.drone.yml

@@ -16,7 +16,7 @@ steps:
 - name: markdown lint
   commands:
   - markdownlint *.md
-  image: git.cryptic.systems/volker.raschek/markdownlint:0.42.0
+  image: git.cryptic.systems/volker.raschek/markdownlint:0.37.0
   resources:
     limits:
       cpu: 150
@@ -69,7 +69,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: false
     dockerfile: Dockerfile
@@ -115,6 +115,72 @@ trigger:
   repo:
   - volker.raschek/gosec-docker
 
+---
+kind: pipeline
+type: docker
+name: dry-run-arm-v7
+
+clone:
+  disable: true
+
+depends_on:
+- linter
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: false
+    dockerfile: Dockerfile
+    dry_run: true
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    tags: latest-arm-v7
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  branch:
+    exclude:
+    - master
+  event:
+  - pull_request
+  - push
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@@ -135,7 +201,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: false
     dockerfile: Dockerfile
@@ -201,7 +267,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: false
     dockerfile: Dockerfile
@@ -245,6 +311,70 @@ trigger:
   repo:
   - volker.raschek/gosec-docker
 
+---
+kind: pipeline
+type: docker
+name: latest-arm-v7
+
+clone:
+  disable: true
+
+depends_on:
+- linter
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: false
+    dockerfile: Dockerfile
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    tags: latest-arm-v7
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  branch:
+  - master
+  event:
+  - cron
+  - push
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@@ -265,7 +395,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: false
     dockerfile: Dockerfile
@@ -319,6 +449,7 @@ clone:
 
 depends_on:
 - latest-amd64
+- latest-arm-v7
 - latest-arm64-v8
 
 # docker.io/plugins/manifest only for amd64 architectures available
@@ -399,7 +530,7 @@ steps:
       from_secret: container_image_registry_user
     DEST_CRED_PASSWORD:
       from_secret: container_image_registry_password
-  image: quay.io/skopeo/stable:v1.16.1
+  image: quay.io/skopeo/stable:v1.13.3
 
 - name: email-notification
   environment:
@@ -449,7 +580,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: true
     auto_tag_suffix: amd64
@@ -492,6 +623,66 @@ trigger:
   repo:
   - volker.raschek/gosec-docker
 
+---
+kind: pipeline
+type: docker
+name: tagged-arm-v7
+
+clone:
+  disable: true
+
+platform:
+  os: linux
+  arch: arm
+
+steps:
+- name: clone
+  image: git.cryptic.systems/volker.raschek/git:1.3.1
+
+- name: build
+  image: docker.io/plugins/docker:20.10.9
+  settings:
+    auto_tag: true
+    auto_tag_suffix: arm-v7
+    dockerfile: Dockerfile
+    force_tag: true
+    no_cache: true
+    purge: true
+    mirror:
+      from_secret: docker_io_mirror
+    registry: git.cryptic.systems
+    repo: git.cryptic.systems/volker.raschek/gosec
+    username:
+      from_secret: git_cryptic_systems_container_registry_user
+    password:
+      from_secret: git_cryptic_systems_container_registry_password
+    build_args:
+    - GOSEC_VERSION=v${DRONE_TAG}
+
+- name: email-notification
+  environment:
+    SMTP_FROM_ADDRESS:
+      from_secret: smtp_from_address
+    SMTP_FROM_NAME:
+      from_secret: smtp_from_name
+    SMTP_HOST:
+      from_secret: smtp_host
+    SMTP_USERNAME:
+      from_secret: smtp_username
+    SMTP_PASSWORD:
+      from_secret: smtp_password
+  image: git.cryptic.systems/volker.raschek/drone-email:0.1.5
+  when:
+    status:
+    - changed
+    - failure
+
+trigger:
+  event:
+  - tag
+  repo:
+  - volker.raschek/gosec-docker
+
 ---
 kind: pipeline
 type: docker
@@ -509,7 +700,7 @@ steps:
   image: git.cryptic.systems/volker.raschek/git:1.3.1
 
 - name: build
-  image: docker.io/plugins/docker:20.18.4
+  image: docker.io/plugins/docker:20.10.9
   settings:
     auto_tag: true
     auto_tag_suffix: arm64-v8
@@ -562,6 +753,7 @@ clone:
 
 depends_on:
 - tagged-amd64
+- tagged-arm-v7
 - tagged-arm64-v8
 
 # docker.io/plugins/manifest only for amd64 architectures available
@@ -639,7 +831,7 @@ steps:
       from_secret: container_image_registry_user
     DEST_CRED_PASSWORD:
       from_secret: container_image_registry_password
-  image: quay.io/skopeo/stable:v1.16.1
+  image: quay.io/skopeo/stable:v1.13.3
 
 - name: email-notification
   environment:

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/golang:1.23.2-alpine AS build
+FROM docker.io/library/golang:1.21.3-alpine AS build
 
 ARG GOSEC_VERSION
 

Makefile

@@ -1,6 +1,6 @@
 # GOSEC_VERSION
 # Only required to install a specifiy version
-GOSEC_VERSION?=v2.21.4 # renovate: datasource=github-releases depName=securego/gosec
+GOSEC_VERSION?=v2.18.0 # renovate: datasource=github-releases depName=securego/gosec
 
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a
@@ -9,8 +9,8 @@ CONTAINER_RUNTIME?=$(shell which podman)
 
 # GOSEC_IMAGE_REGISTRY_NAME
 # Defines the name of the new container to be built using several variables.
-GOSEC_IMAGE_REGISTRY_NAME:=git.cryptic.systems
+GOSEC_IMAGE_REGISTRY_NAME:=docker.io
-GOSEC_IMAGE_REGISTRY_USER:=volker.raschek
+GOSEC_IMAGE_REGISTRY_USER:=volkerraschek
 
 GOSEC_IMAGE_NAMESPACE?=${GOSEC_IMAGE_REGISTRY_USER}
 GOSEC_IMAGE_NAME:=gosec

manifest.tmpl

@@ -11,6 +11,11 @@ manifests:
     platform:
       architecture: amd64
       os: linux
+  - image: git.cryptic.systems/volker.raschek/gosec:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-arm-v7
+    platform:
+      architecture: arm
+      os: linux
+      variant: v7
   - image: git.cryptic.systems/volker.raschek/gosec:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}-arm64-v8
     platform:
       architecture: arm64

renovate.json

@@ -1,11 +1,14 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "assignees": [ "volker.raschek" ],
+  "automergeStrategy": "merge-commit",
+  "automergeType": "pr",
   "labels": [ "renovate" ],
   "packageRules": [
     {
       "addLabels": [ "renovate/droneci", "renovate/automerge" ],
       "automerge": true,
+      "excludePackagePatterns": [ "plugins/docker" ],
       "matchManagers": "droneci",
       "matchUpdateTypes": [ "minor", "patch"]
     },
@@ -13,6 +16,7 @@
       "description": "Automatically update patch version of used container images in docker files",
       "addLabels": [ "renovate/container-image", "renovate/automerge" ],
       "automerge": true,
+      "matchBaseBranches": [ "master" ],
       "matchManagers": [ "dockerfile" ],
       "matchUpdateTypes": [ "patch" ]
     },