Merge pull request 'chore(deps): update dependency npm to v11.3.0' (#203) from renovate/npm-11.x into master

Reviewed-on: #203

.gitignore

@@ -1 +1,2 @@
 .envrc
+**/target/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "images/mx-puppet-steam"]
+	path = images/mx-puppet-steam
+	url = https://github.com/blueperil/mx-puppet-steam

Justfile

@@ -3,10 +3,23 @@ target := 'main'
 
 # Internal endpoint of the Docker registry, where no authentication is necessary
 registry_url := env_var_or_default('REGISTRY_URL', 'docker.io/')
-repo_url := shell("git remote get-url origin | sed 's|git@\\([^:]*\\):\\(.*\\).git|https://\\1/\\2|'")
+registry_mirror_url := env_var_or_default('REGISTRY_MIRROR_URL', '')
+forgejo_api_key := env_var("FORGEJO_API_KEY")
+forgejo_url := shell("git remote get-url origin | sed 's|git@\\([^:]*\\):\\(.*\\).git|https://\\1/\\2|' | cut -d'/' -f-3")
+repo_owner := shell("git remote get-url origin | sed 's|git@\\([^:]*\\):\\(.*\\).git|https://\\1/\\2|' | cut -d'/' -f4")
+repo_name := shell("git remote get-url origin | sed 's|git@\\([^:]*\\):\\(.*\\).git|https://\\1/\\2|' | cut -d'/' -f5-")
 
 pipeline_file := shell('mktemp')
 
+buildkit_config_tmpl := '''
+[registry."docker.io"]
+  mirrors = ["{{registry_mirror_url}}"]
+
+[registry."{{registry_mirror_url}}"]
+  http = true
+'''
+buildkit_config := replace(buildkit_config_tmpl, "{{registry_mirror_url}}", registry_mirror_url)
+
 build context dockerfile='' image_target='' *args='':
     fly -t {{target}} execute \
         --config=./tasks/build-image.yml \
@@ -16,21 +29,34 @@ build context dockerfile='' image_target='' *args='':
         -v context=repo/images/{{context}} \
         -v dockerfile={{dockerfile}} \
         -v target={{image_target}} \
+        -v registry_url={{registry_url}} \
+        -v 'buildkit_config={{buildkit_config}}' \
+        -v image_platform= \
         {{args}}
+    @echo "$(tput bold)Image built and downloaded to /tmp/build-image/. You can import it with 'docker image import /tmp/build-image/image.tar <tag>'$(tput sgr0)"
 
 make-pipeline file:
     jinja2 --strict --outfile="{{file}}" pipelines/build-and-push.yml.j2 pipelines/build-and-push.json
     fly -t {{target}} validate-pipeline \
         --strict \
         --config "{{file}}" \
-        -v registry_url={{registry_url}}
+        -v registry_url={{registry_url}} \
+        -v 'buildkit_config={{buildkit_config}}' \
+        -v forgejo_api_key={{forgejo_api_key}} \
+        -v forgejo_url={{forgejo_url}} \
+        -v repo_owner={{repo_owner}} \
+        -v repo_name={{repo_name}}
 
 set-pipeline: (make-pipeline pipeline_file)
     fly -t {{target}} set-pipeline \
         --pipeline {{pipeline_name}} \
         --config "{{pipeline_file}}" \
         -v registry_url={{registry_url}} \
-        -v repo_url={{repo_url}}
+        -v 'buildkit_config={{buildkit_config}}' \
+        -v forgejo_api_key={{forgejo_api_key}} \
+        -v forgejo_url={{forgejo_url}} \
+        -v repo_owner={{repo_owner}} \
+        -v repo_name={{repo_name}}
 
 validate:
     docker run --rm -v ./:/usr/src/app renovate/renovate renovate-config-validator --strict

images/beancount-import/.dockerignore

@@ -1,2 +0,0 @@
-Dockerfile
-.dockerignore

images/beancount-import/Dockerfile

@@ -1,24 +0,0 @@
-FROM python:3.12.5-slim
-
-COPY requirements.txt /tmp
-
-RUN set -eux; \
-    pip3 install --break-system-packages -r /tmp/requirements.txt; \
-    rm -rf \
-        /root/.cache \
-        /tmp/requirements.txt \
-        ;
-
-WORKDIR /beancount-import
-COPY . .
-
-ENV BEANCOUNT_IMPORT_ARGS="" \
-    BEANCOUNT_IMPORT_JOURNAL_DIR="/beancount-import/journal" \
-    BEANCOUNT_IMPORT_DATA_DIR="/beancount-import/data"
-
-EXPOSE 8080
-
-VOLUME ${BEANCOUNT_IMPORT_DATA_DIR}
-VOLUME ${BEANCOUNT_IMPORT_JOURNAL_DIR}
-
-CMD [ "python3", "/beancount-import/run.py", "--address", "0.0.0.0", "--port", "8080", "${BEANCOUNT_IMPORT_ARGS}" ]

