ci: add read-only pull secret to security build

Reviewed-on: #382
Co-authored-by: Renovator Bot <renovator@rknet.org>
Co-committed-by: Renovator Bot <renovator@rknet.org>

.chglog/CHANGELOG.tpl.md

@@ -1,27 +0,0 @@
-# Changelog
-
-{{ range .Versions -}}
-## {{ if .Tag.Previous }}[{{ .Tag.Name }}]({{ $.Info.RepositoryURL }}/compare/{{ .Tag.Previous.Name }}...{{ .Tag.Name }}){{ else }}{{ .Tag.Name }}{{ end }} ({{ datetime "2006-01-02" .Tag.Date }})
-
-{{ range .CommitGroups -}}
-### {{ .Title }}
-
-{{ $subjects := list }}
-{{ range .Commits -}}
-{{ if not (has .Subject $subjects) -}}
-- {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
-{{ $subjects = append $subjects .Subject -}}
-{{ end }}
-{{- end }}
-{{- end -}}
-
-{{- if .NoteGroups -}}
-{{ range .NoteGroups -}}
-### {{ .Title }}
-
-{{ range .Notes }}
-{{ .Body }}
-{{ end }}
-{{ end -}}
-{{ end -}}
-{{ end -}}

.chglog/config.yml

@@ -1,25 +0,0 @@
-style: github
-template: CHANGELOG.tpl.md
-info:
-  title: CHANGELOG
-  repository_url: https://gitea.rknet.org/docker/lhci
-options:
-  commit_groups:
-    title_maps:
-      feat: Features
-      fix: Bug Fixes
-      perf: Performance Improvements
-      refactor: Code Refactoring
-      chore: Others
-      test: Testing
-      ci: CI Pipeline
-      docs: Documentation
-  header:
-    pattern: "^(\\w*)(?:\\(([\\w\\$\\.\\-\\*\\s]*)\\))?\\:\\s(.*)$"
-    pattern_maps:
-      - Type
-      - Scope
-      - Subject
-  notes:
-    keywords:
-      - BREAKING CHANGE

.dictionary

@@ -0,0 +1,2 @@
+lhci
+lighthouse-ci

.drone.yml

@@ -1,206 +0,0 @@
----
-kind: pipeline
-name: test
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: markdownlint
-  image: thegeeklab/markdownlint-cli
-  commands:
-  - markdownlint 'README.md'
-
-trigger:
-  ref:
-  - refs/heads/main
-  - refs/pull/**
-  - refs/tags/**
-
----
-kind: pipeline
-name: build-container
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: dryrun
-  image: thegeeklab/drone-docker-buildx:20
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    dry_run: true
-    password:
-      from_secret: docker_password
-    repo: thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/pull/**
-
-- name: tags
-  image: thegeeklab/docker-autotag
-  environment:
-    DOCKER_AUTOTAG_FORCE_LATEST: True
-    DOCKER_AUTOTAG_IGNORE_PRERELEASE: True
-    DOCKER_AUTOTAG_OUTPUT_FILE: .tags
-    DOCKER_AUTOTAG_VERSION: ${DRONE_TAG}
-  when:
-    ref:
-    - refs/heads/main
-    - refs/tags/**
-  depends_on:
-  - dryrun
-
-- name: changelog-generate
-  image: thegeeklab/git-chglog
-  commands:
-  - git fetch -tq
-  - git-chglog --no-color --no-emoji -o CHANGELOG.md ${DRONE_TAG:---next-tag unreleased unreleased}
-  depends_on:
-  - tags
-
-- name: changelog-format
-  image: thegeeklab/alpine-tools
-  commands:
-  - prettier CHANGELOG.md
-  - prettier -w CHANGELOG.md
-  depends_on:
-  - changelog-generate
-
-- name: publish-dockerhub
-  image: thegeeklab/drone-docker-buildx:20
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    password:
-      from_secret: docker_password
-    repo: thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/heads/main
-    - refs/tags/**
-  depends_on:
-  - changelog-format
-
-- name: publish-quay
-  image: thegeeklab/drone-docker-buildx:20
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    password:
-      from_secret: quay_password
-    registry: quay.io
-    repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: quay_username
-  when:
-    ref:
-    - refs/heads/main
-    - refs/tags/**
-  depends_on:
-  - changelog-format
-
-- name: publish-gitea
-  image: plugins/gitea-release
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://gitea.rknet.org
-    note: CHANGELOG.md
-    overwrite: true
-    title: ${DRONE_TAG}
-  when:
-    ref:
-    - refs/tags/**
-  depends_on:
-  - publish-dockerhub
-  - publish-quay
-
-trigger:
-  ref:
-  - refs/heads/main
-  - refs/pull/**
-  - refs/tags/**
-
-depends_on:
-- test
-
----
-kind: pipeline
-name: notifications
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: pushrm-dockerhub
-  pull: always
-  image: chko/docker-pushrm:1
-  environment:
-    DOCKER_PASS:
-      from_secret: docker_password
-    DOCKER_USER:
-      from_secret: docker_username
-    PUSHRM_FILE: README.md
-    PUSHRM_SHORT: Custom image for lighthouse-ci
-    PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
-  when:
-    status:
-    - success
-
-- name: pushrm-quay
-  pull: always
-  image: chko/docker-pushrm:1
-  environment:
-    APIKEY__QUAY_IO:
-      from_secret: quay_token
-    PUSHRM_FILE: README.md
-    PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
-  when:
-    status:
-    - success
-
-- name: matrix
-  image: plugins/matrix
-  settings:
-    homeserver:
-      from_secret: matrix_homeserver
-    password:
-      from_secret: matrix_password
-    roomid:
-      from_secret: matrix_roomid
-    template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
-    username:
-      from_secret: matrix_username
-  when:
-    status:
-    - success
-    - failure
-
-trigger:
-  ref:
-  - refs/heads/main
-  - refs/tags/**
-  status:
-  - success
-  - failure
-
-depends_on:
-- build-container
-
----
-kind: signature
-hmac: f0a79ff218867538b206db31be99e8dc07be3e50b1bb56e3e047a272816a33bf
-
-...

