chore(deps): update dependency docker/compose to v5.5.1

chore(ci): authenticate against harbor.cryptic.systems before pulling binfmt
The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting and made the multi arch builds fail sporadically. The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering were removed. All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the repositories.
2026-09-03 18:05:07 +00:00 · 2026-09-02 20:44:09 +02:00 · 2026-08-27 21:05:44 +00:00 · 2026-08-19 12:06:56 +00:00 · 2026-08-17 12:09:18 +00:00 · 2026-07-29 15:07:33 +00:00
14 changed files with 520 additions and 160 deletions
@@ -0,0 +1,41 @@
 name: Upload ArtifactHub Metadata
 on:
  schedule:
    - cron: '0 3 1 * *'
  workflow_dispatch:
 jobs:
  upload-metadata:
    name: "Upload artifacthub-repo.yml to OCI registry"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
      with:
        registry: ${{ github.server_url }}
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
    - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
      with:
        version: 1.3.4 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
    - name: Extract meta information
      run: |
        echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV
        echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
        echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV
        echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 1)" >> $GITHUB_ENV
    - name: Push artifacthub-repo.yml
      run: |
        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:artifacthub.io \
          --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
          artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
    - name: Push public cosign key
      env:
        COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }}
      run: |
        echo "${COSIGN_PUBLIC_KEY}" > cosign.pub
        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:cosign.pub \
          --artifact-type application/vnd.dev.cosign.public-key.v1 \
          --annotation org.opencontainers.image.title=cosign.pub \
          cosign.pub:application/vnd.dev.cosign.public-key.v1
@@ -0,0 +1,73 @@
 name: Auto release tagged
 on:
  push:
    branches: [ "master" ]
    paths:
    - Dockerfile
 env:
  GIT_EMAIL: noreply@cryptic.systems
  GIT_USER: CSRBot
 jobs:
  tag_on_change:
    permissions:
      actions: write
      contents: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Check if DC_VERSION line changed
        id: check_change
        run: |
          echo "changed=false" >> $GITHUB_OUTPUT
          for file in Dockerfile; do
            if git diff HEAD~1 HEAD -- "${file}" | grep --quiet '^[+-]ARG DC_VERSION'; then
              echo "DC_VERSION line changed."
              echo "changed=true" >> $GITHUB_OUTPUT
              break
            fi
          done
      - name: Stop if no change detected
        if: steps.check_change.outputs.changed == 'false'
        run: echo "No DC_VERSION change. Exiting..."
      - name: Create and push new tag
        id: create_tag
        if: steps.check_change.outputs.changed == 'true'
        run: |
          defined_tag="$(grep --only-matching --perl-regexp 'ARG DC_VERSION=v?[\d]*(\.[\d]*){0,2}' Dockerfile | head --lines 1 | cut --delimiter='=' --fields=2)"
          echo "defined_tag=${defined_tag}" >> $GITHUB_OUTPUT
          echo "New tag: ${defined_tag}"
          git config --local user.name "${GIT_USER}"
          git config --local user.email "${GIT_EMAIL}"
          git tag -a "${defined_tag}" -m "${defined_tag}"
          git push origin "${defined_tag}"
      - name: Trigger "Push tagged images" workflow
        if: steps.check_change.outputs.changed == 'true'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const workflowFileName = 'release-tagged.yaml';
            const defaultBranch = context.payload.repository.default_branch;
            const definedTag = '${{ steps.create_tag.outputs.defined_tag }}';
            await github.rest.actions.createWorkflowDispatch({
                owner: context.repo.owner,
                repo: context.repo.repo,
                workflow_id: workflowFileName,
                ref: defaultBranch,
                inputs: {
                  tag: definedTag
                }
            });
@@ -3,21 +3,28 @@ name: Build
 on:
  pull_request:
    types:
-    - "opened"
+    - opened
-    - "reopened"
+    - reopened
-    - "synchronize"
+    - synchronize
  push:
    branches:
    - master
  workflow_dispatch: {}
 jobs:
  build-arm64:
    runs-on: ubuntu-latest-arm64
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: docker/setup-qemu-action@v3.6.0
+
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build image
        run: |
@@ -33,9 +40,19 @@ jobs:
  build-amd64:
    runs-on: ubuntu-latest-amd64
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: docker/setup-qemu-action@v3.6.0
+
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build image
        run: |
@@ -0,0 +1,21 @@
 name: 'Lint Markdown files'
 on:
  pull_request:
    types:
    - opened
    - reopened
    - synchronize
  push:
    branches:
    - master
  workflow_dispatch: {}
 jobs:
  markdown-lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
      with:
        globs: '**/*.md'
@@ -0,0 +1,113 @@
 name: Release latest
 on:
  push:
    branches: [ "master" ]
  workflow_dispatch: {}
 jobs:
  push-arm64:
    runs-on: ubuntu-latest-arm64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build and push image
        run: |
          docker buildx build \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --file Dockerfile \
            --platform linux/arm64 \
            --provenance false \
            --push \
            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-arm64 \
            .
