chore(docker): update docker.io/python:3.12-alpine docker digest to 5365725

Reviewed-on: #373
Co-authored-by: Renovator Bot <renovator@rknet.org>
Co-committed-by: Renovator Bot <renovator@rknet.org>

.dictionary

@@ -0,0 +1 @@
+Ansible

.drone.yml

@@ -1,190 +0,0 @@
----
-kind: pipeline
-name: test
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: markdownlint
-  image: thegeeklab/markdownlint-cli
-  commands:
-  - markdownlint 'README.md'
-
-trigger:
-  ref:
-  - refs/heads/master
-  - refs/pull/**
-  - refs/tags/**
-
----
-kind: pipeline
-name: build-container
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: dryrun
-  image: plugins/docker:19
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    dry_run: true
-    password:
-      from_secret: docker_password
-    repo: thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/pull/**
-
-- name: tags
-  image: thegeeklab/docker-autotag
-  environment:
-    DOCKER_AUTOTAG_FORCE_LATEST: True
-    DOCKER_AUTOTAG_IGNORE_PRERELEASE: True
-    DOCKER_AUTOTAG_OUTPUT_FILE: .tags
-    DOCKER_AUTOTAG_VERSION: ${DRONE_TAG}
-  when:
-    ref:
-    - refs/heads/master
-    - refs/tags/**
-  depends_on:
-  - dryrun
-
-- name: publish-dockerhub
-  image: plugins/docker:19
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    password:
-      from_secret: docker_password
-    repo: thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: docker_username
-  when:
-    ref:
-    - refs/heads/master
-    - refs/tags/**
-  depends_on:
-  - tags
-
-- name: publish-quay
-  image: plugins/docker:19
-  settings:
-    build_args:
-    - BUILD_VERSION=${DRONE_TAG%-*}
-    dockerfile: Dockerfile
-    password:
-      from_secret: quay_password
-    registry: quay.io
-    repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
-    username:
-      from_secret: quay_username
-  when:
-    ref:
-    - refs/heads/master
-    - refs/tags/**
-  depends_on:
-  - tags
-
-- name: publish-gitea
-  image: plugins/gitea-release
-  settings:
-    api_key:
-      from_secret: gitea_token
-    base_url: https://gitea.rknet.org
-    note: CHANGELOG.md
-    overwrite: true
-    title: ${DRONE_TAG}
-  when:
-    ref:
-    - refs/tags/**
-  depends_on:
-  - publish-dockerhub
-  - publish-quay
-
-trigger:
-  ref:
-  - refs/heads/master
-  - refs/pull/**
-  - refs/tags/**
-
-depends_on:
-- test
-
----
-kind: pipeline
-name: notifications
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: pushrm-dockerhub
-  pull: always
-  image: chko/docker-pushrm:1
-  environment:
-    DOCKER_PASS:
-      from_secret: docker_password
-    DOCKER_USER:
-      from_secret: docker_username
-    PUSHRM_FILE: README.md
-    PUSHRM_SHORT: Custom image for Molecule Ansible test automation
-    PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
-  when:
-    status:
-    - success
-
-- name: pushrm-quay
-  pull: always
-  image: chko/docker-pushrm:1
-  environment:
-    APIKEY__QUAY_IO:
-      from_secret: quay_token
-    PUSHRM_FILE: README.md
-    PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
-  when:
-    status:
-    - success
-
-- name: matrix
-  image: plugins/matrix
-  settings:
-    homeserver:
-      from_secret: matrix_homeserver
-    password:
-      from_secret: matrix_password
-    roomid:
-      from_secret: matrix_roomid
-    template: "Status: **{{ build.status }}**<br/> Build: [{{ repo.Owner }}/{{ repo.Name }}]({{ build.link }}) ({{ build.branch }}) by {{ build.author }}<br/> Message: {{ build.message }}"
-    username:
-      from_secret: matrix_username
-  when:
-    status:
-    - success
-    - failure
-
-trigger:
-  ref:
-  - refs/heads/master
-  - refs/tags/**
-  status:
-  - success
-  - failure
-
-depends_on:
-- build-container
-
----
-kind: signature
-hmac: 50c98019002ef5875ddc9d697bb65895a0d9e7f9a9c79029bd7432ef7771b1e5
-
-...

