chore(deps): update dependency docker/compose to v5.5.1

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.gitea/workflows/artifacthub-metadata.yaml

@@ -0,0 +1,41 @@
+name: Upload ArtifactHub Metadata
+
+on:
+  schedule:
+    - cron: '0 3 1 * *'
+  workflow_dispatch:
+
+jobs:
+  upload-metadata:
+    name: "Upload artifacthub-repo.yml to OCI registry"
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        registry: ${{ github.server_url }}
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+    - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+      with:
+        version: 1.3.4 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
+    - name: Extract meta information
+      run: |
+        echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV
+        echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+        echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV
+        echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 1)" >> $GITHUB_ENV
+    - name: Push artifacthub-repo.yml
+      run: |
+        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:artifacthub.io \
+          --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
+          artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
+    - name: Push public cosign key
+      env:
+        COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }}
+      run: |
+        echo "${COSIGN_PUBLIC_KEY}" > cosign.pub
+        oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:cosign.pub \
+          --artifact-type application/vnd.dev.cosign.public-key.v1 \
+          --annotation org.opencontainers.image.title=cosign.pub \
+          cosign.pub:application/vnd.dev.cosign.public-key.v1

.gitea/workflows/auto-release.yaml

@@ -1,4 +1,4 @@
-name: Auto release
+name: Auto release tagged
 
 on:
   push:
@@ -18,7 +18,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -43,7 +43,7 @@ jobs:
         id: create_tag
         if: steps.check_change.outputs.changed == 'true'
         run: |
-          defined_tag="$(grep --only-matching --perl-regexp 'ARG DC_VERSION=v?[\d]*(\.[\d]*){0,2}' Dockerfile | cut --delimiter='=' --fields=2)"
+          defined_tag="$(grep --only-matching --perl-regexp 'ARG DC_VERSION=v?[\d]*(\.[\d]*){0,2}' Dockerfile | head --lines 1 | cut --delimiter='=' --fields=2)"
 
           echo "defined_tag=${defined_tag}" >> $GITHUB_OUTPUT
           echo "New tag: ${defined_tag}"
@@ -55,10 +55,10 @@ jobs:
 
       - name: Trigger "Push tagged images" workflow
         if: steps.check_change.outputs.changed == 'true'
-        uses: actions/github-script@v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const workflowFileName = 'release.yaml';
+            const workflowFileName = 'release-tagged.yaml';
             const defaultBranch = context.payload.repository.default_branch;
             const definedTag = '${{ steps.create_tag.outputs.defined_tag }}';
 

.gitea/workflows/build.yaml

@@ -6,18 +6,25 @@ on:
     - opened
     - reopened
     - synchronize
-  push:
-    branches:
-    - master
   workflow_dispatch: {}
 
 jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v4.1.0
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |
@@ -33,9 +40,19 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: docker/setup-qemu-action@v4.1.0
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -15,7 +15,7 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release-latest.yaml

@@ -0,0 +1,113 @@
+name: Release latest
+
+on:
+  push:
+    branches: [ "master" ]
+  workflow_dispatch: {}
+
+jobs:
+  push-arm64:
+    runs-on: ubuntu-latest-arm64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --file Dockerfile \
+            --platform linux/arm64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-arm64 \
+            .
+
+  push-amd64:
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      - name: Build and push image
+        run: |
+          docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
+            --file Dockerfile \
+            --platform linux/amd64 \
+            --provenance false \
+            --push \
+            --tag git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
+            .
+
+  push-manifest:
+    runs-on: ubuntu-latest
+    needs:
+    - push-arm64
+    - push-amd64
+    steps:
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: git.cryptic.systems
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
+
+      - name: Create and push manifest
+        run: |
+          docker manifest create git.cryptic.systems/volker.raschek/docker-compose:latest \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-amd64 \
+            --amend git.cryptic.systems/volker.raschek/docker-compose:latest-arm64
+
+          docker manifest push git.cryptic.systems/volker.raschek/docker-compose:latest
+
+  sync-to-hub-docker-io:
+    needs:
+    - push-manifest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Copy images to docker.io
+        run: |
+          apt-get update --yes
+          apt-get install --yes skopeo
+          skopeo copy \
+            --all \
+            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+            --src-username volker.raschek \
+              docker://git.cryptic.systems/volker.raschek/docker-compose:latest \
+              docker://docker.io/volkerraschek/docker-compose:latest

.gitea/workflows/release-tagged.yaml

@@ -1,4 +1,4 @@
-name: Release
+name: Release tagged
 
 on:
   push:
@@ -27,23 +27,33 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.1.0
-      - uses: docker/setup-buildx-action@v4.1.0
-
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
           docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
             --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
             --file Dockerfile \
             --platform linux/arm64 \
@@ -67,23 +77,33 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.1.0
-      - uses: docker/setup-buildx-action@v4.1.0
-
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
           docker buildx build \
+            --build-arg BUILD_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
             --build-arg DC_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
             --file Dockerfile \
             --platform linux/amd64 \
@@ -110,7 +130,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}

.gitea/workflows/update-docker-hub-description.yaml

@@ -12,8 +12,8 @@ jobs:
   update-description-on-hub-docker-io:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.2
-    - uses: peter-evans/dockerhub-description@v5.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

Dockerfile

@@ -1,6 +1,6 @@
 FROM docker.io/library/ubuntu:26.04 AS download
 
-ARG DC_VERSION=v5.1.4
+ARG DC_VERSION=v5.5.1
 
 RUN NAME=docker-compose-$(uname | tr [:upper:] [:lower:])-$(uname -m); \
     apt update --yes && \
@@ -19,8 +19,13 @@ RUN NAME=docker-compose-$(uname | tr [:upper:] [:lower:])-$(uname -m); \
 
 FROM scratch
 
-LABEL org.opencontainers.image.description="Define and run multi-container applications with Docker" \
-      io.artifacthub.package.readme-url="https://github.com/docker/compose"
+ARG DC_VERSION=v5.5.1
+ARG BUILD_DATE
+
+LABEL io.artifacthub.package.readme-url="https://raw.githubusercontent.com/docker/compose/refs/tags/${DC_VERSION}/README.md" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.description="Define and run multi-container applications with Docker" \
+      org.opencontainers.image.version=${DC_VERSION}
 
 COPY --from=download /tmp/docker-compose /usr/bin/docker-compose
 ENTRYPOINT [ "/usr/bin/docker-compose" ]

Makefile

@@ -18,6 +18,7 @@ DC_IMAGE_FULLY_QUALIFIED=${DC_IMAGE_REGISTRY_NAME}/${DC_IMAGE_NAMESPACE}/${DC_IM
 PHONY:=container-image/build
 container-image/build:
 	${CONTAINER_RUNTIME} build \
+		--build-arg BUILD_DATE="$(shell date -u +"%Y-%m-%dT%H:%M:%SZ")" \
 		--file Dockerfile \
 		--no-cache \
 		--pull \

README.md

@@ -11,7 +11,7 @@ The workflow or how `docker-compose` can in general be used is documented at
 image.
 
 ```bash
-IMAGE_VERSION=5.1.4
+IMAGE_VERSION=5.5.1
 docker run \
   --rm \
   --volume "$(pwd):$(pwd)" \

artifacthub-repo.yml

@@ -0,0 +1 @@
+repositoryID: c7576fb6-9bfd-44ad-a7a5-fd80465f0b65