chore(deps): update tonistiigi/binfmt docker tag to v10.2.3

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.gitea/workflows/auto-release.yaml

@@ -0,0 +1,73 @@
+name: Auto release
+
+on:
+  push:
+    branches: [ "master" ]
+    paths:
+    - Makefile
+
+env:
+  GIT_EMAIL: noreply@cryptic.systems
+  GIT_USER: CSRBot
+
+jobs:
+  tag_on_change:
+    permissions:
+      actions: write
+      contents: write
+
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Check if HELM_VERSION line changed
+        id: check_change
+        run: |
+          echo "changed=false" >> $GITHUB_OUTPUT
+
+          for file in Makefile; do
+            if git diff HEAD~1 HEAD -- "${file}" | grep --quiet '^[+-]HELM_VERSION'; then
+              echo "HELM_VERSION line changed."
+              echo "changed=true" >> $GITHUB_OUTPUT
+              break
+            fi
+          done
+
+      - name: Stop if no change detected
+        if: steps.check_change.outputs.changed == 'false'
+        run: echo "No HELM_VERSION change. Exiting..."
+
+      - name: Create and push new tag
+        id: create_tag
+        if: steps.check_change.outputs.changed == 'true'
+        run: |
+          defined_tag="$(grep --only-matching --perl-regexp 'HELM_VERSION\?=v?[\d]*(\.[\d]*){0,2}' Makefile | cut --delimiter='=' --fields=2)"
+
+          echo "defined_tag=${defined_tag}" >> $GITHUB_OUTPUT
+          echo "New tag: ${defined_tag}"
+
+          git config --local user.name "${GIT_USER}"
+          git config --local user.email "${GIT_EMAIL}"
+          git tag -a "${defined_tag}" -m "${defined_tag}"
+          git push origin "${defined_tag}"
+
+      - name: Trigger "Push tagged images" workflow
+        if: steps.check_change.outputs.changed == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const workflowFileName = 'release.yaml';
+            const defaultBranch = context.payload.repository.default_branch;
+            const definedTag = '${{ steps.create_tag.outputs.defined_tag }}';
+
+            await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowFileName,
+                ref: defaultBranch,
+                inputs: {
+                  tag: definedTag
+                }
+            });

.gitea/workflows/build.yaml

@@ -15,9 +15,19 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |
@@ -33,9 +43,19 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -13,10 +13,9 @@ on:
 
 jobs:
   markdown-lint:
-    runs-on:
-    - ubuntu-latest
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.2.2
-    - uses: DavidAnson/markdownlint-cli2-action@v20.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
       with:
         globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -4,58 +4,110 @@ on:
   push:
     tags:
     - "**"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag which should be released"
+        type: string
+        required: true
 
 jobs:
   push-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.0
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
 
-      - uses: docker/login-action@v3.4.0
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-tags: true
+          ref: "${{ steps.version_extraction.outputs.version_raw }}"
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
-          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
-
           docker buildx build \
-            --build-arg HELM_VERSION=${{ github.ref_name }} \
+            --build-arg HELM_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
             --file Dockerfile \
             --platform linux/arm64 \
             --provenance false \
             --push \
-            --tag git.cryptic.systems/volker.raschek/helm:${TAG}-arm64 \
+            --tag git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}-arm64 \
             .
 
   push-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.11.0
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
 
-      - uses: docker/login-action@v3.4.0
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-tags: true
+          ref: "${{ steps.version_extraction.outputs.version_raw }}"
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
       - name: Build and push image
         run: |
-          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
-
           docker buildx build \
-            --build-arg HELM_VERSION=${{ github.ref_name }} \
+            --build-arg HELM_VERSION=${{ steps.version_extraction.outputs.version_raw }} \
             --file Dockerfile \
             --platform linux/amd64 \
             --provenance false \
             --push \
-            --tag git.cryptic.systems/volker.raschek/helm:${TAG}-amd64 \
+            --tag git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
             .
 
   push-manifest:
@@ -64,7 +116,19 @@ jobs:
     - push-arm64
     - push-amd64
     steps:
-      - uses: docker/login-action@v3.4.0
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
+
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -72,30 +136,38 @@ jobs:
 
       - name: Create and push manifest
         run: |
-          TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+          docker manifest create git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }} \
+            --amend git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}-amd64 \
+            --amend git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}-arm64
 
-          docker manifest create git.cryptic.systems/volker.raschek/helm:${TAG} \
-            --amend git.cryptic.systems/volker.raschek/helm:${TAG}-amd64 \
-            --amend git.cryptic.systems/volker.raschek/helm:${TAG}-arm64
-
-          docker manifest push git.cryptic.systems/volker.raschek/helm:${TAG}
+          docker manifest push git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}
 
   sync-to-hub-docker-io:
     needs:
     - push-manifest
     runs-on: ubuntu-latest
     steps:
-    - name: Copy images to docker.io
-      run: |
-        TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
+      - id: version_extraction
+        name: Extract git tag
+        run: |
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#refs/*/}"
 