.gitsv/config.yml

@@ -0,0 +1,47 @@
+---
+version: "1.1"
+
+versioning:
+  update-major: []
+  update-minor: [feat]
+  update-patch: [fix, perf, refactor, chore, test, ci, docs]
+
+tag:
+  pattern: "v%d.%d.%d"
+
+release-notes:
+  sections:
+    - name: Features
+      commit-types: [feat]
+      section-type: commits
+    - name: Bug Fixes
+      commit-types: [fix]
+      section-type: commits
+    - name: Performance Improvements
+      commit-types: [perf]
+      section-type: commits
+    - name: Code Refactoring
+      commit-types: [refactor]
+      section-type: commits
+    - name: Others
+      commit-types: [chore]
+      section-type: commits
+    - name: Testing
+      commit-types: [test]
+      section-type: commits
+    - name: CI Pipeline
+      commit-types: [ci]
+      section-type: commits
+    - name: Documentation
+      commit-types: [docs]
+      section-type: commits
+    - name: BREAKING CHANGES
+      section-type: breaking-changes
+
+commit-message:
+  footer:
+    issue:
+      key: issue
+      add-value-prefix: "#"
+  issue:
+    regex: "#?[0-9]+"

.prettierignore

@@ -1,2 +1,2 @@
-.drone.yml
 *.tpl.md
+LICENSE

.woodpecker/build-container.yml

@@ -0,0 +1,67 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: security-build
+    image: quay.io/thegeeklab/wp-docker-buildx:5
+    settings:
+      containerfile: Containerfile
+      output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
+      repo: thegeeklab/${CI_REPO_NAME}
+      registry_config:
+        from_secret: DOCKER_REGISTRY_CONFIG_PULL
+
+  - name: security-scan
+    image: docker.io/aquasec/trivy
+    depends_on: security-build
+    commands:
+      - trivy -v
+      - trivy image --input oci/${CI_REPO_NAME}
+    environment:
+      TRIVY_EXIT_CODE: "1"
+      TRIVY_IGNORE_UNFIXED: "true"
+      TRIVY_NO_PROGRESS: "true"
+      TRIVY_SEVERITY: HIGH,CRITICAL
+      TRIVY_TIMEOUT: 1m
+      TRIVY_DB_REPOSITORY: docker.io/aquasec/trivy-db:2
+
+  - name: publish-dockerhub
+    image: quay.io/thegeeklab/wp-docker-buildx:5
+    depends_on: security-scan
+    settings:
+      auto_tag: true
+      containerfile: Containerfile
+      password:
+        from_secret: docker_password
+      provenance: false
+      repo: thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: docker_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+
+  - name: publish-quay
+    image: quay.io/thegeeklab/wp-docker-buildx:5
+    depends_on: security-scan
+    settings:
+      auto_tag: true
+      containerfile: Containerfile
+      password:
+        from_secret: quay_password
+      provenance: false
+      registry: quay.io
+      repo: quay.io/thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: quay_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}

.woodpecker/build-package.yml

@@ -0,0 +1,25 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: changelog
+    image: quay.io/thegeeklab/git-sv
+    commands:
+      - git sv current-version
+      - git sv release-notes -t ${CI_COMMIT_TAG:-next} -o CHANGELOG.md
+      - cat CHANGELOG.md
+
+  - name: publish-gitea
+    image: quay.io/thegeeklab/wp-gitea-release
+    settings:
+      api_key:
+        from_secret: gitea_token
+      base_url: https://gitea.rknet.org
+      note: CHANGELOG.md
+      title: ${CI_COMMIT_TAG}
+    when:
+      - event: [tag]

