switch to new image and update trivy checks

.gitea/workflows/docker-publish.yml

@@ -1,5 +1,15 @@
 name: Reusable Docker Publish
 
+# Multi-arch (v1.9.0+): builds a manifest list for `platforms` (amd64 + arm64 by default) with
+# `docker buildx`, so the same tag runs on x86 servers and on the arm64 Raspberry Pi nodes with no
+# per-host changes. The Trivy gate is preserved by building the native amd64 image first with
+# --load, scanning that locally, and only then building + pushing the multi-arch manifest (the
+# amd64 layers are reused from cache, so only arm64 is newly built).
+#
+# Runner requirements (baked into the PipelineImage runner; the workflow also self-installs as a
+# fallback): the `docker buildx` plugin, and a build daemon that permits `--privileged` containers
+# so QEMU/binfmt can be registered for cross-building arm64 on an amd64 runner.
+
 on:
   workflow_call:
     inputs:
@@ -9,6 +19,27 @@ on:
       dockerfile_path:
         type: string
         default: "."
+      floating_tag:
+        type: string
+        default: "edge"
+      platforms:
+        # target platforms for the manifest list. Override to a single platform (e.g.
+        # "linux/amd64") for images that do not need to run on the arm64 nodes.
+        type: string
+        default: "linux/amd64,linux/arm64"
+      run_image_scan:
+        type: boolean
+        default: true
+      scan_severity:
+        type: string
+        default: "HIGH,CRITICAL"
+      use_private_index:
+        # pass the private Gitea PyPI index into the build as a BuildKit secret, for images
+        # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
+        # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
+        # token is not baked into an image layer.
+        type: boolean
+        default: false
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -16,12 +47,24 @@ on:
       NTFY_TOPIC: { required: true }
       NTFY_TOKEN: { required: true }
       NTFY_SERVER: { required: true }
+      PIP_EXTRA_INDEX_URL: { required: false }
+
+# Pinned build tooling. Keep in sync with the ARGs in the PipelineImage Dockerfiles.
+# buildx: verify the binary against checksums.txt from the buildx GitHub release before bumping.
+# binfmt: pin by digest (tonistiigi/binfmt@sha256:...) for the strongest posture; the version tag
+# below is immutable enough for CI and avoids a Docker Hub token dance in the workflow.
+env:
+  BUILDX_VERSION: "0.35.0"
+  BUILDX_SHA256: "d41ece72044243b4f58b343441ae37446d9c29a7d6b5e11c61847bbcf8f7dfda"
+  BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3"
+  TRIVY_VERSION: "0.72.0"
+  TRIVY_SHA256: "bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea"
 
 jobs:
   publish:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -34,100 +77,152 @@ jobs:
         id: vars
         shell: bash
         run: |
+          set -euo pipefail
           SHA_SHORT="$(git rev-parse --short HEAD)"
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
-          TAGS="-t ${FULL_IMAGE}:${SHA_SHORT}"
+
+          # the SHA tag is always built; it is also the target Trivy scans before any push
+          PUSH_TAGS="-t ${FULL_IMAGE}:${SHA_SHORT} -t ${FULL_IMAGE}:${{ inputs.floating_tag }}"
 
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             VERSION="${{ gitea.ref_name }}"
             VERSION="${VERSION#v}"
             MAJOR="$(echo "$VERSION" | cut -d. -f1)"
             MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-            TAGS="${TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
+            PUSH_TAGS="${PUSH_TAGS} -t ${FULL_IMAGE}:latest -t ${FULL_IMAGE}:${VERSION} -t ${FULL_IMAGE}:${MINOR} -t ${FULL_IMAGE}:${MAJOR}"
           fi
 
-          echo "docker_tags=${TAGS}" >> "$GITEA_OUTPUT"
+          echo "scan_ref=${FULL_IMAGE}:${SHA_SHORT}" >> "$GITEA_OUTPUT"
+          echo "push_tags=${PUSH_TAGS}" >> "$GITEA_OUTPUT"
           echo "full_image=${FULL_IMAGE}" >> "$GITEA_OUTPUT"
 
