERSION=5.1.4
 docker run \
   --rm \
-  --volume ./path/to/docker-compose.yml:/workdir/docker-compose.yml:ro \
+  --volume "$(pwd):$(pwd)" \
   --volume /var/run/docker.sock:/var/run/docker.sock \
-  --workdir /workdir \
-    git.cryptic.systems/volker.raschek/docker-compose:${IMAGE_VERSION} \
-      ps
+  --workdir "$(pwd)" \
+    "git.cryptic.systems/volker.raschek/docker-compose:${IMAGE_VERSION}" \
+      version
 ```

artifacthub-repo.yml

@@ -0,0 +1 @@
+repositoryID: c7576fb6-9bfd-44ad-a7a5-fd80465f0b65

renovate.json

@@ -4,9 +4,11 @@
     {
       "customType": "regex",
       "fileMatch": [
+        "^Dockerfile$",
         "^README\\.md$"
       ],
       "matchStrings": [
+        "ARG DC_VERSION=(?<currentValue>.*)",
         "IMAGE_VERSION=(?<currentValue>.*)"
       ],
       "datasourceTemplate": "github-releases",
@@ -31,6 +33,10 @@
       ],
       "matchManagers": [
         "regex"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
       ]
     }
   ]