images/beancount-import/_config.py

@@ -1,45 +0,0 @@
-"""
-This config is where you would initialize your importers with personal info
-like account number or credit card last4 digit.
-
-you may also define CONFIG:List[ImporterProtocol] for other beancount tools like
-bean-identify, bean-file, and other beancount scripts to use
-eg. `bean-identify _config.py ~/Downloads`
-to identify the files that importers defined here can process
-
-
-beancount-import should have it's own run.py where you invoke the
-`beancount_import.webserver.main` but import the Importer objects from this config
-
-This is the way!!
-"""
-from beancount.ingest.importers.csv import Importer as CSVImporter, Col
-
-my_foobar_bank_importer = CSVImporter(
-    {
-        Col.DATE: "Date",
-        Col.NARRATION1: "Description",
-        Col.AMOUNT: "Amount",
-    },
-    "Assets:FooBarBank",  # account
-    "EUR",  # currency
-    # regexps used by ImporterProtocol.identify() to identify the correct file
-    '"Date","Description","Amount"',
-)
-
-my_amex_cc_importer = CSVImporter(
-    {
-        Col.DATE: "Date",
-        Col.NARRATION1: "Description",
-        Col.AMOUNT: "Amount",
-        Col.BALANCE: "Balance",
-    },
-    "Liabilities:Amex-Credit-Card",  # account
-    "EUR",  # currency
-    # regexps used by ImporterProtocol.identify() to identify the correct file
-    ("Date,Description,Amount,Balance", "Credit.*7890"),
-    skip_lines=1,
-)
-
-# beancount's scripts use this
-CONFIG = [my_foobar_bank_importer, my_amex_cc_importer]

images/beancount-import/requirements.txt

@@ -1,5 +0,0 @@
-# beancount-import doesn't specify this constraint itself, but is also
-# not compatible with v3. So we need to ensure this here.
-beancount<3.0.0
-beancount-import==1.4.0
-smart_importer==0.5

images/beancount-import/run.py

@@ -1,31 +0,0 @@
-#!/usr/bin/env python3
-
-import os
-import sys
-
-from _config import data_sources
-
-
-def run_reconcile(extra_args):
-    import beancount_import.webserver
-
-    journal_dir = os.environ["BEANCOUNT_IMPORT_JOURNAL_DIR"]
-
-    beancount_import.webserver.main(
-        extra_args,
-        journal_input=os.path.join(journal_dir, "main.beancount"),
-        ignored_journal=os.path.join(journal_dir, "ignored.beancount"),
-        default_output=os.path.join(journal_dir, "main.beancount"),
-        open_account_output_map=[
-            (".*", os.path.join(journal_dir, "accounts.beancount")),
-        ],
-        balance_account_output_map=[
-            (".*", os.path.join(journal_dir, "accounts.beancount")),
-        ],
-        price_output=os.path.join(journal_dir, "prices.beancount"),
-        data_sources=data_sources,
-    )
-
-
-if __name__ == "__main__":
-    run_reconcile(sys.argv[1:])

images/fava/Dockerfile

@@ -1,59 +0,0 @@
-# renovate: datasource=github-tags depName=beancount packageName=beancount/beancount
-ARG BEANCOUNT_VERSION=2.3.6
-# renovate: datasource=github-tags depName=fava packageName=beancount/fava
-ARG FAVA_VERSION=1.28
-
-FROM node:20.17.0-slim AS node_build_env
-ARG FAVA_VERSION
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y python3-babel git make;
-
-RUN git clone --depth 1 --branch v${FAVA_VERSION} https://github.com/beancount/fava /tmp/build/fava;
-
-WORKDIR /tmp/build/fava
-RUN set -eux; \
-    make -j $(nproc); \
-    rm -rf .*cache .eggs .tox build dist frontend/node_modules; \
-    find . -type f -name '*.py[c0]' -delete; \
-    find . -type d -name "__pycache__" -delete;
-
-FROM python:3.12.5-slim AS build_env
-ARG BEANCOUNT_VERSION
-ENV PATH "/app/bin:$PATH"
-
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y build-essential libxml2-dev libxslt-dev curl git; \
-    python -mvenv /app;
-
-COPY --from=node_build_env /tmp/build/fava /tmp/build/fava
-
-RUN git clone --depth 1 --branch ${BEANCOUNT_VERSION} https://github.com/beancount/beancount /tmp/build/beancount;
-
-WORKDIR /tmp/build/beancount
-
-COPY requirements.txt ./
-
-RUN set -eux; \
-    CFLAGS=-s pip3 install -U /tmp/build/beancount; \
-    pip3 install -U /tmp/build/fava; \
-    pip3 install -r requirements.txt; \
-    pip3 uninstall -y pip; \
-    rm -r /app/share; \
-    find /app -name __pycache__ -exec rm -rf -v {} +
-
-FROM python:3.12.5-slim
-COPY --from=build_env /app /app
-
-# Default fava port number
-EXPOSE 5000
-
-ENV BEAN_ROOT ""
-ENV BEANCOUNT_FILE ""
-
-ENV FAVA_HOST "0.0.0.0"
-ENV PATH "/app/bin:$PATH"
-
-CMD ["fava"]