.gitignore

@@ -0,0 +1 @@
+CHANGELOG.md

.gitsv/config.yml

@@ -0,0 +1,47 @@
+---
+version: "1.1"
+
+versioning:
+  update-major: []
+  update-minor: [feat]
+  update-patch: [fix, perf, refactor, chore, test, ci, docs]
+
+tag:
+  pattern: "v%d.%d.%d"
+
+release-notes:
+  sections:
+    - name: Features
+      commit-types: [feat]
+      section-type: commits
+    - name: Bug Fixes
+      commit-types: [fix]
+      section-type: commits
+    - name: Performance Improvements
+      commit-types: [perf]
+      section-type: commits
+    - name: Code Refactoring
+      commit-types: [refactor]
+      section-type: commits
+    - name: Others
+      commit-types: [chore]
+      section-type: commits
+    - name: Testing
+      commit-types: [test]
+      section-type: commits
+    - name: CI Pipeline
+      commit-types: [ci]
+      section-type: commits
+    - name: Documentation
+      commit-types: [docs]
+      section-type: commits
+    - name: BREAKING CHANGES
+      section-type: breaking-changes
+
+commit-message:
+  footer:
+    issue:
+      key: issue
+      add-value-prefix: "#"
+  issue:
+    regex: "#?[0-9]+"

.prettierignore

@@ -1 +1,2 @@
-.drone.yml
+*.tpl.md
+LICENSE

.woodpecker/build-container.yml

@@ -0,0 +1,69 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: security-build
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    settings:
+      containerfile: Containerfile.multiarch
+      output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
+      repo: thegeeklab/${CI_REPO_NAME}
+
+  - name: security-scan
+    image: ghcr.io/aquasecurity/trivy
+    commands:
+      - trivy -v
+      - trivy image --input oci/${CI_REPO_NAME}
+    environment:
+      TRIVY_EXIT_CODE: "1"
+      TRIVY_IGNORE_UNFIXED: "true"
+      TRIVY_NO_PROGRESS: "true"
+      TRIVY_SEVERITY: HIGH,CRITICAL
+      TRIVY_TIMEOUT: 1m
+
+  - name: publish-dockerhub
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    group: container
+    settings:
+      auto_tag: true
+      containerfile: Containerfile.multiarch
+      password:
+        from_secret: docker_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      repo: thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: docker_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+
+  - name: publish-quay
+    image: quay.io/thegeeklab/wp-docker-buildx:4
+    group: container
+    settings:
+      auto_tag: true
+      containerfile: Containerfile.multiarch
+      password:
+        from_secret: quay_password
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      provenance: false
+      registry: quay.io
+      repo: quay.io/thegeeklab/${CI_REPO_NAME}
+      username:
+        from_secret: quay_username
+    when:
+      - event: [tag]
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}

.woodpecker/build-package.yml

@@ -0,0 +1,25 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: changelog
+    image: quay.io/thegeeklab/git-sv
+    commands:
+      - git sv current-version
+      - git sv release-notes -t ${CI_COMMIT_TAG:-next} -o CHANGELOG.md
+      - cat CHANGELOG.md
+
+  - name: publish-gitea
+    image: quay.io/thegeeklab/wp-gitea-release
+    settings:
+      api_key:
+        from_secret: gitea_token
+      base_url: https://gitea.rknet.org
+      note: CHANGELOG.md
+      title: ${CI_COMMIT_TAG}
+    when:
+      - event: [tag]