.woodpecker/docs.yml

@@ -0,0 +1,59 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: markdownlint
+    image: quay.io/thegeeklab/markdownlint-cli
+    commands:
+      - markdownlint 'README.md'
+
+  - name: spellcheck
+    image: quay.io/thegeeklab/alpine-tools
+    commands:
+      - spellchecker --files '_docs/**/*.md' 'README.md' -d .dictionary -p spell indefinite-article syntax-urls
+    environment:
+      FORCE_COLOR: "true"
+
+  - name: link-validation
+    image: docker.io/lycheeverse/lychee
+    commands:
+      - lychee --no-progress --format detailed README.md
+
+  - name: pushrm-dockerhub
+    image: docker.io/chko/docker-pushrm:1
+    depends_on: [markdownlint, spellcheck, link-validation]
+    environment:
+      DOCKER_PASS:
+        from_secret: docker_password
+      DOCKER_USER:
+        from_secret: docker_username
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Custom image for lighthouse-ci
+      PUSHRM_TARGET: thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+  - name: pushrm-quay
+    image: docker.io/chko/docker-pushrm:1
+    depends_on: [markdownlint, spellcheck, link-validation]
+    environment:
+      APIKEY__QUAY_IO:
+        from_secret: quay_token
+      PUSHRM_FILE: README.md
+      PUSHRM_TARGET: quay.io/thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+depends_on:
+  - build-package
+  - build-container

.woodpecker/notify.yml

@@ -0,0 +1,26 @@
+---
+when:
+  - event: [tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+runs_on: [success, failure]
+
+steps:
+  - name: matrix
+    image: quay.io/thegeeklab/wp-matrix
+    settings:
+      homeserver:
+        from_secret: matrix_homeserver
+      room_id:
+        from_secret: matrix_room_id
+      user_id:
+        from_secret: matrix_user_id
+      access_token:
+        from_secret: matrix_access_token
+    when:
+      - status: [success, failure]
+
+depends_on:
+  - docs

Containerfile

@@ -0,0 +1,42 @@
+FROM docker.io/node:lts-bookworm-slim@sha256:4b44c32c9f3118d60977d0dde5f758f63c4f9eac8ddee4275277239ec600950f
+
+LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.title="lhci"
+LABEL org.opencontainers.image.url="https://gitea.rknet.org/container/lhci"
+LABEL org.opencontainers.image.source="https://gitea.rknet.org/container/lhci"
+LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/container/lhci"
+
+ARG BUILD_VERSION
+ARG YQ_VERSION
+
+# renovate: datasource=npm depName=@lhci/cli
+ENV LHCI_VERSION="${BUILD_VERSION:-0.14.0}"
+# renovate: datasource=github-releases depName=mikefarah/yq
+ENV YQ_VERSION="${YQ_VERSION:-v4.44.3}"
+
+ENV LHCI_BASE_DIR=/drone/src \
+    FORCE_COLOR=true \
+    NPM_CONFIG_LOGLEVEL=error \
+    PATH=/usr/bin:$PATH
+
+ADD overlay/ /
+
+RUN apt-get update && apt-get install -y git curl wget gnupg jq bash bc libc-bin libc6 && \
+    curl -SsfL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" && \
+    chmod 755 /usr/local/bin/yq && \
+    wget -qO - "https://dl-ssl.google.com/linux/linux_signing_key.pub" | apt-key add - && \
+    echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" | tee "/etc/apt/sources.list.d/google.list" && \
+    apt-get update && apt-get install --no-install-recommends -y google-chrome-stable && \
+    LHCI_VERSION="${LHCI_VERSION##v}" && \
+    echo "Installing lhci version '$LHCI_VERSION' ..." && \
+    npm install -g @lhci/cli@"$LHCI_VERSION"; \
+    npm install -g lighthouse && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /tmp/* && \
+    rm -rf /root/.cache/
+
+USER root
+CMD []
+WORKDIR /drone/src
+ENTRYPOINT ["/usr/bin/lhci", "autorun"]