images/fava/requirements.txt

@@ -1,14 +0,0 @@
-# Ensure a compatible version of Beancount, including personal tooling
-beancount<3.0.0
-beancount-reds-plugins==0.3.0
-beanprice==1.2.1
-fava_envelope==0.5.9
-fava-investor==0.7.0
-# renovate: branch=main
-git+https://github.com/andreasgerstmayr/fava-dashboards.git@50a0b7c8b20e50b15bf491329e1ecab6598d8b96
-git+https://github.com/beancount/beangrow.git@56f1c2a62c808917fad66fbaa4aa4028a6d2def6
-# renovate: branch=main
-git+https://github.com/daniel-wells/beancount_checkclosed.git@5abc380703105c12b518144f83a5c4fe25cc8f39
-# renovate: branch=main
-git+https://github.com/PhracturedBlue/fava-portfolio-summary.git@fb31e371c9808a8a99ea02a60e3712271925d379
-git+https://github.com/scauligi/refried.git@b1b2a1fe1efd321142163ecc1796a38b71bb48b0

images/fluentd/Dockerfile

@@ -1,32 +0,0 @@
-FROM fluent/fluentd:v1.17.0-1.1
-
-USER root
-
-# The recommendation is to install gems here. But in practice,
-# the `geoip` plugin will fail if done so, because for unknown reasons,
-# it wouldn't be able to find the `geoip2_c` gem, even though that would
-# be installed successfully.
-# The only way to get that plugin working is to use the `--gemfile` flag
-# to have them installed at startup.
-# Hence why we need to blow up this image with a bunch of dev dependencies.
-RUN set -eux; \
-    apk add --no-cache --virtual .build-deps \
-        binutils \
-        autoconf \
-        automake \
-        gcc \
-        geoip-dev \
-        gettext \
-        libmaxminddb-dev \
-        libtool \
-        make \
-        musl-dev \
-        ruby-dev \
-        ; \
-    # fluentd needs this directory when installing Gems
-    mkdir /etc/fluentd; \
-    chown fluent:fluent /etc/fluentd
-
-USER fluent
-
-COPY Gemfile /etc/fluentd/Gemfile

images/fluentd/Gemfile

@@ -1,10 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'fluentd'
-gem 'geoip2_c'
-gem 'fluent-plugin-geoip'
-gem 'fluent-plugin-prometheus'
-gem 'fluent-plugin-ua-parser'
-gem 'fluent-plugin-grafana-loki'
-gem 'fluent-plugin-stdout-pp'
-gem 'fluent-plugin-parser-logfmt'

images/forgejo/Dockerfile

@@ -1,14 +0,0 @@
-FROM codeberg.org/forgejo/forgejo:8.0.1
-
-RUN apk --no-cache add \
-    asciidoctor \
-    freetype \
-    freetype-dev \
-    gcc \
-    g++ \
-    libpng \
-    libffi-dev \
-    py-pip \
-    python3-dev \
-    py3-pip \
-    py3-pyzmq

images/frp/Dockerfile

@@ -1,19 +0,0 @@
-# renovate: datasource=github-releases depName=frp packageName=fatedier/frp
-ARG FRP_VERSION=0.60.0
-
-FROM scratch AS src
-
-ARG FRP_VERSION
-ADD https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_amd64.tar.gz /frp.tar.gz
-
-
-FROM alpine:3.20
-
-ARG FRP_VERSION
-
-RUN --mount=from=src,target=/src <<EOF
-tar -xf /src/frp.tar.gz -C /usr/local/bin --strip-component=1 frp_${FRP_VERSION}_linux_amd64/frpc frp_${FRP_VERSION}_linux_amd64/frps
-EOF
-
-VOLUME /etc/frp
-WORKDIR /

