5 changed files with 214 additions and 13 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -16,7 +16,7 @@ steps:
 - name: markdown lint
  commands:
  - markdownlint *.md
-  image: git.cryptic.systems/volker.raschek/markdownlint:0.42.0
+  image: git.cryptic.systems/volker.raschek/markdownlint:0.37.0
  resources:
    limits:
      cpu: 150
@ -69,7 +69,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: false
    dockerfile: Dockerfile
@ -115,6 +115,72 @@ trigger:
  repo:
  - volker.raschek/gosec-docker

+---
+kind: pipeline
+type: docker
+name: dry-run-arm-v7
+
+clone:
+  disable: true
+
+depends_on:
+- linter
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: false
+    dockerfile: Dockerfile
+    dry_run: true
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    tags: latest-arm-v7
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  branch:
+    exclude:
+    - master
+  event:
+  - pull_request
+  - push
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@ -135,7 +201,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: false
    dockerfile: Dockerfile
@ -201,7 +267,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: false
    dockerfile: Dockerfile
@ -245,6 +311,70 @@ trigger:
  repo:
  - volker.raschek/gosec-docker

+---
+kind: pipeline
+type: docker
+name: latest-arm-v7
+
+clone:
+  disable: true
+
+depends_on:
+- linter
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: false
+    dockerfile: Dockerfile
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    tags: latest-arm-v7
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  branch:
+  - master
+  event:
+  - cron
+  - push
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@ -265,7 +395,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: false
    dockerfile: Dockerfile
@ -319,6 +449,7 @@ clone:

 depends_on:
 - latest-amd64
+- latest-arm-v7
 - latest-arm64-v8

 # docker.io/plugins/manifest only for amd64 architectures available
@ -399,7 +530,7 @@ steps:
      from_secret: container_image_registry_user
    DEST_CRED_PASSWORD:
      from_secret: container_image_registry_password
-  image: quay.io/skopeo/stable:v1.16.1
+  image: quay.io/skopeo/stable:v1.13.3

 - name: email-notification
  environment:
@ -449,7 +580,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: true
    auto_tag_suffix: amd64
@ -492,6 +623,66 @@ trigger:
  repo:
  - volker.raschek/gosec-docker

+---
+kind: pipeline
+type: docker
+name: tagged-arm-v7
+
+clone:
+  disable: true
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: true
+    auto_tag_suffix: arm-v7
+    dockerfile: Dockerfile
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+    build_args:
+    - GOSEC_VERSION=v${DRONE_TAG}
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  event:
+  - tag
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@ -509,7 +700,7 @@ steps:
  image: git.cryptic.systems/volker.raschek/git:1.3.1

 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
  settings:
    auto_tag: true
    auto_tag_suffix: arm64-v8
@ -562,6 +753,7 @@ clone:

 depends_on:
 - tagged-amd64
+- tagged-arm-v7
 - tagged-arm64-v8

 # docker.io/plugins/manifest only for amd64 architectures available
@ -639,7 +831,7 @@ steps:
      from_secret: container_image_registry_user
    DEST_CRED_PASSWORD:
      from_secret: container_image_registry_password
-  image: quay.io/skopeo/stable:v1.16.1
+  image: quay.io/skopeo/stable:v1.13.3

 - name: email-notification
  environment:
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-FROM docker.io/library/golang:1.23.2-alpine AS build
+FROM docker.io/library/golang:1.21.3-alpine AS build

 ARG GOSEC_VERSION

--- a/6
+++ b/6
@ -1,6 +1,6 @@
 # GOSEC_VERSION
 # Only required to install a specifiy version
-GOSEC_VERSION?=v2.21.4 # renovate: datasource=github-releases depName=securego/gosec
+GOSEC_VERSION?=v2.18.0 # renovate: datasource=github-releases depName=securego/gosec

 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a
@ -9,8 +9,8 @@ CONTAINER_RUNTIME?=$(shell which podman)

 # GOSEC_IMAGE_REGISTRY_NAME
 # Defines the name of the new container to be built using several variables.
-GOSEC_IMAGE_REGISTRY_NAME:=git.cryptic.systems
-GOSEC_IMAGE_REGISTRY_USER:=volker.raschek
+GOSEC_IMAGE_REGISTRY_NAME:=docker.io
+GOSEC_IMAGE_REGISTRY_USER:=volkerraschek

 GOSEC_IMAGE_NAMESPACE?=${GOSEC_IMAGE_REGISTRY_USER}
 GOSEC_IMAGE_NAME:=gosec
--- a/manifest.tmpl
+++ b/manifest.tmpl
@ -11,6 +11,11 @@ manifests:
    platform:
      architecture: amd64
      os: linux
+  - image: git.cryptic.systems/volker.raschek/gosec:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-arm-v7
+    platform:
+      architecture: arm
+      os: linux
+      variant: v7
  - image: git.cryptic.systems/volker.raschek/gosec:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-arm64-v8
    platform:
      architecture: arm64
--- a/renovate.json
+++ b/renovate.json
@ -1,11 +1,14 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "assignees": [ "volker.raschek" ],
+  "automergeStrategy": "merge-commit",
+  "automergeType": "pr",
  "labels": [ "renovate" ],
  "packageRules": [
    {
      "addLabels": [ "renovate/droneci", "renovate/automerge" ],
      "automerge": true,
+      "excludePackagePatterns": [ "plugins/docker" ],
      "matchManagers": "droneci",
      "matchUpdateTypes": [ "minor", "patch"]
    },
@ -13,6 +16,7 @@
      "description": "Automatically update patch version of used container images in docker files",
      "addLabels": [ "renovate/container-image", "renovate/automerge" ],
      "automerge": true,
+      "matchBaseBranches": [ "master" ],
      "matchManagers": [ "dockerfile" ],
      "matchUpdateTypes": [ "patch" ]
    },