Dockerfile

@@ -1,50 +0,0 @@
-FROM node:lts-alpine3.14
-
-LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.title="lhci"
-LABEL org.opencontainers.image.url="https://gitea.rknet.org/docker/lhci"
-LABEL org.opencontainers.image.source="https://gitea.rknet.org/docker/lhci"
-LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/lhci"
-
-ARG BUILD_VERSION
-ARG YQ_VERSION
-
-# renovate: datasource=npm depName=@lhci/cli
-ENV LHCI_VERSION="${BUILD_VERSION:-0.8.0}"
-# renovate: datasource=github-releases depName=mikefarah/yq
-ENV YQ_VERSION="${YQ_VERSION:-v4.11.2}"
-
-ENV LHCI_BASE_DIR=/drone/src \
-    FORCE_COLOR=true \
-    NPM_CONFIG_LOGLEVEL=error \
-    PATH=/usr/bin:$PATH
-
-ADD overlay/ /
-
-RUN apk --update add --virtual .build-deps curl && \
-    echo @edge http://dl-cdn.alpinelinux.org/alpine/edge/main >> /etc/apk/repositories && \
-    echo @edge http://dl-cdn.alpinelinux.org/alpine/edge/community >> /etc/apk/repositories && \
-    apk update && \
-    apk add --update --no-cache git chromium@edge harfbuzz@edge freetype@edge freetype-dev@edge jq && \
-    curl -SsL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" && \
-    chmod 755 /usr/local/bin/yq && \
-    LHCI_VERSION="${LHCI_VERSION##v}" && \
-    LHCI_MAJOR="${LHCI_VERSION%%.*}" && \
-    if [ -z "${LHCI_MAJOR//[0-9]}" ] && [ -n "$LHCI_MAJOR" ]; then \
-        echo "Installing lhci version '$LHCI_VERSION' ..." && \
-        npm install -g @lhci/cli@"$LHCI_VERSION"; \
-    else \
-        echo "Installing latest lhci ..." && \
-        npm install -g @lhci/cli; \
-    fi && \
-    npm install -g lighthouse && \
-    apk del .build-deps && \
-    rm -rf /var/cache/apk/* && \
-    rm -rf /tmp/* && \
-    rm -rf /root/.cache/
-
-USER root
-CMD []
-WORKDIR /drone/src
-ENTRYPOINT ["/usr/bin/lhci", "autorun"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished
+to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice (including the next
+paragraph) shall be included in all copies or substantial portions of the
+Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
+OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -2,13 +2,17 @@
 
 Custom image for lighthouse-ci
 
-[![Build Status](https://img.shields.io/drone/build/docker/lhci?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/docker/lhci)
+<!-- spellchecker-disable -->
+
+[![Build Status](https://ci.rknet.org/api/badges/container/lhci/status.svg)](https://ci.rknet.org/repos/container/lhci)
 [![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/lhci)
 [![Quay.io](https://img.shields.io/badge/quay-latest-blue.svg?logo=docker&logoColor=white)](https://quay.io/repository/thegeeklab/lhci)
-[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/docker/lhci)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/lhci/src/branch/main/LICENSE)
+[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/container/lhci)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/container/lhci/src/branch/main/LICENSE)
 
-Custom wrapper Docker image for [lighthouse-ci](https://github.com/GoogleChrome/lighthouse-ci).
+<!-- spellchecker-enable -->
+
+Custom container image for [lighthouse-ci](https://github.com/GoogleChrome/lighthouse-ci).
 
 ## Usage
 
@@ -55,7 +59,7 @@ You will also get the target URLs in your CI output:
 
 All results processed!
 
-Dumping 6 reports to disk at /drone/src/lhci_reports...
+Dumping 6 reports to disk at /src/lhci_reports...
 Done writing reports to disk.
 
 Done running autorun.
@@ -67,16 +71,16 @@ Report for http://localhost:43901/posts/ will be uploaded to https://example.com
 ```
 
 ```Shell
-docker run -v $(pwd)/public:/drone/src lhci autorun
+docker run -v $(pwd)/public:/src lhci autorun
 
 # or pass arguments to lhci
-docker run -v $(pwd)/public:/drone/src lhci autorun --upload.target=temporary-public-storage
+docker run -v $(pwd)/public:/src lhci autorun --upload.target=temporary-public-storage
 ```
 
 ## Environment variables
 
 ```Shell
-LHCI_BASE_DIR="/drone/src"
+LHCI_BASE_DIR="/src"
 LHCI_SERVER_URL="https://example.com/"
 ```
 
@@ -88,4 +92,4 @@ docker build -t lhci:latest .
 
 ## License
 
-This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/lhci/src/branch/main/LICENSE) file for details.
+This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/container/lhci/src/branch/main/LICENSE) file for details.

overlay/usr/bin/lhci

@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -eo pipefail
 
 CONFIG="${LHCI_BASE_DIR%/}/.lighthouserc.yml"

overlay/usr/bin/lhci-official

@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -eo pipefail
 
 exec /usr/local/bin/lhci "$@"

trivy.yaml

@@ -0,0 +1,5 @@
+---
+scan:
+  skip-files:
+    - /usr/local/bin/gomplate
+    - /usr/local/bin/yq