images/gitea/Cargo.toml

@@ -8,13 +8,13 @@ edition = "2021"
 [dependencies]
 clap = { version = "4.2.0", features = ["cargo", "color", "unicode", "std", "derive"] }
 color-eyre = "0.6.2"
-reqwest = { version = "0.11.16", default-features = false, features = ["blocking", "json", "rustls-tls-native-roots"] }
+reqwest = { version = "0.12.7", default-features = false, features = ["blocking", "json", "rustls-tls-native-roots"] }
 serde_json = "1.0.95"
 serde = { version = "1.0.159", features = ["derive"] }
 time = { version = "0.3.20", features = ["formatting", "parsing", "serde"] }
 url = { version = "2.3.1", features = ["serde"] }
 cli-table = "0.4.7"
-globwalk = "0.8.1"
+globwalk = "0.9.0"
 
 [profile.release]
 strip = "debuginfo"

images/gitea/Dockerfile

@@ -1,40 +1,29 @@
-FROM rust:alpine AS builder
+FROM rust:1.85.0-alpine3.20 AS builder
 
-# Use a dummy project to ensure the crate index is up to date.
-RUN set -e; \
-    cargo new --color always /tmp/dummy; \
-    cargo add --color always --manifest-path /tmp/dummy/Cargo.toml serde; \
-    rm -rf /tmp/dummy; \
-    cargo new --color always --bin /app  
+RUN apk add --no-cache musl-dev;
 
 WORKDIR /app
-
-RUN apk add --no-cache \
-    # openssl-dev \
-    # pkgconfig \
-    musl-dev
-
-# Build dependencies with a dummy project to cache those regardless of changes
-# in the actual source code
-COPY ./Cargo.toml ./Cargo.lock /app/
-RUN cargo build --color always --release --locked
-
 COPY . .
-RUN touch -a -m ./src/main.rs && cargo build --color always --release --locked
 
-FROM alpine AS final
+RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry \
+    --mount=type=cache,id=cargo-target,target=/app/target \
+    set -e; \
+    cargo build --color always --release --locked; \
+    # The cache will disappear after this directive, so we
+    # need to copy the binary to a persistent place.
+    cp target/release/gitea /app/gitea;
 
-RUN apk add --no-cache ca-certificates
+FROM alpine:3.21.3 AS final
+
+RUN apk add --no-cache ca-certificates;
 
 ENV RUST_BACKTRACE=1
 ENV RUST_LOG=info
 
-COPY --from=builder /app/target/release/gitea /bin/
+COPY --from=builder /app/gitea /bin/
 
 # Put this last, as it's the only thing that's different between variants.
 # This way, the previous layers can all be shared.
 
 ARG VARIANT="missing build arg 'VARIANT'"
-ARG VERSION="0.1.0"
-LABEL version="$VERSION"
 COPY ./shims/${VARIANT}/* /opt/resource/

images/gitea/src/cmd/package.rs

@@ -5,7 +5,7 @@ use std::path::Path;
 use cli_table::format::Justify;
 use cli_table::{Cell, Style, Table};
 use color_eyre::eyre::{self, Context};
-use color_eyre::{Help, Report, Result};
+use color_eyre::{Help, Report, Result, SectionExt as _};
 use globwalk::{DirEntry, GlobWalkerBuilder};
 use reqwest::StatusCode;
 use serde::{Deserialize, Serialize};
@@ -275,7 +275,10 @@ pub(crate) fn run(action: &Action) -> Result<()> {
             eyre::bail!("No data received on stdin");
         }
 
-        serde_json::from_str(&buf).wrap_err("Failed to parse stdin")?
+        serde_json::from_str(&buf)
+            .wrap_err("Failed to parse config")
+            .with_suggestion(|| "Double-check the `source` and `params` sections in your pipeline")
+            .with_section(|| buf.header("JSON"))?
     };
 
     match action {

images/gitea/src/cmd/pr.rs

@@ -5,7 +5,7 @@ use std::path::Path;
 use cli_table::format::Justify;
 use cli_table::{print_stderr, Cell, Style, Table};
 use color_eyre::eyre::{self, Context};
-use color_eyre::Result;
+use color_eyre::{Result, Section as _, SectionExt as _};
 use reqwest::blocking::Response;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
@@ -160,7 +160,10 @@ pub(crate) fn run(action: &Action) -> Result<()> {
             eyre::bail!("No data received on stdin");
         }
 
-        serde_json::from_str(&buf).wrap_err("Failed to parse stdin")?
+        serde_json::from_str(&buf)
+            .wrap_err("Failed to parse config")
+            .with_suggestion(|| "Double-check the `source` and `params` sections in your pipeline")
+            .with_section(|| buf.header("JSON"))?
     };
 
     match action {

images/gitea/src/cmd/status.rs

@@ -21,7 +21,6 @@ struct Source {
     owner: String,
     url: Url,
     repo: String,
-    sha: String,
     context: String,
     description: Option<String>,
     target_url: Option<String>,
@@ -51,6 +50,7 @@ impl std::fmt::Display for State {
 