.woodpecker/docs.yml

@@ -0,0 +1,62 @@
+---
+when:
+  - event: [pull_request, tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+steps:
+  - name: markdownlint
+    image: quay.io/thegeeklab/markdownlint-cli
+    group: test
+    commands:
+      - markdownlint 'README.md'
+
+  - name: spellcheck
+    image: quay.io/thegeeklab/alpine-tools
+    group: test
+    commands:
+      - spellchecker --files '_docs/**/*.md' 'README.md' -d .dictionary -p spell indefinite-article syntax-urls
+    environment:
+      FORCE_COLOR: "true"
+
+  - name: link-validation
+    image: docker.io/lycheeverse/lychee
+    group: test
+    commands:
+      - lychee --no-progress --format detailed README.md
+
+  - name: pushrm-dockerhub
+    image: docker.io/chko/docker-pushrm:1
+    secrets:
+      - source: docker_password
+        target: DOCKER_PASS
+      - source: docker_username
+        target: DOCKER_USER
+    environment:
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Custom image for Ansible Molecule test automation
+      PUSHRM_TARGET: thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+  - name: pushrm-quay
+    image: docker.io/chko/docker-pushrm:1
+    secrets:
+      - source: quay_token
+        target: APIKEY__QUAY_IO
+    environment:
+      PUSHRM_FILE: README.md
+      PUSHRM_TARGET: quay.io/thegeeklab/${CI_REPO_NAME}
+    when:
+      - event: [push, manual]
+        branch:
+          - ${CI_REPO_DEFAULT_BRANCH}
+        status: [success]
+
+depends_on:
+  - build-package
+  - build-container

.woodpecker/notify.yml

@@ -0,0 +1,26 @@
+---
+when:
+  - event: [tag]
+  - event: [push, manual]
+    branch:
+      - ${CI_REPO_DEFAULT_BRANCH}
+
+runs_on: [success, failure]
+
+steps:
+  - name: matrix
+    image: quay.io/thegeeklab/wp-matrix
+    settings:
+      homeserver:
+        from_secret: matrix_homeserver
+      password:
+        from_secret: matrix_password
+      roomid:
+        from_secret: matrix_roomid
+      username:
+        from_secret: matrix_username
+    when:
+      - status: [success, failure]
+
+depends_on:
+  - docs

CHANGELOG.md

@@ -1,4 +0,0 @@
-- ENHANCEMENT
-  - Update dependency ansible to v2.10.4
-  - Update dependency molecule to v3.2.1
-  - Switch to `org.opencontainers` container labels

Containerfile.multiarch

@@ -0,0 +1,43 @@
+FROM docker.io/python:3.12-alpine@sha256:5365725a6cd59b72a927628fdda9965103e3dc671676c89ef3ed8b8b0e22e812
+
+LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
+LABEL org.opencontainers.image.title="molecule"
+LABEL org.opencontainers.image.url="https://gitea.rknet.org/container/molecule"
+LABEL org.opencontainers.image.source="https://gitea.rknet.org/container/molecule"
+LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/container/molecule"
+
+ARG ANSIBLE_VERSION
+ARG MOLECULE_VERSION
+
+# renovate: datasource=pypi depName=molecule
+ENV MOLECULE_VERSION="${MOLECULE_VERSION:-24.2.1}"
+# renovate: datasource=pypi depName=ansible
+ENV ANSIBLE_VERSION="${ANSIBLE_VERSION:-9.5.1}"
+
+ENV PY_COLORS=1
+ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
+ENV ANSIBLE_FORCE_COLOR=true
+ENV USER=root
+
+COPY overlay/ /
+
+RUN apk add --update --no-cache --virtual .build-deps build-base libffi-dev musl-dev openssl-dev python3-dev cargo && \
+    apk add --update --no-cache git openssh-client && \
+    apk upgrade --no-cache libexpat && \
+    echo "Installing requirements ..." && \
+    pip install -qq --no-cache-dir --upgrade pip && \
+    pip install -qq --no-cache-dir boto boto3 botocore apache-libcloud hcloud \
+        flaky passlib pytest pytest-testinfra && \
+    echo "Installing ansible 'v$ANSIBLE_VERSION' ..." && \
+    pip install -qq --no-cache-dir ansible=="$ANSIBLE_VERSION" && \
+    echo "Installing molecule version 'v$MOLECULE_VERSION' ..." && \
+    pip install -qq --no-cache-dir molecule=="$MOLECULE_VERSION" molecule-plugins[docker] molecule_hetznercloud; \
+    apk del .build-deps && \
+    rm -rf /var/cache/apk/* && \
+    rm -rf /tmp/* && \
+    rm -rf /root/.cache/
+
+USER root
+CMD []
+ENTRYPOINT ["/bin/molecule"]

