ci(tag): dispatch Renovate on tf-depl-kubernetes once the release image is pushed

A release only reached perso_private/tf-depl-kubernetes on the next hourly
Renovate scan, so the image bump PR could lag up to an hour behind the tag.

After the image push completes, dispatch that repo's Renovate workflow through
the Gitea API (workflow_dispatch is already enabled there). It authenticates
with the RENOVATE_TOKEN org secret of this organisation — the same token the
Renovate instance itself uses, no extra credential. The job fails loudly so a
rotated token shows up instead of the trigger silently going missing.

.gitea/workflows/cron.yaml

@@ -0,0 +1,53 @@
+name: Nightly Rebuild
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        with:
+          dockerfile: Dockerfile
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - run: docker build -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}
+
+  build-push:
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - id: get-latest-tag
+        run: |
+          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+      - id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+        with:
+          images: jcabillot/phpapache
+          tags: |
+            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}  type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true

.gitea/workflows/docker-build.yaml

@@ -1,46 +0,0 @@
-name: Docker Build and Push
-
-on:
-  pull_request:
-    branches: [master]
-  push:
-    branches: [master]
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: jcabillot/phpapache
-          tags: |
-            #type=ref,event=branch
-            #type=ref,event=pr
-            #type=sha
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          pull: true

.gitea/workflows/main.yaml

@@ -0,0 +1,49 @@
+name: Main Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        with:
+          dockerfile: Dockerfile
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - run: docker build -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}
+
+  build:
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - run: docker build -t jcabillot/phpapache:${{ github.sha }} .
+
+  tag:
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Configure git auth
+        run: |
+          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/web/phpapache.git"
+      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
+          DEFAULT_BUMP: patch
+          RELEASE_BRANCHES: master
+          WITH_V: true
+          GIT_API_TAGGING: false

.gitea/workflows/pr.yaml

@@ -0,0 +1,23 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [master]
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - run: docker build -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}

.gitea/workflows/renovate.yaml

@@ -0,0 +1,12 @@
+name: Renovate
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    uses: perso/gitea-pipelines/.gitea/workflows/renovate.yaml@main
+    secrets: inherit

.gitea/workflows/tag.yaml

@@ -0,0 +1,67 @@
+name: Tag Release
+
+on:
+  push:
+    tags: ['*']
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
+        with:
+          dockerfile: Dockerfile
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - run: docker build -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}
+
+  build-push:
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+        with:
+          images: jcabillot/phpapache
+          tags: |
+            type=ref,event=tag
+            type=ref,event=tag,suffix=-latest
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true
+
+  trigger-renovate:
+    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
+    # Renovate instance only scans hourly, so this dispatch opens the image bump
+    # PR within minutes of the release instead of up to an hour later.
+    needs: [build-push]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
+        # needs: build-push — Renovate reads Docker Hub, so a scan started before
+        # the push lands would only see the previous release.
+        # RENOVATE_TOKEN is the org-level secret of this organisation.
+        run: |
+          curl -sS -f -X POST \
+            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{{"ref":"main"}}' \
+            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
+          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"

.gitlab-ci.yml

@@ -1,33 +0,0 @@
-image: docker:latest
-
-services:
-  - docker:dind
-
-before_script:
-  - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
-
-build-master:
-  stage: build
-  script:
-    - docker build --pull -t "$CI_REGISTRY_IMAGE" .
-    - docker push "$CI_REGISTRY_IMAGE"
-  only:
-    - master
-
-build-master-arm64:
-  stage: build
-  tags:
-    - arm64
-  script:
-    - docker build --pull -t "$CI_REGISTRY_IMAGE:arm64" .
-    - docker push "$CI_REGISTRY_IMAGE:arm64"
-  only:
-    - master
-
-build:
-  stage: build
-  script:
-    - docker build --pull -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG" .
-    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
-  except:
-    - master

Dockerfile

@@ -1,11 +1,12 @@
-FROM "php:8.3-apache"
+FROM php:8.5-apache
 LABEL maintainer="Julien Cabillot <dockerimages@cabillot.eu>"
 
+# hadolint ignore=DL3008,DL3015,SC3009
 RUN export DEBIAN_FRONTEND="noninteractive" && \
     sed -i'' 's/ServerSignature On/ServerSignature Off/; s/ServerTokens OS/ServerTokens Prod/' "/etc/apache2/conf-enabled/security.conf" && \
     sed -i'' 's/^Listen 80$/Listen 8080/' "/etc/apache2/ports.conf" && \
     sed -i'' 's/^<VirtualHost \*:80>$/<VirtualHost *:8080>/' '/etc/apache2/sites-enabled/000-default.conf' && \
-    echo "RemoteIPHeader X-Forwarded-For\nRemoteIPProxiesHeader X-Forwarded-By\nRemoteIPInternalProxy 10.0.0.0/8\nRemoteIPInternalProxy 192.168.0.0/16\nRemoteIPInternalProxy 172.16.0.0/12" > "${APACHE_CONFDIR}/conf-available/remoteip.conf" && \
+    printf 'RemoteIPHeader X-Forwarded-For\nRemoteIPProxiesHeader X-Forwarded-By\nRemoteIPInternalProxy 10.0.0.0/8\nRemoteIPInternalProxy 192.168.0.0/16\nRemoteIPInternalProxy 172.16.0.0/12\n' > "${APACHE_CONFDIR}/conf-available/remoteip.conf" && \
     sed -i'' 's/\(LogFormat "%h.*combined\)/LogFormat "%a %l %u %t \\"%r\\" %>s %O \\"%{Referer}i\\" \\"%{User-Agent}i\\"" combined/' "${APACHE_CONFDIR}/apache2.conf" && \
     echo 'AddType video/mp4 .mp4' >> /etc/apache2/sites-enabled/000-default.conf && \
     a2enconf remoteip && \
@@ -29,7 +30,7 @@ RUN export DEBIAN_FRONTEND="noninteractive" && \
         s#^(\s*CustomLog)\s+\S+#\1 /proc/self/fd/1#g; \
         s#^(\s*ErrorLog)\s+\S+#\1 /proc/self/fd/2#g; \
         ' "/etc/apache2/sites-enabled/000-default.conf" && \
-    echo "error_reporting=E_ALL\nerror_log=/proc/self/fd/2\nlog_errors=On\nexpose_php=Off" > "/usr/local/etc/php/conf.d/override.ini" && \
+    printf 'error_reporting=E_ALL\nerror_log=/proc/self/fd/2\nlog_errors=On\nexpose_php=Off\n' > "/usr/local/etc/php/conf.d/override.ini" && \
     docker-php-ext-configure pcntl --enable-pcntl && \
     docker-php-ext-install pcntl
 
