add passing secrets to docker build

python:3.14-slim has no Node.js so actions/checkout@v4 fails with
'node: executable file not found in PATH'. Switch to the same
gitea_runner_python314 custom image used by python-checks.yml which
has both Python 3.14 and Node.js. Drop the python_version input as it
no longer drives the container selection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/docker-publish.yml

@@ -9,6 +9,22 @@ on:
       dockerfile_path:
         type: string
         default: "."
+      floating_tag:
+        type: string
+        default: "edge"
+      run_image_scan:
+        type: boolean
+        default: true
+      scan_severity:
+        type: string
+        default: "HIGH,CRITICAL"
+      use_private_index:
+        # pass the private Gitea PyPI index into the build as a BuildKit secret, for images
+        # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
+        # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
+        # token is not baked into an image layer.
+        type: boolean
+        default: false
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -16,6 +32,7 @@ on:
       NTFY_TOPIC: { required: true }
       NTFY_TOKEN: { required: true }
       NTFY_SERVER: { required: true }
+      PIP_EXTRA_INDEX_URL: { required: false }
 
 jobs:
   publish:
@@ -54,14 +71,35 @@ jobs:
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
       - name: Build image
+        shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
+          set -euo pipefail
           SHA_SHORT="$(git rev-parse --short HEAD)"
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
 
-          docker build \
+          # optionally hand the private package index to the build as a BuildKit secret so the
+          # Dockerfile can install the in-house BB* packages without the token entering a layer
+          SECRET_ARGS=""
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
+            fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
+
+          DOCKER_BUILDKIT=1 docker build \
+            ${SECRET_ARGS} \
             -t "${FULL_IMAGE}:${SHA_SHORT}" \
             ${{ inputs.dockerfile_path }}
 
+          # Floating tag points at the most recent build on any branch/tag, so
+          # the nightly image-security scan always has a stable target even
+          # before a release exists. ":latest" stays release-only (below).
+          docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${{ inputs.floating_tag }}"
+
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             VERSION="${{ gitea.ref_name }}"
             VERSION="${VERSION#v}"
@@ -74,6 +112,38 @@ jobs:
             docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MAJOR}"
           fi
 
+      - name: Image Vulnerability Scan
+        if: ${{ inputs.run_image_scan }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Fallback for runner images without Trivy baked in. Pinned version +
+          # checksum, never "latest": Trivy releases were compromised in the
+          # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
+          # with the ARGs in the PipelineImage Dockerfiles.
+          TRIVY_VERSION=0.71.0
+          TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
+          if ! command -v trivy >/dev/null 2>&1; then
+            echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
+            curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+            echo "${TRIVY_SHA256}  trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | sha256sum -c -
+            tar -xzf "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
+            rm "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          fi
+          trivy --version
+
+          SHA_SHORT="$(git rev-parse --short HEAD)"
+          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
+
+          echo "=== Scanning ${FULL_IMAGE}:${SHA_SHORT} (fail on fixable ${{ inputs.scan_severity }}) ==="
+          trivy image \
+            --exit-code 1 \
+            --severity "${{ inputs.scan_severity }}" \
+            --ignore-unfixed \
+            --scanners vuln,secret \
+            "${FULL_IMAGE}:${SHA_SHORT}"
+
       - name: Push image
         shell: bash
         run: |
@@ -105,6 +175,9 @@ jobs:
           echo "=== Push SHA tag ==="
           docker push "${FULL_IMAGE}:${SHA_SHORT}"
 
+          echo "=== Push floating tag (${{ inputs.floating_tag }}) ==="
+          docker push "${FULL_IMAGE}:${{ inputs.floating_tag }}"
+
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             echo "=== Version tag detected ==="
 