  push-amd64:
    runs-on: ubuntu-latest-amd64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build and push image
        run: |
          docker buildx build \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --file Dockerfile \
            --platform linux/amd64 \
            --provenance false \
            --push \
            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
            .
  push-manifest:
    runs-on: ubuntu-latest
    needs:
    - push-arm64
    - push-amd64
    steps:
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - name: Create and push manifest
        run: |
          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:latest \
            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-arm64
          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:latest
  sync-to-hub-docker-io:
    needs:
    - push-manifest
    runs-on: ubuntu-latest
    steps:
      - name: Copy images to docker.io
        run: |
          apt-get update --yes
          apt-get install --yes skopeo
          skopeo copy \
            --all \
            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
            --src-username volker.raschek \
              docker://git.cryptic.systems/volker.raschek/docker-compose:latest \
              docker://docker.io/volkerraschek/docker-compose:latest
@@ -0,0 +1,175 @@
 name: Release tagged
 on:
  push:
    tags:
    - "**"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag which should be released"
        type: string
        required: true
 jobs:
  push-arm64:
    runs-on: ubuntu-latest-arm64
    steps:
      - id: version_extraction
        name: Extract git tag
        run: |
          VERSION="${{ inputs.tag || github.ref_name }}"
          VERSION="${VERSION#refs/*/}"
          echo "Version (raw):      ${VERSION}"
          echo "Version (cleaned):  ${VERSION/v/}"
          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-tags: true
          ref: "${{ steps.version_extraction.outputs.version_raw }}"
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build and push image
        run: |
          docker buildx build \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
            --file Dockerfile \
            --platform linux/arm64 \
            --provenance false \
            --push \
            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-arm64 \
            .
  push-amd64:
    runs-on: ubuntu-latest-amd64
    steps:
      - id: version_extraction
        name: Extract git tag
        run: |
          VERSION="${{ inputs.tag || github.ref_name }}"
          VERSION="${VERSION#refs/*/}"
          echo "Version (raw):      ${VERSION}"
          echo "Version (cleaned):  ${VERSION/v/}"
          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-tags: true
          ref: "${{ steps.version_extraction.outputs.version_raw }}"
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: harbor.cryptic.systems
          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
        with:
          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      - name: Build and push image
        run: |
          docker buildx build \
            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
            --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
            --file Dockerfile \
            --platform linux/amd64 \
            --provenance false \
            --push \
            --tag git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
            .
  push-manifest:
    runs-on: ubuntu-latest
    needs:
    - push-arm64
    - push-amd64
    steps:
      - id: version_extraction
        name: Extract git tag
        run: |
          VERSION="${{ inputs.tag || github.ref_name }}"
          VERSION="${VERSION#refs/*/}"
          echo "Version (raw):      ${VERSION}"
          echo "Version (cleaned):  ${VERSION/v/}"
          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - name: Create and push manifest
        run: |
          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }} \
            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
            --amend git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}-arm64
          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}
  sync-to-hub-docker-io:
    needs:
    - push-manifest
    runs-on: ubuntu-latest
    steps:
      - id: version_extraction
        name: Extract git tag
        run: |
          VERSION="${{ inputs.tag || github.ref_name }}"
          VERSION="${VERSION#refs/*/}"
          echo "Version (raw):      ${VERSION}"
          echo "Version (cleaned):  ${VERSION/v/}"
          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
      - name: Copy images to docker.io
        run: |
          apt-get update --yes
          apt-get install --yes skopeo
          skopeo copy \
            --all \
            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
            --src-username volker.raschek \
              docker://git.cryptic.systems/volker.raschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }} \
              docker://docker.io/volkerraschek/docker-compose:${{ steps.version_extraction.outputs.version_cleaned }}
@@ -1,99 +0,0 @@
 name: Release
 on:
  push:
    tags:
    - "**"
 jobs:
  push-arm64:
    runs-on: ubuntu-latest-arm64
    steps:
      - uses: actions/checkout@v4.2.2
      - uses: docker/setup-qemu-action@v3.6.0
      - uses: docker/setup-buildx-action@v3.10.0
      - uses: docker/login-action@v3.4.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - name: Build and push image
        run: |
          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
          docker buildx build \
            --platform linux/arm64 \
            --file Dockerfile \
            --provenance false \
            --tag git.cryptic.systems/volker.raschek/docker-compose:${TAG}-arm64 \
            --push \
            .