 #[derive(Deserialize, Serialize, Debug)]
 struct Params {
+    sha: String,
     state: State,
     description: Option<String>,
 }
@@ -76,7 +76,7 @@ fn action_out(conf: Config, _dir: impl AsRef<Path>) -> Result<()> {
             // when `join`ing the file name later. Otherwise, the last component
             // would be considered a "file" part itself, and replaced by a future `join`.
             "api/v1/repos/{}/{}/statuses/{}",
-            conf.source.owner, conf.source.repo, conf.source.sha
+            conf.source.owner, conf.source.repo, params.sha
         ))
         .wrap_err("Invalid URL")?;
 
@@ -97,7 +97,7 @@ fn action_out(conf: Config, _dir: impl AsRef<Path>) -> Result<()> {
         StatusCode::CREATED => {
             eprintln!(
                 "Created status '{}' on commit '{}'",
-                params.state, conf.source.sha
+                params.state, params.sha
             );
         }
         StatusCode::BAD_REQUEST => {
@@ -144,7 +144,10 @@ pub(crate) fn run(action: &Action) -> Result<()> {
                 }
 
                 serde_json::from_str(&buf)
-                    .wrap_err("Failed to parse stdin")
+                    .wrap_err("Failed to parse config")
+                    .with_suggestion(|| {
+                        "Double-check the `source` and `params` sections in your pipeline"
+                    })
                     .with_section(|| buf.header("JSON"))?
             };
 

images/gotenberg/Dockerfile

@@ -1,19 +0,0 @@
-FROM gotenberg/gotenberg:8.9.1
-
-USER root
-
-RUN set -eux; \
-    apt-get update -qq; \
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends -t bookworm-backports libreoffice-l10n-de; \
-    sed -i '/de_DE.UTF-8/s/^# //g' /etc/locale.gen; \
-    locale-gen; \
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /var/log/*;
-
-# Adjust user for Unraid
-RUN usermod -u 2000 -g 100 gotenberg
-
-ENV LANG de_DE.UTF-8
-ENV LANGUAGE de_DE:de
-ENV LC_ALL de_DE.UTF-8
-
-USER gotenberg

images/lua-clib/Dockerfile

@@ -5,9 +5,9 @@ ARG LUA_5_4_VERSION=5.4.4
 # renovate: datasource=github-tags depName=luarocks packageName=luarocks/luarocks
 ARG LUAROCKS_VERSION=3.11.1
 # renovate: datasource=github-releases depName=dart-sass packageName=sass/dart-sass
-ARG DART_SASS_VERSION=1.77.8
+ARG DART_SASS_VERSION=1.86.3
 # renovate: datasource=github-tags depName=node packageName=nodejs/node versioning=node
-ARG NODE_VERSION=20.17.0
+ARG NODE_VERSION=22.14.0
 
 FROM debian:bookworm-slim AS builder
 

images/mx-puppet-steam

@@ -0,0 +1 @@
+Subproject commit a8c4b5732129a03d775dee14908dae0c0cee0122

images/nextcloud/Dockerfile

@@ -1,44 +0,0 @@
-FROM nextcloud:29.0.5-apache
-
-# renovate: datasource=github-releases depName=yt-dlp packageName=yt-dlp/yt-dlp versioning=loose
-ARG YTDLP_VERSION=2024.08.06
-# Debian ships node.js v18, make sure that the pageres version supports that
-# renovate: datasource=npm packageName=pageres-cli
-ARG PAGERES_VERSION=8.0.0
-
-RUN set -ex; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends --no-install-suggests \
-        aria2 \
-        cifs-utils \
-        clamav \
-        ffmpeg \
-        libnss3 \
-        libbz2-dev \
-        nodejs \
-        npm \
-        smbclient \
-        p7zip \
-        p7zip-full \
-        python3-pip \
-        unzip \
-        wget \
-        ; \
-    docker-php-ext-install bz2; \
-    npm install --global pageres-cli@${PAGERES_VERSION} puppeteer; \
-    npx puppeteer browsers install chrome; \
-    curl -L -o /usr/local/bin/youtube-dl https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/yt-dlp; \
-    chmod +rx /usr/local/bin/youtube-dl; \
-    apt-get remove -y --auto-remove ${PHPIZE_DEPS}; \
-    rm -rf \
-        /var/lib/apt/lists/* \
-        /var/log/*/.log /var/log/apt/* \
-        /usr/src/php.tar* \
-        /usr/share/man/* \
-        /usr/share/doc/* \
-        /usr/share/doc-base/* \
-        /usr/local/php/man/* \
-        /root/.cache \
-        /root/.npm
-
-COPY ./php-pgsql.ini /etc/php8/conf.d/pgsql.ini