@@ -39,8 +40,7 @@ CMD [ "docker-php-entrypoint", "apache2-foreground" ]
 
 # C'est dommage mais il n'est pas possible de faire unexpose :
 # https://github.com/moby/moby/issues/3465
-EXPOSE "8080/tcp"
+EXPOSE 8080/tcp
 
 # TODO: à remettre une fois le bug corrigé
-#HEALTHCHECK --interval="5s" \
-#    CMD curl --fail "http://localhost:8080" || exit 1
+#HEALTHCHECK --interval=5s -- CMD curl --fail http://localhost:8080 || exit 1

Jenkinsfile

@@ -1,38 +0,0 @@
-pipeline {
-  environment {
-    registry = 'https://registry.hub.docker.com'
-    registryCredential = 'dockerhub_jcabillot'
-    dockerImage = 'jcabillot/phpapache'
-  }
-
-  agent any
-
-  triggers {
-    cron('@midnight')
-  }
-
-  stages {
-    stage('Clone repository') {
-      steps{
-        checkout scm
-      }
-    }
-
-    stage('Build image') {
-      steps{
-        sh 'docker build --force-rm --no-cache --pull -t ${dockerImage} .'
-      }
-    }
-
-    stage('Deploy Image') {
-      steps{
-        script {
-          withCredentials([usernamePassword(credentialsId: 'dockerhub_jcabillot', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
-            sh 'docker login --username ${DOCKER_USER} --password ${DOCKER_PASS}'
-            sh 'docker push ${dockerImage}'
-          }
-        }
-      }
-    }
-  }
-}

tests/test.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE="${1:?Usage: test.sh <image>}"
+CONTAINER_NAME="test-$(echo "$IMAGE" | tr ':/' '-')-$$"
+PASSED=0
+FAILED=0
+TOTAL=0
+
+cleanup() {
+  docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+assert() {
+  local name="$1" expected="$2" actual="$3"
+  TOTAL=$((TOTAL + 1))
+  if [ "$expected" = "$actual" ]; then
+    echo "  PASS: $name"
+    PASSED=$((PASSED + 1))
+  else
+    echo "  FAIL: $name (expected: '$expected', got: '$actual')"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+assert_in() {
+  local name="$1" expected="$2" actual="$3"
+  TOTAL=$((TOTAL + 1))
+  if [ "$actual" -ge "$expected" ] && [ "$actual" -lt 500 ]; then
+    echo "  PASS: $name (got: $actual)"
+    PASSED=$((PASSED + 1))
+  else
+    echo "  FAIL: $name (expected < 500, got: $actual)"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+assert_match() {
+  local name="$1" pattern="$2" actual="$3"
+  TOTAL=$((TOTAL + 1))
+  if echo "$actual" | grep -qE "$pattern"; then
+    echo "  PASS: $name"
+    PASSED=$((PASSED + 1))
+  else
+    echo "  FAIL: $name (pattern: '$pattern', got: '$actual')"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+echo "Running container: $IMAGE"
+docker run -d --name "$CONTAINER_NAME" -p 8080:8080 "$IMAGE" >/dev/null
+
+DOCKER_GW=$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}')
+BASE_URL="http://${DOCKER_GW}:8080"
+
+echo "Waiting for container on ${DOCKER_GW}:8080..."
+for i in $(seq 1 30); do
+  if curl -sf -o /dev/null "$BASE_URL/" 2>/dev/null || [ "$(curl -s -o /dev/null -w '%{http_code}' "$BASE_URL/" 2>/dev/null)" != "000" ]; then
+    echo "Container ready after ${i}s"
+    break
+  fi
+  if [ "$i" -eq 30 ]; then
+    echo "FAIL: Container did not become ready within 30s"
+    docker logs "$CONTAINER_NAME"
+    exit 1
+  fi
+  sleep 1
+done
+
+echo ""
+echo "Test: GET / (Apache responds on port 8080)"
+RESPONSE=$(curl -s -D - "$BASE_URL/")
+STATUS=$(echo "$RESPONSE" | head -1 | grep -oP '\d{3}')
+SERVER=$(echo "$RESPONSE" | grep -i '^server:' | tr -d '\r' | cut -d: -f2- | xargs)
+
+assert_in "HTTP status is valid" 200 "$STATUS"
+assert_match "Server is Apache" "[Aa]pache" "$SERVER"
+
+echo ""
+echo "Results: $PASSED/$TOTAL passed, $FAILED failed"
+[ "$FAILED" -eq 0 ]