  push-amd64:
    runs-on: ubuntu-latest-amd64
    steps:
      - uses: actions/checkout@v4.2.2
      - uses: docker/setup-qemu-action@v3.6.0
      - uses: docker/setup-buildx-action@v3.10.0
      - uses: docker/login-action@v3.4.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - name: Build and push image
        run: |
          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
          docker buildx build \
            --platform linux/amd64 \
            --file Dockerfile \
            --provenance false \
            --tag git.cryptic.systems/volker.raschek/docker-compose:${TAG}-amd64 \
            --push \
            .
  push-manifest:
    runs-on: ubuntu-latest
    needs:
    - push-arm64
    - push-amd64
    steps:
      - uses: docker/login-action@v3.4.0
        with:
          registry: git.cryptic.systems
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
      - name: Create and push manifest
        run: |
          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:${TAG} \
            --amend git.cryptic.systems/volker.raschek/docker-compose:${TAG}-amd64 \
            --amend git.cryptic.systems/volker.raschek/docker-compose:${TAG}-arm64
          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:${TAG}
  sync-to-hub-docker-io:
    needs:
    - push-manifest
    runs-on: ubuntu-latest
    steps:
    - name: Copy images to docker.io
      run: |
        TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
        apt-get update --yes
        apt-get install --yes skopeo
        skopeo copy \
          --all \
          --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
          --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
          --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
          --src-username volker.raschek \
            docker://git.cryptic.systems/volker.raschek/docker-compose:${TAG} \
            docker://docker.io/volkerraschek/docker-compose:${TAG}
@@ -6,14 +6,14 @@ on:
    - master
    paths:
    - README.md
  workflow_dispatch: {}
 jobs:
  update-description-on-hub-docker-io:
-    runs-on:
+    runs-on: ubuntu-latest
    - ubuntu-latest
    steps:
-    - uses: actions/checkout@v4.2.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: peter-evans/dockerhub-description@v4.0.2
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
      with:
        username: ${{ secrets.DOCKER_IO_USERNAME }}
        password: ${{ secrets.DOCKER_IO_PASSWORD }}
@@ -56,8 +56,6 @@ MD013:
  tables: false
  # Include headings
  headings: true
  # Include headings
  headers: true
  # Strict length checking
  strict: false
  # Stern length checking
@@ -70,11 +68,6 @@ MD022:
  # Blank lines below heading
  lines_below: 1
 # MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content
 MD024:
  # Only check sibling headings
  allow_different_nesting: true
 # MD025/single-title/single-h1 - Multiple top-level headings in the same document
 MD025:
  # Heading level
@@ -1,18 +1,31 @@
-FROM docker.io/library/golang:1.24.3-alpine3.21 AS build
+FROM docker.io/library/ubuntu:26.04 AS download
-ARG DC_VERSION=main
+ARG DC_VERSION=v5.5.1
-RUN set -ex && \
+RUN NAME=docker-compose-$(uname | tr [:upper:] [:lower:])-$(uname -m); \
-    apk update && \
+    apt update --yes && \
-    apk upgrade && \
+    apt install --yes curl && \
-    apk add git make
+    curl \
      --fail \
      --output "/tmp/${NAME}" \
      --location "https://github.com/docker/compose/releases/download/${DC_VERSION}/${NAME}" && \
    curl \
      --fail \
      --output /tmp/checksums.txt \
      --location "https://github.com/docker/compose/releases/download/${DC_VERSION}/checksums.txt" && \
    (cd /tmp && sha256sum --ignore-missing --check checksums.txt) && \
    ln -s "${NAME}" /tmp/docker-compose && \
    chmod +x /tmp/docker-compose
-RUN git clone https://github.com/docker/compose.git --branch ${DC_VERSION} docker-compose && \
+FROM scratch
    cd docker-compose && \
    make DESTDIR=/cache
-FROM docker.io/library/alpine:3.21
+ARG DC_VERSION=v5.5.1
 ARG BUILD_DATE
-COPY --from=build /cache/docker-compose /usr/bin/docker-compose
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/docker/compose/refs/tags/${DC_VERSION}/README.md" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.description="Define and run multi-container applications with Docker" \
      org.opencontainers.image.version=${DC_VERSION}
 COPY --from=download /tmp/docker-compose /usr/bin/docker-compose
 ENTRYPOINT [ "/usr/bin/docker-compose" ]
@@ -1,7 +1,3 @@
 # DC_VERSION
 # Only required to install a specifiy version
 DC_VERSION?=v2.36.0 # renovate: datasource=github-releases depName=docker/compose
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a container runtime. This is needed to start and