images/nextcloud/php-pgsql.ini

@@ -1,11 +0,0 @@
-# configuration for PHP PostgreSQL module
-extension=pdo_pgsql.so
-extension=pgsql.so
-
-[PostgresSQL]
-pgsql.allow_persistent = On
-pgsql.auto_reset_persistent = Off
-pgsql.max_persistent = 25
-pgsql.max_links = 30
-pgsql.ignore_notice = 0
-pgsql.log_notice = 0

images/node-script/Dockerfile

@@ -1,7 +1,7 @@
-FROM node:20.17.0-slim
+FROM node:22.14.0-slim
 
 # renovate: datasource=npm packageName=npm versioning=npm
-ARG NPM_VERSION=10.8.2
+ARG NPM_VERSION=11.3.0
 # renovate: datasource=npm packageName=bluebird versioning=npm
 ARG BLUEBIRD_VERSION=3.7.2
 # renovate: datasource=npm packageName=lodash versioning=npm
@@ -9,11 +9,11 @@ ARG LODASH_VERSION=4.17.21
 # renovate: datasource=npm packageName=moment versioning=npm
 ARG MOMENT_VERSION=2.30.1
 # renovate: datasource=npm packageName=shelljs versioning=npm
-ARG SHELLJS_VERSION=0.8.5
+ARG SHELLJS_VERSION=0.9.2
 # renovate: datasource=npm packageName=js-yaml versioning=npm
 ARG JS_YAML_VERSION=4.1.0
 # renovate: datasource=npm packageName=got versioning=npm
-ARG GOT_VERSION=14.4.2
+ARG GOT_VERSION=14.4.7
 
 RUN set -e; \
     rm -r \

images/python-script/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12.5-slim-bookworm
+FROM python:3.13.3-slim-bookworm
 
 RUN set -e; \
     apt-get update -q; \
@@ -30,6 +30,5 @@ ENV PATH=/home/runner/.local/bin:$PATH
 
 COPY requirements.txt ./
 
-RUN set -e; \
-    pip install --user -r requirements.txt; \
-    rm -r /home/runner/.cache;
+RUN --mount=type=cache,id=pip-cache,target=/home/runner/.cache/pip \
+    pip install --user -r requirements.txt;

images/python-script/requirements.txt

@@ -1,7 +1,7 @@
-pip==24.2
-numpy==2.1.0
-httpie==3.2.3
-pyforgejo==1.0.2
+pip==25.0.1
+numpy==2.2.4
+httpie==3.2.4
+pyforgejo==2.0.0
 # httpie restricts this, so we need to do the same
 requests<2.31.0
 spotify==0.10.2

images/ruby-script/Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.3.4-slim-bookworm
+FROM ruby:3.4.2-slim-bookworm
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN --mount=type=cache,target=/var/cache/apt,id=apt \
@@ -6,6 +6,7 @@ RUN --mount=type=cache,target=/var/cache/apt,id=apt \
     apt-get update; \
     apt-get install -y --no-install-recommends --no-install-suggests \
         gcc \
+        libc6-dev \
         make \
         ; \
     apt-get clean; \

images/rust-xwin/Dockerfile

@@ -72,7 +72,6 @@ RUN set -eux; \
     update-alternatives --install /usr/bin/c++ c++ /usr/bin/clang++ 100; \
     update-alternatives --install /usr/bin/ld ld /usr/bin/ld.lld 100; \
     rustup target add x86_64-pc-windows-msvc; \
-    rustup default stable-x86_64-pc-windows-msvc; \
     rustup component add rust-src; \
     rustup update; \
     apt-get remove -y --auto-remove \

pipelines/build-and-push.json

@@ -21,36 +21,12 @@
             "name": "base"
         },
         {
-            "type": "simple",
-            "name": "nextcloud"
-        },
-        {
-            "type": "simple",
-            "name": "gotenberg"
-        },
-        {
-            "type": "simple",
-            "name": "fluentd"
-        },
-        {
-            "type": "simple",
-            "name": "forgejo"
-        },
-        {
-            "type": "simple",
-            "name": "beancount-import"
-        },
-        {
-            "type": "simple",
-            "name": "frp"
-        },
-        {
-            "type": "simple",
-            "name": "fava"
+            "type": "file",
+            "name": "rust-xwin"
         },
         {
             "type": "file",
-            "name": "rust-xwin"
+            "name": "gitea"
         }
     ]
 }