Dockerfile

@@ -1,49 +0,0 @@
-FROM python:3.9-alpine
-
-LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
-LABEL org.opencontainers.image.title="molecule"
-LABEL org.opencontainers.image.url="https://gitea.rknet.org/docker/molecule"
-LABEL org.opencontainers.image.source="https://gitea.rknet.org/docker/molecule"
-LABEL org.opencontainers.image.documentation="https://gitea.rknet.org/docker/molecule"
-
-ARG ANSIBLE_VERSION
-ARG BUILD_VERSION
-
-# renovate: datasource=pypi depName=molecule
-ENV MOLECULE_VERSION="${BUILD_VERSION:-3.2.1}"
-# renovate: datasource=pypi depName=ansible
-ENV ANSIBLE_VERSION="${ANSIBLE_VERSION:-2.10.4}"
-
-ENV PY_COLORS=1 \
-    ANSIBLE_FORCE_COLOR=true \
-    USER=root \
-    PATH=/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin
-
-COPY overlay/ /
-
-RUN apk add --update --no-cache --virtual .build-deps gcc make libffi-dev musl-dev \
-    openssl-dev python3-dev && \
-    apk add --update --no-cache git openssh-client && \
-    echo "Installing ansible 'v$ANSIBLE_VERSION' ..." && \
-    pip install -qq --upgrade --no-cache-dir pip setuptools~=49.0 requests~=2.23 && \
-    pip install -qq --no-cache-dir ansible=="$ANSIBLE_VERSION" && \
-    echo "Installing requirements ..." && \
-    MOLECULE_VERSION="${MOLECULE_VERSION##v}" && \
-    MOLECULE_MAJOR="${MOLECULE_VERSION%%.*}" && \
-    pip install -qq --no-cache-dir -r /root/requirements.txt && \
-    if [ -z "${MOLECULE_MAJOR//[0-9]}" ] && [ -n "$MOLECULE_MAJOR" ]; then \
-        echo "Installing molecule version '$MOLECULE_VERSION' ..." && \
-        pip install -qq --no-cache-dir molecule[docker,podman,lint]=="$MOLECULE_VERSION"; \
-    else \
-        echo "Installing latest molecule ..." && \
-        pip install -qq --no-cache-dir molecule; \
-    fi && \
-    apk del .build-deps && \
-    rm -rf /var/cache/apk/* && \
-    rm -rf /tmp/* && \
-    rm -rf /root/.cache/
-
-USER root
-CMD []
-ENTRYPOINT ["/bin/molecule"]

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Robert Kaussow <mail@geeklabor.de>
+Copyright (c) 2022 Robert Kaussow <mail@thegeeklab.de>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,14 +1,18 @@
 # molecule
 
-Custom image for Molecule Ansible test automation
+Custom image for Ansible Molecule test automation
 
-[![Build Status](https://img.shields.io/drone/build/docker/molecule?logo=drone&server=https%3A%2F%2Fdrone.rknet.org)](https://drone.rknet.org/docker/molecule)
+<!-- spellchecker-disable -->
+
+[![Build Status](https://ci.rknet.org/api/badges/container/molecule/status.svg)](https://ci.rknet.org/repos/container/molecule)
 [![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/molecule)
 [![Quay.io](https://img.shields.io/badge/quay-latest-blue.svg?logo=docker&logoColor=white)](https://quay.io/repository/thegeeklab/molecule)
-[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/docker/molecule)
+[![Source: Gitea](https://img.shields.io/badge/source-gitea-blue.svg?logo=gitea&logoColor=white)](https://gitea.rknet.org/container/molecule)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/docker/molecule/src/branch/master/LICENSE)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://gitea.rknet.org/container/molecule/src/branch/main/LICENSE)
 
-Custom Docker image to automate Ansible deployment tests with [Molecule](https://molecule.readthedocs.io/en/latest/).
+<!-- spellchecker-enable -->
+
+Custom container image to automate Ansible deployment tests with [Molecule](https://ansible.readthedocs.io/projects/molecule/).
 
