Merge pull request 'fix(ci): SHA corrompu pour anothrNick/github-tag-action (job tag casse sur master)' (#29 ) from fix/ci-tag-action-sha into master

Reviewed-on: #29
fix(ci): correct handed-corrupted SHA for anothrNick/github-tag-action
2026-09-15 17:39:46 -04:00 · 2026-09-13 14:57:01 +00:00 · 2026-09-13 10:46:25 -04:00 · 2026-09-13 14:41:49 +00:00
5 changed files with 9 additions and 7 deletions
@@ -11,7 +11,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Hadolint
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        continue-on-error: true

  build:
@@ -10,7 +10,7 @@ jobs:
    continue-on-error: true
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile

@@ -40,7 +40,7 @@ jobs:
      - name: Configure git auth
        run: |
          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@scm.cabillot.eu/perso/mysql-client.git"
-      - uses: anothrNick/github-tag-action@4ed44965e0db2c5b5e8b8c7c7c8c9c9c9c9c9c9c9 # v1.75.0
+      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DEFAULT_BUMP: patch
@@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        with:
          dockerfile: Dockerfile

@@ -12,7 +12,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Hadolint
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
        continue-on-error: true

  build:
@@ -4,8 +4,10 @@ LABEL maintainer="Cabillot Julien <dockerimages@cabillot.eu>"
 # hadolint ignore=DL3018
 RUN apk add --no-cache mysql-client && \
    rm -rf /usr/share/apk/keys && \
-    adduser -D muser
+    addgroup -g 1000 muser && \
+    adduser -D -u 1000 -G muser muser

-USER muser
+# Numeric uid/gid (DL3066): identity stays resolvable by the host
+USER 1000:1000

 ENTRYPOINT [ "/usr/bin/mysql" ]
Author	SHA1	Message	Date
jcabillot	2f1f4d7320	Merge pull request 'fix(ci): SHA corrompu pour anothrNick/github-tag-action (job tag casse sur master)' (#29 ) from fix/ci-tag-action-sha into master Main Release / hadolint (push) Successful in 22s Details Main Release / test (push) Successful in 1m5s Details Main Release / build (push) Successful in 38s Details Renovate / renovate (push) Successful in 1m30s Details Main Release / tag (push) Successful in 23s Details Reviewed-on: #29	2026-09-15 17:39:46 -04:00
OpenCode Cabillot	42ff058a6f	fix(ci): correct handed-corrupted SHA for anothrNick/github-tag-action PR Checks / hadolint (pull_request) Successful in 12s Details PR Checks / build-test (pull_request) Successful in 26s Details The tag job in main.yaml references anothrNick/github-tag-action@4ed44965e0 which does not exist upstream: the runner fails with Unable to resolve 4ed44965...: reference not found ##[error]reference not found The first 12 chars match the real commit, the rest is fabricated - the signature of a hand-rewritten YAML (commit `5e1827b` re-added the step with a bad SHA after `8b583cc` had removed it). The correct commit for tag v1.75.0 is 4ed44965e0db8dab2b466a16da04aec3cc312fd8. Impact: main.yaml has been red on every push to master since (runs 8197 and 8616: hadolint/test/build green, tag failed), so no release tag is created and tag.yaml never runs -> no release build pushed to Docker Hub. Verified against the upstream repo: tag 1.75.0 (and the v1 alias) both point at 4ed44965e0db8dab2b466a16da04aec3cc312fd8.	2026-09-13 14:57:01 +00:00
jcabillot	d2b11aefeb	Merge pull request 'fix(docker): numeric uid/gid pour hadolint DL3066 + bump hadolint-action v3.5.0' (#27 ) from fix/dl3066-numeric-uid into master Main Release / hadolint (push) Successful in 8s Details Renovate / renovate (push) Successful in 22s Details Main Release / test (push) Successful in 30s Details Main Release / build (push) Successful in 28s Details Main Release / tag (push) Failing after 8s Details Reviewed-on: #27	2026-09-13 10:46:25 -04:00
OpenCode Cabillot	fb061f33a1	fix(docker): pin numeric uid/gid so hadolint DL3066 passes PR Checks / hadolint (pull_request) Successful in 11s Details PR Checks / build-test (pull_request) Successful in 31s Details hadolint 2.15.x - pulled in by hadolint-action v3.5.0 - adds DL3066 ("Non-numeric user-id may not be resolvable by host system"). The Dockerfile's `USER muser` trips it and the hadolint job exits 1 (hadolint fails on info-level findings by default), turning the PR Checks pipeline red on the Renovate bump PR. muser was created without an explicit uid/gid, so its numeric identity depended on busybox's auto-assignment. Both ids are now pinned at 1000:1000 - the values Alpine was already assigning - and USER uses the numeric form, which is always resolvable by the host. Verified with the upstream hadolint v2.15.1 binary: the previous Dockerfile reports "Dockerfile:9 DL3066 info" and exits 1, the fixed one lints clean and exits 0. The hadolint-action v3.3.0 -> v3.5.0 bump is included here (all four workflows, SHA 06be81ba) so that master ends up on v3.5.0 with a clean lint - superseding Renovate PR #23.	2026-09-13 14:41:49 +00:00