pipelines/build-and-push.yml.j2

@@ -1,10 +1,21 @@
 {%- import 'jobs/simple-image.yml.j2' as simple_image %}
-{%- macro simple_image_resource(name, registry_url) -%}
+{%- macro simple_image_resource(name) -%}
+  - name: status-{{name}}
+    type: gitea-status
+    source:
+      access_token: ((forgejo_api_key))
+      url: ((forgejo_url))
+      owner: ((repo_owner))
+      repo: ((repo_name))
+      type: generic
+      context: build/{{name}}
+      description: Building image {{name}}
+
   - name: image-{{ name }}
     type: registry-image
     icon: docker
     source:
-      repository: "{{ registry_url }}/{{ name }}"
+      repository: "((registry_url))/{{ name }}"
       tag: latest
 {% endmacro -%}
 ---
@@ -15,21 +26,25 @@ resource_types:
     source:
       repository: concourse/github-release-resource
 
+  - name: gitea-status
+    type: registry-image
+    source:
+      repository: ((registry_url))/gitea-status
+
 resources:
   - name: repo
     type: git
     icon: github
     source:
-      uri: ((repo_url))
+      uri: ((forgejo_url))/((repo_owner))/((repo_name))
       branch: master
 
-  {%- set registry_url = "((registry_url))" %}
   {% for img in images -%}
   {%- if img.type == "simple" %}
-  {{ simple_image_resource(img.name, registry_url) }}
+  {{ simple_image_resource(img.name) }}
   {%- elif img.type == "file" %}
   {%- import "jobs/" + img.name + ".yml.j2" as job %}
-  {{ job.resources(registry_url) }}
+  {{ job.resources() }}
   {%- endif %}
   {%- endfor %}
 
@@ -42,3 +57,5 @@ jobs:
   {{ job.jobs() }}
   {%- endif %}
   {% endfor %}
+
+{# vim: ft=yaml-jinja #}

pipelines/jobs/gitea.yml.j2

@@ -0,0 +1,91 @@
+{% macro resource(variant) -%}
+  - name: image-gitea-{{ variant }}
+    type: registry-image
+    icon: docker
+    source:
+      repository: "((registry_url))/gitea-{{ variant }}"
+      tag: latest
+{% endmacro %}
+
+{% macro build(variant) -%}
+      - task: build-gitea-{{ variant }}
+        file: repo/tasks/build-image.yml
+        privileged: true
+        vars:
+          context: repo/images/gitea
+          target: ''
+          dockerfile: ''
+          registry_url: "((registry_url))"
+          buildkit_config: "((buildkit_config))"
+          image_platform: ''
+        params:
+          BUILD_ARG_VARIANT: {{ variant }}
+        output_mapping:
+          image: image-gitea-{{ variant }}
+{% endmacro %}
+
+{% macro put(variant) -%}
+            - put: image-gitea-{{ variant }}
+              inputs: detect
+              params: { image: image-gitea-{{ variant }}/image.tar }
+              no_get: true
+{% endmacro %}
+
+{% macro resources() -%}
+  - name: status-gitea
+    type: gitea-status
+    source:
+      access_token: ((forgejo_api_key))
+      url: ((forgejo_url))
+      owner: ((repo_owner))
+      repo: ((repo_name))
+      type: generic
+      context: build/gitea
+      description: Building images gitea-package, gitea-pr, gitea-status
+
+  {{ resource('package') }}
+  {{ resource('status') }}
+  {{ resource('pr') }}
+{% endmacro %}
+
+{% macro jobs(registry_url) -%}
+  - name: gitea
+    serial: true
+    on_success:
+      put: state-success
+      resource: status-gitea
+      no_get: true
+      params:
+        state: success
+        sha: ((.:git_sha))
+
+    on_failure:
+      put: state-failure
+      resource: status-gitea
+      no_get: true
+      params:
+        state: failure
+        sha: ((.:git_sha))
+
+    plan:
+      - get: repo
+        trigger: true
+      - load_var: git_sha
+        file: repo/.git/ref
+      - put: state-pending
+        resource: status-gitea
+        no_get: true
+        params:
+          state: pending
+          sha: ((.:git_sha))
+      {{ build('package') }}
+      {{ build('status') }}
+      {{ build('pr') }}
+      - in_parallel:
+          steps:
+            {{ put('package') }}
+            {{ put('status') }}
+            {{ put('pr') }}
+{% endmacro %}
+
+{# vim: ft=yaml-jinja #}

pipelines/jobs/rust-xwin.yml.j2

@@ -1,25 +1,60 @@
-{% macro resources(registry_url) -%}
+{% macro resources() -%}
+  - name: status-rust-xwin
+    type: gitea-status
+    source:
+      access_token: ((forgejo_api_key))
+      url: ((forgejo_url))
+      owner: ((repo_owner))
+      repo: ((repo_name))
+      type: generic
+      context: build/rust-xwin
+      description: Building image rust-xwin
+
   - name: image-rust-xwin
     type: registry-image
     icon: docker
     source:
-      repository: "{{ registry_url }}/rust-xwin"
+      repository: "((registry_url))/rust-xwin"
       tag: latest
 