-        apt-get update --yes
-        apt-get install --yes skopeo
-        skopeo copy \
-          --all \
-          --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
-          --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
-          --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
-          --src-username volker.raschek \
-            docker://git.cryptic.systems/volker.raschek/helm:${TAG} \
-            docker://docker.io/volkerraschek/helm:${TAG}
+          echo "Version (raw):      ${VERSION}"
+          echo "Version (cleaned):  ${VERSION/v/}"
+
+          echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
+
+      - name: Copy images to docker.io
+        run: |
+          apt-get update --yes
+          apt-get install --yes skopeo
+          skopeo copy \
+            --all \
+            --dest-password ${{ secrets.DOCKER_IO_PASSWORD }} \
+            --dest-username ${{ secrets.DOCKER_IO_USERNAME }} \
+            --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
+            --src-username volker.raschek \
+              docker://git.cryptic.systems/volker.raschek/helm:${{ steps.version_extraction.outputs.version_cleaned }} \
+              docker://docker.io/volkerraschek/helm:${{ steps.version_extraction.outputs.version_cleaned }}

.gitea/workflows/update-docker-hub-description.yaml

@@ -13,10 +13,10 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.2.2
-    - uses: peter-evans/dockerhub-description@v4.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}
         repository: volkerraschek/helm
-        readme-filepath: README.md
+        readme-filepath: README.md

Dockerfile

@@ -1,18 +1,13 @@
-FROM docker.io/library/alpine:3.22.0
+FROM docker.io/library/alpine:3.24.1
 
 ARG HELM_VERSION
 
 RUN apk add bash curl git openssl && \
-    curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 --output /tmp/install.sh
+    curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 --output /tmp/install.sh
 
 RUN if [[ -z "${HELM_VERSION+x}" ]]; then bash /tmp/install.sh; fi
 RUN if [[ -n "${HELM_VERSION+x}" ]]; then bash /tmp/install.sh --version "${HELM_VERSION}"; fi
 
 RUN rm /tmp/install.sh
 
-# Install additionally helm plugins
-RUN helm plugin install https://github.com/chartmuseum/helm-push.git && \
-    helm plugin install https://github.com/helm-unittest/helm-unittest.git && \
-    helm plugin install https://github.com/losisin/helm-values-schema-json.git
-
 ENTRYPOINT [ "/usr/local/bin/helm" ]

Makefile

@@ -1,6 +1,6 @@
 # HELM_VERSION
 # Only required to install a specify version
-HELM_VERSION?=v3.18.3 # renovate: datasource=github-releases depName=helm/helm
+HELM_VERSION?=v4.2.4 # renovate: datasource=github-releases depName=helm/helm
 
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a

README.md

@@ -3,59 +3,15 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/volkerraschek/helm)](https://hub.docker.com/r/volkerraschek/helm)
 
 This project contains all sources to build the container image `git.cryptic.systems/volker.raschek/helm`. The primary
-goal of this project is to package the binary `helm` as container image to provide the functionally for CI/CD workflows.
+goal of this project is to package the binary `helm` as container image and provide the functionally for CI/CD workflows.
 The source code of the binary can be found in the upstream project of [helm](github.com/helm/helm).
 
-## drone
-
-Here is an example to lint, package and deploy a chart to chartmuseum via
-`git.cryptic.systems/volker.raschek/helm`.
-
-```yaml
-kind: pipeline
-type: kubernetes
-name: linter
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: helm lint
-  commands:
-  - helm lint
-  image: git.cryptic.systems/volker.raschek/helm:latest
-  resources:
-    limits:
-      cpu: 50
-      memory: 50M
-
----
-kind: pipeline
-type: kubernetes
-name: release
-
-platform:
-  os: linux
-
-steps:
-- name: release-helm-chart
-  commands:
-  - helm plugin install https://github.com/chartmuseum/helm-push.git
-  - helm repo add myrepo https://charts.example.com/myrepo
-  - helm package --version ${DRONE_TAG} .
-  - helm cm-push ${DRONE_REPO_NAME}-${DRONE_TAG}.tgz myrepo
-  environment:
-    HELM_REPO_PASSWORD:
-      from_secret: helm_repo_password
-    HELM_REPO_USERNAME:
-      from_secret: helm_repo_username
-  image: git.cryptic.systems/volker.raschek/helm:latest
-  resources:
-    limits:
-      cpu: 50
-      memory: 50M
-trigger:
-  event:
-  - tag
+```bash
+IMAGE_VERSION=4.2.4
+docker run \
+  --rm \
+  --volume "$(pwd):$(pwd)" \
+  --workdir "$(pwd)" \
+    "git.cryptic.systems/volker.raschek/helm:${IMAGE_VERSION}" \
+      version
 ```

renovate.json

@@ -1,5 +1,19 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "^README\\.md$"
+      ],
+      "matchStrings": [
+        "IMAGE_VERSION=(?<currentValue>.*)"
+      ],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "helm/helm",
+      "versioningTemplate": "semver"
+    }
+  ],
   "extends": [
     "local>volker.raschek/renovate-config:default#master",
     "local>volker.raschek/renovate-config:container#master",
@@ -8,9 +22,20 @@
   ],
   "packageRules": [
     {
-      "automerge": false,
-      "matchPackageNames": [ "helm" ],
-      "matchManagers": [ "regex" ]
+      "addLabels": [
+        "renovate/automerge"
+      ],
+      "automerge": true,
+      "matchPackageNames": [
+        "helm/helm"
+      ],
+      "matchManagers": [
+        "regex"
+      ],
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ]
     }
   ]
 }