.gitea/workflows/image-security-checks.yml

@@ -0,0 +1,70 @@
+name: Reusable Image Security Checks
+
+on:
+  workflow_call:
+    inputs:
+      image_name:
+        required: true
+        type: string
+      image_tag:
+        type: string
+        default: "edge"
+      scan_severity:
+        type: string
+        default: "HIGH,CRITICAL"
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+      DOCKER_REGISTRY: { required: true }
+
+jobs:
+  scan:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Docker Login
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Pull Image
+        shell: bash
+        run: |
+          set -euo pipefail
+          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
+          echo "=== Pulling ${FULL_IMAGE} ==="
+          docker pull "${FULL_IMAGE}"
+
+      - name: Image Vulnerability Scan
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Fallback for runner images without Trivy baked in. Pinned version +
+          # checksum, never "latest": Trivy releases were compromised in the
+          # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
+          # with the ARGs in the PipelineImage Dockerfiles.
+          TRIVY_VERSION=0.71.0
+          TRIVY_SHA256=30a3d22b23f88c233f1658f562fb477cae3b3e8b4761109d515b7698daf85814
+          if ! command -v trivy >/dev/null 2>&1; then
+            echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
+            curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+            echo "${TRIVY_SHA256}  trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | sha256sum -c -
+            tar -xzf "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
+            rm "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          fi
+          trivy --version
+
+          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
+
+          echo "=== Scanning ${FULL_IMAGE} (fail on fixable ${{ inputs.scan_severity }}) ==="
+          trivy image \
+            --exit-code 1 \
+            --severity "${{ inputs.scan_severity }}" \
+            --ignore-unfixed \
+            --scanners vuln,secret \
+            "${FULL_IMAGE}"

.gitea/workflows/node-checks.yml

@@ -0,0 +1,42 @@
+name: Reusable Node Checks
+
+on:
+  workflow_call:
+    inputs:
+      node_version:
+        type: string
+        default: "22"
+      install_command:
+        type: string
+        default: "npm ci"
+      typecheck_command:
+        type: string
+        default: "npm run typecheck"
+      test_command:
+        type: string
+        default: "npm test"
+      build_command:
+        type: string
+        default: "npm run build"
+
+jobs:
+  check:
+    runs-on: docker
+    container:
+      image: node:${{ inputs.node_version }}-alpine
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: ${{ inputs.install_command }}
+
+      - name: Typecheck
+        run: ${{ inputs.typecheck_command }}
+
+      - name: Run tests
+        run: ${{ inputs.test_command }}
+
+      - name: Build
+        run: ${{ inputs.build_command }}

.gitea/workflows/notifications.yml

@@ -9,35 +9,156 @@ on:
       job_name:
         required: true
         type: string
+      notify_on_release:
+        required: false
+        type: boolean
+        default: true
     secrets:
       NTFY_TOPIC: { required: true }
       NTFY_TOKEN: { required: true }
       NTFY_SERVER: { required: true }
+      API_GITEA_TOKEN: { required: true }
 
 jobs:
   notify:
     runs-on: docker
     steps:
+      - name: Detect previous workflow state
+        id: previous
+        shell: bash
+        env:
+          API_GITEA_TOKEN: ${{ secrets.API_GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          python3 <<'PY'
+          import json
+          import os
+          import urllib.request
+
+          server = "${{ gitea.server_url }}"
+          repo = "${{ gitea.repository }}"
+          current_run_number = int("${{ gitea.run_number }}")
+          current_branch = "${{ gitea.ref_name }}"
+          current_event = "${{ gitea.event_name }}"
+          token = os.environ["API_GITEA_TOKEN"]
+
+          url = (
+              f"{server}/api/v1/repos/{repo}/actions/runs"
+              f"?page=1&limit=5"
+          )
+
+          print(f"Fetching workflow runs from: {url}")
+          print(f"Current run number: {current_run_number}")
+          print(f"Current branch: {current_branch}")
+          print(f"Current event: {current_event}")
+
+          req = urllib.request.Request(
+              url,
+              headers={
+                  "Authorization": f"token {token}",
+                  "Accept": "application/json",
+              },
+          )
+
+          with urllib.request.urlopen(req) as response:
+              data = json.loads(response.read().decode("utf-8"))
+
+          runs = data.get("workflow_runs", [])
+
+          print(f"Received {len(runs)} workflow runs")
+
+          previous = "unknown"
+
+          for run in runs:
+              run_number = run.get("run_number")
+              status = run.get("status")
+              conclusion = run.get("conclusion")
+              branch = run.get("head_branch")
+              event = run.get("event")
+
+              print(
+                  f"Inspecting run #{run_number}: "
+                  f"status={status}, "
+                  f"conclusion={conclusion}, "
+                  f"branch={branch}, "
+                  f"event={event}"
+              )
+
+              # aktuellen Run überspringen
+              if int(run_number) == current_run_number:
+                  print(" -> skipping current run")
+                  continue
+
+              # nur abgeschlossene Runs
+              if status != "completed":
+                  print(" -> skipping non-completed run")
+                  continue
+
+              # nur gleicher Branch
+              if branch != current_branch:
+                  print(" -> skipping different branch")
+                  continue
+
+              # nur gleiches Event
+              if event != current_event:
+                  print(" -> skipping different event")
+                  continue
+
+              previous = conclusion or "unknown"
+
+              print(f" -> selected previous conclusion: {previous}")
+              break
+
+          print(f"Previous conclusion final: {previous}")
+
+          with open(os.environ["GITEA_OUTPUT"], "a", encoding="utf-8") as f:
+              f.write(f"previous_conclusion={previous}\n")
+          PY
+
       - name: Send Notification
         shell: bash
         run: |
-          # Icon und Titel basierend auf Status
-          if [ "${{ inputs.job_status }}" == "success" ]; then
-            ICON="✅"
-            TITLE="Fixed: ${{ inputs.job_name }} for ${{ gitea.repository }}"
-          else
-            ICON="❌"
-            TITLE="Failed: ${{ inputs.job_name }} for ${{ gitea.repository }}"
+          set -euo pipefail
+
+          CURRENT_STATUS="${{ inputs.job_status }}"
+          PREVIOUS_STATUS="${{ steps.previous.outputs.previous_conclusion }}"
+          IS_RELEASE="false"
+
+          if [[ "${{ gitea.ref }}" == refs/tags/v* ]]; then
+            IS_RELEASE="true"
           fi
 