       - name: Docker Login
         run: |
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
-      - name: Build image
+      - name: Set up Docker Buildx and QEMU
+        shell: bash
+        env:
+          PLATFORMS: ${{ inputs.platforms }}
         run: |
-          SHA_SHORT="$(git rev-parse --short HEAD)"
-          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
+          set -euo pipefail
 
-          docker build \
-            -t "${FULL_IMAGE}:${SHA_SHORT}" \
-            ${{ inputs.dockerfile_path }}
+          # Ensure the buildx plugin. Baked into the runner image (PipelineImage); this fallback
+          # covers older runners, mirroring the Trivy fallback below. Pinned + checksum-verified.
+          if ! docker buildx version >/dev/null 2>&1; then
+            echo "=== buildx not in runner image, installing v${BUILDX_VERSION} ==="
+            mkdir -p /usr/libexec/docker/cli-plugins
+            curl -sSfLo /usr/libexec/docker/cli-plugins/docker-buildx \
+              "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64"
+            echo "${BUILDX_SHA256}  /usr/libexec/docker/cli-plugins/docker-buildx" | sha256sum -c -
+            chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
+          fi
+          docker buildx version
 
-          if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
-            VERSION="${{ gitea.ref_name }}"
-            VERSION="${VERSION#v}"
-            MAJOR="$(echo "$VERSION" | cut -d. -f1)"
-            MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:latest"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${VERSION}"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MINOR}"
-            docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${MAJOR}"
+          # Register QEMU so this amd64 runner can cross-build the non-native platforms. binfmt is
+          # a kernel concern, so it cannot live in the runner image and is installed here against
+          # the build daemon (needs --privileged).
+          if echo "${PLATFORMS}" | grep -q 'arm'; then
+            echo "=== Registering QEMU emulators (${BINFMT_IMAGE}) ==="
+            docker run --privileged --rm "${BINFMT_IMAGE}" --install arm64
           fi
 
-      - name: Push image
+          # A docker-container builder is required for multi-platform output (the default docker
+          # driver builds a single platform only). Idempotent across re-runs on a warm runner.
+          docker buildx inspect multiarch >/dev/null 2>&1 || \
+            docker buildx create --name multiarch --driver docker-container --bootstrap
+          docker buildx use multiarch
+
+      - name: Build image for vulnerability scan
+        if: ${{ inputs.run_image_scan }}
         shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          set -euo pipefail
+
+          SECRET_ARGS=""
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
+            fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
+
+          # native amd64 only, loaded into the local image store so Trivy can scan it before
+          # anything is pushed. The amd64 result is cached and reused by the multi-arch push.
+          # CVEs live in the base image and OS/Python packages, which are identical across arches,
+          # so scanning amd64 is a faithful gate for the whole manifest list.
+          DOCKER_BUILDKIT=1 docker buildx build \
+            --load \
+            --platform linux/amd64 \
+            ${SECRET_ARGS} \
+            -t "${{ steps.vars.outputs.scan_ref }}" \
+            ${{ inputs.dockerfile_path }}
+
+      - name: Image Vulnerability Scan
+        if: ${{ inputs.run_image_scan }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Fallback for runner images without Trivy baked in. Pinned version +
+          # checksum, never "latest": Trivy releases were compromised in the
+          # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
+          # with the ARGs in the PipelineImage Dockerfiles.
+          if ! command -v trivy >/dev/null 2>&1; then
+            echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
+            curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+            echo "${TRIVY_SHA256}  trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | sha256sum -c -
+            tar -xzf "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
+            rm "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          fi
+          trivy --version
+
+          echo "=== Scanning ${{ steps.vars.outputs.scan_ref }} (fail on fixable ${{ inputs.scan_severity }}) ==="
+          trivy image \
+            --exit-code 1 \
+            --severity "${{ inputs.scan_severity }}" \
+            --ignore-unfixed \
+            --scanners vuln,secret \
+            "${{ steps.vars.outputs.scan_ref }}"
+
+      - name: Build and push multi-arch image
+        shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
           set -euxo pipefail
 
           echo "=== Git / Ref Info ==="
           git rev-parse HEAD
-          git rev-parse --short HEAD
           echo "gitea.ref=${{ gitea.ref }}"
           echo "gitea.ref_name=${{ gitea.ref_name }}"
+          echo "platforms=${{ inputs.platforms }}"
 
