chore(deps): update docker.io/library/python docker tag to v3.15.1

The workflows pulled tonistiigi/binfmt through an unauthenticated request, either directly from docker.io or from
harbor.cryptic.systems before any credentials had been configured. Both variants are subject to upstream rate limiting
and made the multi arch builds fail sporadically.

The docker/login-action steps are now placed in front of docker/setup-qemu-action and docker/setup-buildx-action, and a
second login against harbor.cryptic.systems was added so that the binfmt image is always pulled from the internal
registry with valid credentials. Leftover setup-qemu-action and setup-buildx-action steps from the previous ordering
were removed.

All pinned actions were additionally bumped to their latest upstream release to remove the version drift between the
repositories.

.gitea/workflows/build.yaml

@@ -3,9 +3,9 @@ name: Build
 on:
   pull_request:
     types:
-    - "opened"
-    - "reopened"
-    - "synchronize"
+    - opened
+    - reopened
+    - synchronize
   push:
     branches:
     - master
@@ -15,9 +15,19 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build image
         run: |
@@ -33,9 +43,19 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build image
         run: |

.gitea/workflows/markdown-linters.yaml

@@ -0,0 +1,22 @@
+name: 'Lint Markdown files'
+
+on:
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
+  push:
+    branches:
+    - master
+  workflow_dispatch: {}
+
+jobs:
+  markdown-lint:
+    runs-on:
+    - ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
+      with:
+        globs: '**/*.md'

.gitea/workflows/release.yaml

@@ -9,16 +9,26 @@ jobs:
   push-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/login-action@v3.4.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
       - name: Build and push image
         run: |
           TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
@@ -35,16 +45,26 @@ jobs:
   push-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v4.2.2
-      - uses: docker/setup-qemu-action@v3.6.0
-      - uses: docker/setup-buildx-action@v3.10.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/login-action@v3.4.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
 
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: harbor.cryptic.systems
+          username: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_USERNAME }}
+          password: ${{ secrets.HARBOR_CRYPTIC_SYSTEMS_PASSWORD }}
+
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: harbor.cryptic.systems/docker/tonistiigi/binfmt:qemu-v10.2.3 # renovate: datasource=docker registryUrl=https://docker.io depName=tonistiigi/binfmt extractVersion='qemu-(?<version>v\d+\.\d+\.\d+)$'
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
       - name: Build and push image
         run: |
           TAG=$(echo ${{ github.ref_name }} | sed 's/v//gm')
@@ -55,7 +75,7 @@ jobs:
             --platform linux/amd64 \
             --provenance false \
             --push \
-            --tag git.cryptic.systems/volker.raschek/yamllint:1.37.1-amd64 \
+            --tag git.cryptic.systems/volker.raschek/yamllint:${TAG}-amd64 \
             .
 
   push-manifest:
@@ -64,7 +84,7 @@ jobs:
     - push-arm64
     - push-amd64
     steps:
-      - uses: docker/login-action@v3.4.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -98,4 +118,4 @@ jobs:
           --src-password ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} \
           --src-username volker.raschek \
             docker://git.cryptic.systems/volker.raschek/yamllint:${TAG} \
-            docker://docker.io/volkerraschek/yamllint:${TAG}
+            docker://docker.io/volkerraschek/yamllint:${TAG}

.gitea/workflows/update-docker-hub-description.yaml

@@ -6,14 +6,15 @@ on:
     - master
     paths:
     - README.md
+  workflow_dispatch: {}
 
 jobs:
   update-description-on-hub-docker-io:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.2.2
-    - uses: peter-evans/dockerhub-description@v4.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}

.markdownlint.yaml

@@ -56,8 +56,6 @@ MD013:
   tables: false
   # Include headings
   headings: true
-  # Include headings
-  headers: true
   # Strict length checking
   strict: false
   # Stern length checking
@@ -70,11 +68,6 @@ MD022:
   # Blank lines below heading
   lines_below: 1
 
-# MD024/no-duplicate-heading/no-duplicate-header - Multiple headings with the same content
-MD024:
-  # Only check sibling headings
-  allow_different_nesting: true
-
 # MD025/single-title/single-h1 - Multiple top-level headings in the same document
 MD025:
   # Heading level

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/python:3.13.3-alpine AS build
+FROM docker.io/library/python:3.15.1-alpine AS build
 
 ARG YAMLLINT_VERSION=master
 

Makefile

@@ -1,6 +1,6 @@
 # YAMLLINT_VERSION
 # Only required to install a specify version
-YAMLLINT_VERSION?=v1.37.1 # renovate: datasource=github-releases depName=adrienverge/yamllint
+YAMLLINT_VERSION?=v1.38.0 # renovate: datasource=github-releases depName=adrienverge/yamllint
 
 # CONTAINER_RUNTIME
 # The CONTAINER_RUNTIME variable will be used to specified the path to a
@@ -16,7 +16,6 @@ YAMLLINT_IMAGE_NAMESPACE?=${YAMLLINT_IMAGE_REGISTRY_USER}
 YAMLLINT_IMAGE_NAME:=yamllint
 YAMLLINT_IMAGE_VERSION?=latest
 YAMLLINT_IMAGE_FULLY_QUALIFIED=${YAMLLINT_IMAGE_REGISTRY_NAME}/${YAMLLINT_IMAGE_NAMESPACE}/${YAMLLINT_IMAGE_NAME}:${YAMLLINT_IMAGE_VERSION}
-YAMLLINT_IMAGE_UNQUALIFIED=${YAMLLINT_IMAGE_NAMESPACE}/${YAMLLINT_IMAGE_NAME}:${YAMLLINT_IMAGE_VERSION}
 
 # BUILD CONTAINER IMAGE
 # ==============================================================================
@@ -28,15 +27,13 @@ container-image/build:
 		--no-cache \
 		--pull \
 		--tag ${YAMLLINT_IMAGE_FULLY_QUALIFIED} \
-		--tag ${YAMLLINT_IMAGE_UNQUALIFIED} \
 		.
 
 # DELETE CONTAINER IMAGE
 # ==============================================================================
 PHONY:=container-image/delete
 container-image/delete:
-	- ${CONTAINER_RUNTIME} image rm ${YAMLLINT_IMAGE_FULLY_QUALIFIED} ${YAMLLINT_IMAGE_UNQUALIFIED}
-	- ${CONTAINER_RUNTIME} image rm ${BASE_IMAGE_FULL}
+	- ${CONTAINER_RUNTIME} image rm ${YAMLLINT_IMAGE_FULLY_QUALIFIED}
 
 # PUSH CONTAINER IMAGE
 # ==============================================================================

README.md

@@ -2,8 +2,8 @@
 
 [![Docker Pulls](https://img.shields.io/docker/pulls/volkerraschek/yamllint)](https://hub.docker.com/r/volkerraschek/yamllint)
 
-This project contains all sources to build the container image `docker.io/volkerraschek/yamllint`. The primary goal of
-this project is to package the binary `yamllint` as container image. The source code of the binary can be found in the
-upstream project of [adrienverge](https://github.com/adrienverge/yamllint).
+This project contains all sources to build the container image `git.cryptic.systems/volker.raschek/yamllint`. The
+primary goal of this project is to package the binary `yamllint` as container image. The source code of the binary can
+be found in the upstream project of [adrienverge](https://github.com/adrienverge/yamllint).
 
-The workflow or how `yamllint` can in general be used is documented [here](https://yamllint.readthedocs.io/en/stable/).
+The workflow or how `yamllint` can in general be used is pretty [documented](https://yamllint.readthedocs.io/en/stable/).