 # run a container image.
@@ -22,7 +18,7 @@ DC_IMAGE_FULLY_QUALIFIED=${DC_IMAGE_REGISTRY_NAME}/${DC_IMAGE_NAMESPACE}/${DC_IM
 PHONY:=container-image/build
 container-image/build:
 	${CONTAINER_RUNTIME} build \
-		--build-arg DC_VERSION=${DC_VERSION} \
+		--build-arg BUILD_DATE="$(shell date -u +"%Y-%m-%dT%H:%M:%SZ")" \
 		--file Dockerfile \
 		--no-cache \
 		--pull \
@@ -34,7 +30,6 @@ container-image/build:
 PHONY:=container-image/delete
 container-image/delete:
 	- ${CONTAINER_RUNTIME} image rm ${DC_IMAGE_FULLY_QUALIFIED}
 	- ${CONTAINER_RUNTIME} image rm ${BASE_IMAGE_FULL}
 # PUSH CONTAINER IMAGE
 # =====================================================================================================================
@@ -2,20 +2,21 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/volkerraschek/docker-compose)](https://hub.docker.com/r/volkerraschek/docker-compose)
-This project contains all sources to build the container image `docker.io/volkerraschek/docker-compose`. The primary
+This project contains all sources to build the container image `git.cryptic.systems/volker.raschek/docker-compose`. The
-goal of this project is to package the binary `docker-compose` as container image. The source code of the binary can be
+primary goal of this project is to package the binary `docker-compose` as container image. The source code of the binary
-found in the upstream project of [docker/compose](https://github.com/docker/compose).
+can be found in the upstream project of [docker/compose](https://github.com/docker/compose).
-The workflow or how `docker-compose` can in general be used is documented [here](https://docs.docker.com/compose/).
+The workflow or how `docker-compose` can in general be used is documented at
-Nevertheless, here are some examples of how to use the container image.
+[docs.docker.com](https://docs.docker.com/compose/). Nevertheless, here are some examples of how to use the container
 image.
 ```bash
-IMAGE_VERSION=2.34.0
+IMAGE_VERSION=5.5.1
 docker run \
  --rm \
-  --volume ./path/to/docker-compose.yml:/workdir/docker-compose.yml:ro \
+  --volume "$(pwd):$(pwd)" \
  --volume /var/run/docker.sock:/var/run/docker.sock \
-  --workdir /workdir \
+  --workdir "$(pwd)" \
-    git.cryptic.systems/volker.raschek/docker-compose:${IMAGE_VERSION} \
+    "git.cryptic.systems/volker.raschek/docker-compose:${IMAGE_VERSION}" \
-      ps
+      version
 ```
@@ -0,0 +1 @@
 repositoryID: c7576fb6-9bfd-44ad-a7a5-fd80465f0b65
@@ -2,13 +2,18 @@
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "customManagers": [
    {
-      "fileMatch": ["^README\\.md$"],
+      "customType": "regex",
-      "matchStrings": [
+      "fileMatch": [
-        "VERSION=(?<currentValue>.*)"
+        "^Dockerfile$",
        "^README\\.md$"
      ],
-      "depNameTemplate": "volker.raschek/docker-compose",
+      "matchStrings": [
-      "datasourceTemplate": "docker",
+        "ARG DC_VERSION=(?<currentValue>.*)",
-      "registryUrlTemplate": "https://git.cryptic.systems"
+        "IMAGE_VERSION=(?<currentValue>.*)"
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "docker/compose",
      "versioningTemplate": "semver"
    }
  ],
  "extends": [
@@ -19,9 +24,20 @@
  ],
  "packageRules": [
    {
-      "automerge": false,
+      "addLabels": [
-      "matchPackageNames": [ "docker-compose" ],
+        "renovate/automerge"
-      "matchManagers": [ "regex" ]
+      ],
      "automerge": true,
      "matchPackageNames": [
        "docker/compose"
      ],
      "matchManagers": [
        "regex"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch"
      ]
    }
  ]
 }
		`@@ -0,0 +1 @@`
							`repositoryID: c7576fb6-9bfd-44ad-a7a5-fd80465f0b65`