-          COMMIT_SUBJECT="$(git log -1 --pretty=%s || echo 'Commit info unavailable')"
+          echo "Current status: ${CURRENT_STATUS}"
+          echo "Previous status: ${PREVIOUS_STATUS}"
+          echo "Is release: ${IS_RELEASE}"
+
+          if [[ "$IS_RELEASE" == "true" && "$CURRENT_STATUS" == "success" ]]; then
+            ICON="🚀"
+            TITLE="New release available: ${{ gitea.ref_name }} for ${{ gitea.repository }}"
+          elif [[ "$CURRENT_STATUS" == "failure" ]]; then
+            ICON="❌"
+            TITLE="Failed: ${{ inputs.job_name }} for ${{ gitea.repository }}"
+          elif [[ "$CURRENT_STATUS" == "success" && "$PREVIOUS_STATUS" == "failure" ]]; then
+            ICON="✅"
+            TITLE="Healed: ${{ inputs.job_name }} for ${{ gitea.repository }}"
+          else
+            echo "No notification needed."
+            exit 0
+          fi
+
+          COMMIT_SUBJECT="$(curl -fsS \
+            -H "Authorization: Bearer ${{ secrets.API_GITEA_TOKEN }}" \
+            "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/git/commits/${{ gitea.sha }}" \
+            | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('RepoCommit',{}).get('message','').split('\n')[0])" \
+            2>/dev/null || echo 'Commit info unavailable')"
           RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}"
 
           cat <<EOF >/tmp/ntfy-payload.json
           {
             "topic": "${{ secrets.NTFY_TOPIC }}",
             "title": "${ICON} ${TITLE}",
-            "message": "Ref: ${{ gitea.ref_name }}\nCommit: ${COMMIT_SUBJECT}\n\nRun URL: ${RUN_URL}",
+            "message": "Ref: ${{ gitea.ref_name }}\nStatus: ${CURRENT_STATUS}\nPrevious: ${PREVIOUS_STATUS}\nCommit: ${COMMIT_SUBJECT}\n\nRun URL: ${RUN_URL}",
             "click": "${RUN_URL}",
             "actions": [
               { "action": "view", "label": "Open Run", "url": "${RUN_URL}" }

.gitea/workflows/python-checks.yml

@@ -6,9 +6,24 @@ on:
       python_version:
         type: string
         default: "3.14"
+      source_path:
+        type: string
+        default: "app"
+      tests_path:
+        type: string
+        default: "tests"
       test_command:
         type: string
         default: "coverage run -m pytest"
+      coverage_fail_under:
+        type: string
+        default: "80"
+      run_security_scan:
+        type: boolean
+        default: true
+      use_private_index:
+        type: boolean
+        default: false
 
 jobs:
   check:
@@ -23,33 +38,52 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Configure private package index
+        if: ${{ inputs.use_private_index }}
+        env:
+          PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          if [ -z "$PRIVATE_INDEX_URL" ]; then
+            echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+            exit 1
+          fi
+          pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
+
       - name: Install Tools & Deps
         run: |
           python -m pip install --upgrade pip setuptools wheel
-          pip install -e .[dev] || pip install -e .[test] || pip install -e .
+          pip install -e ".[dev]" || pip install -e ".[test]" || pip install -e .
           pip install ruff coverage pip-audit bandit
 