   - name: image-rust-xwin-ci
     type: registry-image
     icon: docker
     source:
-      repository: "{{ registry_url }}/rust-xwin-ci"
+      repository: "((registry_url))/rust-xwin-ci"
       tag: latest
 {% endmacro %}
 
 {% macro jobs() -%}
   - name: rust-xwin
     serial: true
+    on_success:
+      put: state-success
+      resource: status-rust-xwin
+      no_get: true
+      params:
+        state: success
+        sha: ((.:git_sha))
+
+    on_failure:
+      put: state-failure
+      resource: status-rust-xwin
+      no_get: true
+      params:
+        state: failure
+        sha: ((.:git_sha))
+
     plan:
       - get: repo
         trigger: true
+      - load_var: git_sha
+        file: repo/.git/ref
+      - put: state-pending
+        resource: status-rust-xwin
+        no_get: true
+        params:
+          state: pending
+          sha: ((.:git_sha))
       - task: build-rust-xwin
         file: repo/tasks/build-image.yml
         privileged: true
@@ -27,6 +62,9 @@
           context: repo/images/rust-xwin
           target: rust-xwin
           dockerfile: ''
+          registry_url: "((registry_url))"
+          buildkit_config: "((buildkit_config))"
+          image_platform: ''
         output_mapping:
           image: image-rust-xwin
       - task: build-rust-xwin-ci
@@ -36,6 +74,9 @@
           context: repo/images/rust-xwin
           target: rust-xwin-ci
           dockerfile: ''
+          registry_url: "((registry_url))"
+          buildkit_config: "((buildkit_config))"
+          image_platform: ''
         output_mapping:
           image: image-rust-xwin-ci
       - in_parallel:
@@ -49,3 +90,5 @@
               params: { image: image-rust-xwin-ci/image.tar }
               no_get: true
 {% endmacro %}
+
+{# vim: ft=yaml-jinja #}

pipelines/jobs/simple-image.yml.j2

@@ -1,9 +1,33 @@
 {% macro jobs(job) -%}
   - name: {{ job.name }}
     serial: true
+    on_success:
+      put: state-success
+      resource: status-{{ job.name }}
+      no_get: true
+      params:
+        state: success
+        sha: ((.:git_sha))
+
+    on_failure:
+      put: state-failure
+      resource: status-{{ job.name }}
+      no_get: true
+      params:
+        state: failure
+        sha: ((.:git_sha))
+
     plan:
       - get: repo
         trigger: true
+      - load_var: git_sha
+        file: repo/.git/ref
+      - put: state-pending
+        resource: status-{{ job.name }}
+        no_get: true
+        params:
+          state: pending
+          sha: ((.:git_sha))
       - task: build-image
         privileged: true
         file: repo/tasks/build-image.yml
@@ -11,6 +35,9 @@
           context: repo/images/{{ job.name }}
           dockerfile: ''
           target: ''
+          registry_url: "((registry_url))"
+          buildkit_config: "((buildkit_config))"
+          image_platform: "{% if "platform" in job %}{{job.platform}}{% endif %}"
         {%- if "args" in job %}
         params:
         {%- for name, value in job.args.items() %}
@@ -19,6 +46,10 @@
         {%- endif %}
       - put: image-{{ job.name }}
         inputs: detect
-        params: { image: image/image.tar }
+        params: { image: image/image }
+        get_params:
+          format: oci
         no_get: true
 {%- endmacro -%}
+
+{# vim: ft=yaml-jinja #}

tasks/build-image.yml

@@ -6,7 +6,7 @@ image_resource:
   name: image
   type: registry-image
   source:
-    repository: concourse/oci-build-task
+    repository: ((registry_url))/oci-build-task
     tag: latest
 
 inputs:
@@ -23,6 +23,9 @@ params:
   CONTEXT: ((context))
   DOCKERFILE: ((dockerfile))
   TARGET: ((target))
+  OUTPUT_OCI: "true"
+  BUILDKIT_EXTRA_CONFIG: ((buildkit_config))
+  IMAGE_PLATFORM: ((image_platform))
 
 run:
   path: build