-          SHA_SHORT="$(git rev-parse --short HEAD)"
-          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
-
-          echo "=== Image Info ==="
-          echo "FULL_IMAGE=${FULL_IMAGE}"
-          echo "SHA_SHORT=${SHA_SHORT}"
-          echo "Expected image: ${FULL_IMAGE}:${SHA_SHORT}"
-
-          echo "=== Local Docker Images ==="
-          docker images | grep "${{ inputs.image_name }}" || true
-
-          echo "=== Inspect Image ==="
-          docker image inspect "${FULL_IMAGE}:${SHA_SHORT}" >/dev/null
-
-          echo "=== Docker Auth Check ==="
-          docker info
-
-          echo "=== Push SHA tag ==="
-          docker push "${FULL_IMAGE}:${SHA_SHORT}"
-
-          if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
-            echo "=== Version tag detected ==="
-
-            VERSION="${{ gitea.ref_name }}"
-            VERSION="${VERSION#v}"
-            MAJOR="$(echo "$VERSION" | cut -d. -f1)"
-            MINOR="$(echo "$VERSION" | cut -d. -f1,2)"
-
-            echo "VERSION=${VERSION}"
-            echo "MINOR=${MINOR}"
-            echo "MAJOR=${MAJOR}"
-
-            echo "=== Push latest ==="
-            docker push "${FULL_IMAGE}:latest"
-
-            echo "=== Push version ==="
-            docker push "${FULL_IMAGE}:${VERSION}"
-
-            echo "=== Push minor ==="
-            docker push "${FULL_IMAGE}:${MINOR}"
-
-            echo "=== Push major ==="
-            docker push "${FULL_IMAGE}:${MAJOR}"
-          else
-            echo "=== No version tag detected, only SHA tag pushed ==="
+          SECRET_ARGS=""
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
             fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
+
+          # one build produces every platform and pushes a manifest list per tag. The Trivy gate
+          # above already ran on the amd64 image these layers are reused from, so a scan failure
+          # aborts the job before this step. On a version tag this also pushes latest/major/minor.
+          DOCKER_BUILDKIT=1 docker buildx build \
+            --push \
+            --platform "${{ inputs.platforms }}" \
+            ${SECRET_ARGS} \
+            ${{ steps.vars.outputs.push_tags }} \
+            ${{ inputs.dockerfile_path }}
+
+      - name: Verify pushed manifest
+        shell: bash
+        run: |
+          set -euo pipefail
+          # confirm the pushed tag really is a multi-arch manifest list
+          docker buildx imagetools inspect "${{ steps.vars.outputs.scan_ref }}"

.gitea/workflows/image-security-checks.yml

@@ -0,0 +1,70 @@
+name: Reusable Image Security Checks
+
+on:
+  workflow_call:
+    inputs:
+      image_name:
+        required: true
+        type: string
+      image_tag:
+        type: string
+        default: "edge"
+      scan_severity:
+        type: string
+        default: "HIGH,CRITICAL"
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+      DOCKER_REGISTRY: { required: true }
+
+jobs:
+  scan:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Docker Login
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Pull Image
+        shell: bash
+        run: |
+          set -euo pipefail
+          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
+          echo "=== Pulling ${FULL_IMAGE} ==="
+          docker pull "${FULL_IMAGE}"
+
+      - name: Image Vulnerability Scan
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Fallback for runner images without Trivy baked in. Pinned version +
+          # checksum, never "latest": Trivy releases were compromised in the
+          # March 2026 supply-chain incident (malicious v0.69.4). Keep in sync
+          # with the ARGs in the PipelineImage Dockerfiles.
+          TRIVY_VERSION=0.72.0
+          TRIVY_SHA256=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
+          if ! command -v trivy >/dev/null 2>&1; then
+            echo "=== Trivy not in runner image, installing v${TRIVY_VERSION} ==="
+            curl -sSfLO "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+            echo "${TRIVY_SHA256}  trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | sha256sum -c -
+            tar -xzf "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy
+            rm "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          fi
+          trivy --version
+
+          FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}:${{ inputs.image_tag }}"
+
+          echo "=== Scanning ${FULL_IMAGE} (fail on fixable ${{ inputs.scan_severity }}) ==="
+          trivy image \
+            --exit-code 1 \
+            --severity "${{ inputs.scan_severity }}" \
+            --ignore-unfixed \
+            --scanners vuln,secret \
+            "${FULL_IMAGE}"