 ## Environment variables
 
@@ -34,4 +38,4 @@ MOLECULE_ANSIBLE_VAULT_PASSWORD=my_secret
 
 ## License
 
-This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/docker/molecule/src/branch/master/LICENSE) file for details.
+This project is licensed under the MIT License - see the [LICENSE](https://gitea.rknet.org/container/molecule/src/branch/main/LICENSE) file for details.

overlay/bin/molecule

@@ -1,5 +1,5 @@
 #!/usr/bin/env sh
-# shellcheck disable=2039
+# shellcheck disable=2039,3040
 set -eo pipefail
 
 DIR=$(pwd)
@@ -11,7 +11,7 @@ if [ -n "${MOLECULE_CUSTOM_MODULES_REPO}" ]; then
     WORKDIR="${MOLECULE_LIBRARY_DIR}"
     [ -d "$WORKDIR" ] && rm -rf "$WORKDIR"
     mkdir -p "$WORKDIR"
-    git clone "$MOLECULE_CUSTOM_MODULES_REPO" "$WORKDIR" 2> /dev/null
+    git clone "$MOLECULE_CUSTOM_MODULES_REPO" "$WORKDIR" 2>/dev/null
 fi
 
 if [ -n "${MOLECULE_CUSTOM_FILTERS_REPO}" ]; then
@@ -19,13 +19,13 @@ if [ -n "${MOLECULE_CUSTOM_FILTERS_REPO}" ]; then
     printf "Cloning custom filters ...\n"
     [ -d "$WORKDIR" ] && rm -rf "$WORKDIR"
     mkdir -p "$WORKDIR"
-    git clone "$MOLECULE_CUSTOM_FILTERS_REPO" "$WORKDIR" 2> /dev/null
+    git clone "$MOLECULE_CUSTOM_FILTERS_REPO" "$WORKDIR" 2>/dev/null
 fi
 
 if [ -n "${MOLECULE_ANSIBLE_VAULT_PASSWORD}" ]; then
     printf "Write vault password file ...\n"
     MOLECULE_ANSIBLE_VAULT_PASSWORD_FILE=/root/.vaultpasswd
-    echo "${MOLECULE_ANSIBLE_VAULT_PASSWORD}" > $MOLECULE_ANSIBLE_VAULT_PASSWORD_FILE
+    echo "${MOLECULE_ANSIBLE_VAULT_PASSWORD}" >$MOLECULE_ANSIBLE_VAULT_PASSWORD_FILE
     exec env ANSIBLE_VAULT_PASSWORD_FILE=$MOLECULE_ANSIBLE_VAULT_PASSWORD_FILE /usr/local/bin/molecule "$@"
 else
     exec /usr/local/bin/molecule "$@"

overlay/root/requirements.txt

@@ -1,15 +0,0 @@
-# linter
-testinfra
-flake8
-yamllint
-ansible-lint
-
-# cloud provider deps
-boto
-boto3
-botocore
-apache-libcloud
-hcloud
-
-# misc
-pycrypto

renovate.json

@@ -1,16 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:base"],
+  "extends": ["github>thegeeklab/renovate-presets:docker"]
-  "ignorePresets": [":prHourlyLimit2"],
-  "regexManagers": [
-    {
-      "fileMatch": ["^Dockerfile$"],
-      "matchStrings": [
-        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>.*?))?\\nENV .*?_VERSION=\"\\${.*:-(?<currentValue>.*)}\"\\s"
-      ]
-    }
-  ],
-  "droneci": {
-    "enabled": false
-  }
 }

trivy-secret.yaml

@@ -0,0 +1,6 @@
+---
+allow-rules:
+  - id: private-key
+    path: .*/ansible/.*/site-packages/ansible_collections/(community|google|netapp)/.*\.py
+  - id: aws-secret-access-key
+    path: .*/ansible/.*/site-packages/ansible_collections/amazon/.*\.py

trivy.yaml

@@ -0,0 +1,4 @@
+---
+scan:
+  skip-files:
+    - /usr/local/bin/gomplate