       - name: Linting
-        run: ruff check app tests
+        run: ruff check ${{ inputs.source_path }} ${{ inputs.tests_path }}
 
       - name: Tests
         run: |
           ${{ inputs.test_command }}
-          coverage report --fail-under=60
+          coverage report --fail-under=${{ inputs.coverage_fail_under }}
           coverage xml
           coverage html
 
       - name: Security Scan
+        if: ${{ inputs.run_security_scan }}
         run: |
           pip freeze | grep -v "git+" > req.txt
           pip-audit -r req.txt
-          bandit -r app/
+          bandit -r ${{ inputs.source_path }}
 
-      - name: Upload Coverage
+      - name: Upload Coverage HTML
         if: always()
         uses: actions/upload-artifact@v3
         with:
-          name: coverage-report
-          path: |
-            htmlcov/
-            coverage.xml
+          name: coverage-html
+          path: htmlcov/
+          if-no-files-found: warn
+
+      - name: Upload Coverage XML
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-xml
+          path: coverage.xml
+          if-no-files-found: warn

.gitea/workflows/python-package-publish.yml

@@ -0,0 +1,93 @@
+name: Reusable Python Package Publish
+
+# Builds a Python package with `python -m build` and uploads it to the Gitea PyPI registry with
+# twine. Intended to run only on version tags (v*), alongside python-checks, so a package is
+# never published without its tests passing.
+#
+# The caller gates this job on python-checks and on the tag ref, the same way docker-publish is
+# gated. The job itself additionally refuses to publish when the git tag does not match the
+# version declared in pyproject.toml, so a mistyped tag cannot ship the wrong version.
+
+on:
+  workflow_call:
+    inputs:
+      package_name:
+        # informational, used only in log output
+        required: true
+        type: string
+      use_private_index:
+        # build backends that need the in-house BB* packages to resolve build dependencies
+        type: boolean
+        default: false
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+      PYPI_UPLOAD_URL: { required: true }
+      PYPI_UPLOAD_USER: { required: true }
+      PYPI_UPLOAD_PASSWORD: { required: true }
+
+jobs:
+  publish:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure private package index
+        if: ${{ inputs.use_private_index }}
+        env:
+          PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          if [ -z "$PRIVATE_INDEX_URL" ]; then
+            echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+            exit 1
+          fi
+          pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
+
+      - name: Verify the tag matches the package version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if ! echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
+            echo "This workflow only publishes on version tags (refs/tags/v*), got '${{ gitea.ref }}'"
+            exit 1
+          fi
+
+          TAG_VERSION="${{ gitea.ref_name }}"
+          TAG_VERSION="${TAG_VERSION#v}"
+          PROJECT_VERSION="$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+
+          echo "tag version     : ${TAG_VERSION}"
+          echo "pyproject version: ${PROJECT_VERSION}"
+
+          if [ "${TAG_VERSION}" != "${PROJECT_VERSION}" ]; then
+            echo "Tag v${TAG_VERSION} does not match the version ${PROJECT_VERSION} in pyproject.toml"
+            echo "Bump the version in pyproject.toml and retag, so the published artifact matches the tag."
+            exit 1
+          fi
+
+      - name: Build the package
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip build twine
+          python -m build
+          echo "=== built artifacts for ${{ inputs.package_name }} ==="
+          ls -1 dist
+
+      - name: Check the artifacts
+        run: python -m twine check dist/*
+
+      - name: Upload to the package registry
+        env:
+          TWINE_USERNAME: ${{ secrets.PYPI_UPLOAD_USER }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_PASSWORD }}
+        run: |
+          python -m twine upload --repository-url "${{ secrets.PYPI_UPLOAD_URL }}" dist/*

.gitea/workflows/python-security-checks.yml

@@ -0,0 +1,38 @@
+name: Reusable Python Security Checks
+
+on:
+  workflow_call:
+    inputs:
+      install_command:
+        type: string
+        default: 'python -m pip install "bandit[toml]"'
+      security_command:
+        type: string
+        default: "python -m bandit -r app -c pyproject.toml"
+      working_directory:
+        type: string
+        default: "."
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+
+jobs:
+  security:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install security tools
+        working-directory: ${{ inputs.working_directory }}
+        run: ${{ inputs.install_command }}
+
+      - name: Run security scan
+        working-directory: ${{ inputs.working_directory }}
+        run: ${{ inputs.security_command }}