.gitea/workflows/python-checks.yml

@@ -21,12 +21,15 @@ on:
       run_security_scan:
         type: boolean
         default: true
+      use_private_index:
+        type: boolean
+        default: false
 
 jobs:
   check:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}
@@ -35,6 +38,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Configure private package index
+        if: ${{ inputs.use_private_index }}
+        env:
+          PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          if [ -z "$PRIVATE_INDEX_URL" ]; then
+            echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+            exit 1
+          fi
+          pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
+
       - name: Install Tools & Deps
         run: |
           python -m pip install --upgrade pip setuptools wheel

.gitea/workflows/python-package-publish.yml

@@ -0,0 +1,93 @@
+name: Reusable Python Package Publish
+
+# Builds a Python package with `python -m build` and uploads it to the Gitea PyPI registry with
+# twine. Intended to run only on version tags (v*), alongside python-checks, so a package is
+# never published without its tests passing.
+#
+# The caller gates this job on python-checks and on the tag ref, the same way docker-publish is
+# gated. The job itself additionally refuses to publish when the git tag does not match the
+# version declared in pyproject.toml, so a mistyped tag cannot ship the wrong version.
+
+on:
+  workflow_call:
+    inputs:
+      package_name:
+        # informational, used only in log output
+        required: true
+        type: string
+      use_private_index:
+        # build backends that need the in-house BB* packages to resolve build dependencies
+        type: boolean
+        default: false
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+      PYPI_UPLOAD_URL: { required: true }
+      PYPI_UPLOAD_USER: { required: true }
+      PYPI_UPLOAD_PASSWORD: { required: true }
+
+jobs:
+  publish:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure private package index
+        if: ${{ inputs.use_private_index }}
+        env:
+          PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          if [ -z "$PRIVATE_INDEX_URL" ]; then
+            echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+            exit 1
+          fi
+          pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
+
+      - name: Verify the tag matches the package version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if ! echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
+            echo "This workflow only publishes on version tags (refs/tags/v*), got '${{ gitea.ref }}'"
+            exit 1
+          fi
+
+          TAG_VERSION="${{ gitea.ref_name }}"
+          TAG_VERSION="${TAG_VERSION#v}"
+          PROJECT_VERSION="$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+
+          echo "tag version     : ${TAG_VERSION}"
+          echo "pyproject version: ${PROJECT_VERSION}"
+
+          if [ "${TAG_VERSION}" != "${PROJECT_VERSION}" ]; then
+            echo "Tag v${TAG_VERSION} does not match the version ${PROJECT_VERSION} in pyproject.toml"
+            echo "Bump the version in pyproject.toml and retag, so the published artifact matches the tag."
+            exit 1
+          fi
+
+      - name: Build the package
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip build twine
+          python -m build
+          echo "=== built artifacts for ${{ inputs.package_name }} ==="
+          ls -1 dist
+
+      - name: Check the artifacts
+        run: python -m twine check dist/*
+
+      - name: Upload to the package registry
+        env:
+          TWINE_USERNAME: ${{ secrets.PYPI_UPLOAD_USER }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_PASSWORD }}
+        run: |
+          python -m twine upload --repository-url "${{ secrets.PYPI_UPLOAD_URL }}" dist/*

.gitea/workflows/python-security-checks.yml

@@ -20,7 +20,7 @@ jobs:
   security:
     runs-on: docker
     container:
-      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:1.0.3
       credentials:
         username: ${{ secrets.REGISTRY_USERNAME }}
         password: ${{ secrets.REGISTRY_PASSWORD }}