feat: add release job

.gitea/workflows/build-docker-image.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
@@ -46,7 +46,7 @@ jobs:
           username: ${{ secrets.registry-user }}
           password: ${{ secrets.registry-password }}
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.gitea/workflows/cog-check.yml

@@ -15,14 +15,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Semver release
-        uses: cocogitto/cocogitto-action@v3
+        uses: cocogitto/cocogitto-action@v4
         with:
-          # check-latest-tag-only: ${{ inputs.check-latest-tag-only }}
+          command: check
-          check-latest-tag-only: true
+          args: --from-latest-tag
           git-user: "gitea-bot"
           git-user-email: "bot@git.palkoi.net"

.gitea/workflows/cog-release.yml

@@ -1,15 +1,12 @@
 ---
 name: Cog release
 on:
-  push:
-    branches:
-      - main
   workflow_call:
-    # inputs:
+    inputs:
-    #   check-latest-tag-only:
+      ref:
-    #     type: boolean
+        type: string
-    #     required: false
+        required: false
-    #     default: true
+        default: ""
 
 jobs:
   release:
@@ -17,9 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          ref: ${{ inputs.ref == '' && github.sha || inputs.ref }}
 
       - run: |
           git config user.name gitea-bot
@@ -28,20 +26,23 @@ jobs:
           git config --global user.name gitea-bot
 
       - name: Semver release
-        uses: cocogitto/cocogitto-action@v3
+        uses: cocogitto/cocogitto-action@v4
         id: release
         with:
-          release: true
+          command: bump
+          args: --auto
           git-user: "gitea-bot"
           git-user-email: "bot@git.palkoi.net"
-          check-latest-tag-only: true
-          # check-latest-tag-only: ${{ inputs.check-latest-tag-only }}
 
       - name: Generate Changelog
-        run: cog changelog --at ${{ steps.release.outputs.version }} -t full_hash > GITHUB_CHANGELOG.md
+        id: changelog
+        uses: cocogitto/cocogitto-action@v4
+        with:
+          command: changelog
+          args: --at ${{ steps.release.outputs.version }} -t full_hash
 
       - name: Upload github release
         uses: softprops/action-gh-release@v2
         with:
-          body_path: GITHUB_CHANGELOG.md
+          body: ${{ steps.changelog.outputs.stdout }}
           tag_name: ${{ steps.release.outputs.version }}

.gitea/workflows/otf-apply.yml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Clone repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Retrieve artifacts
         id: download
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v7
         with:
           name: artifacts
       - name: Check if job errored
@@ -42,7 +42,7 @@ jobs:
             exit "$(cat exitcode)";
           fi
       - name: Clone blackbox repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         if: ${{ steps.check.outputs.code == 2 }}
         with:
           repository: xaked/blackbox
@@ -76,7 +76,7 @@ jobs:
           known-hosts: ${{ secrets.ssh-known-hosts }}
       - name: Restore tofu cache
         if: ${{ steps.check.outputs.code == 2 }}
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-tofu-restore
         with:
           path: .terraform
@@ -96,7 +96,7 @@ jobs:
         run: tofu apply -input=false -auto-approve tfplan.binary;
       - name: Save tofu cache
         if: ${{ steps.check.outputs.code == 2 }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         id: cache-tofu-save
         with:
           path: .terraform

.gitea/workflows/otf-plan.yml

@@ -31,9 +31,9 @@ jobs:
           tofu_version: ${{ inputs.tofu-version }}
           cli_config_credentials_token: ${{ secrets.tf-api-token }}
       - name: Clone repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Clone blackbox repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: xaked/blackbox
           path: blackbox
@@ -57,7 +57,7 @@ jobs:
           private-key-name: id_ed25519
           known-hosts: ${{ secrets.ssh-known-hosts }}
       - name: Restore tofu cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-tofu-restore
         with:
           path: .terraform
@@ -77,7 +77,7 @@ jobs:
         shell: bash
         run: printf "${{ steps.tfplan.outputs.exitcode }}" > exitcode;
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v6
         with:
           name: artifacts
           path: |
@@ -90,7 +90,7 @@ jobs:
             exit 1;
           fi
       - name: Save tofu cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         id: cache-tofu-save
         with:
           path: .terraform

.gitea/workflows/release.yml

@@ -0,0 +1,12 @@
+---
+name: Cog release
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    name: Create release
+    runs-on: ubuntu-latest
+    uses: ./.gitea/workflows/cog-release.yml

.gitea/workflows/sec-blackbox-decrypt.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Clone blackbox repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: xaked/blackbox
           path: blackbox

.gitea/workflows/sec-checks-trivy.yml

@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: Clone repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Run Trivy vulnerability scanner in IaC mode (LOW/MED)
         uses: aquasecurity/trivy-action@master
         with:

.gitea/workflows/sec-megalinter.yml

@@ -43,7 +43,7 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.gitea-token }}
           fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances
@@ -53,7 +53,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/flavors/
-        uses: oxsecurity/megalinter@v7
+        uses: oxsecurity/megalinter@v9
         env:
           # All available variables are described in documentation
           # https://megalinter.io/configuration/
@@ -65,7 +65,7 @@ jobs:
       # Upload MegaLinter artifacts
       - name: Archive production artifacts
         if: success() || failure()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v6
         with:
           name: MegaLinter reports
           path: |
@@ -81,7 +81,7 @@ jobs:
       - name: Create Pull Request with applied fixes
         id: cpr
         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ secrets.gitea-token }}
           commit-message: "[MegaLinter] Apply linters automatic fixes"
@@ -99,7 +99,7 @@ jobs:
         run: sudo chown -Rc $UID .git/
       - name: Commit and push applied linter fixes
         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
           commit_message: "feat(linter): apply linters fixes"

.gitea/workflows/tf-apply.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Clone repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Retrieve artifacts
         id: download
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v7
         with:
           name: artifacts
       - name: Check if job errored
@@ -37,7 +37,7 @@ jobs:
             exit "$(cat exitcode)";
           fi
       - name: Clone blackbox repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         if: ${{ steps.check.outputs.code == 2 }}
         with:
           repository: xaked/blackbox
@@ -71,7 +71,7 @@ jobs:
           known-hosts: ${{ secrets.ssh-known-hosts }}
       - name: Restore terraform cache
         if: ${{ steps.check.outputs.code == 2 }}
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-terraform-restore
         with:
           path: .terraform
@@ -91,7 +91,7 @@ jobs:
         run: terraform apply -input=false -auto-approve tfplan.binary;
       - name: Save terraform cache
         if: ${{ steps.check.outputs.code == 2 }}
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         id: cache-terraform-save
         with:
           path: .terraform

.gitea/workflows/tf-docs.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: Install terraform docs
@@ -25,14 +25,14 @@ jobs:
           terraform-docs --version
           terraform-docs markdown table --output-file README.md --output-mode inject .
       - name: Verify Changed files
-        uses: tj-actions/verify-changed-files@v19
+        uses: tj-actions/verify-changed-files@v20
         id: verify-changed-files
         with:
           files: |
             README.md
       - name: Commit and push new terraform docs version
         if: steps.verify-changed-files.outputs.files_changed == 'true'
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@v7
         with:
           branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
           commit_message: "docs(tf-docs): update docs"

.gitea/workflows/tf-plan.yml

@@ -26,9 +26,9 @@ jobs:
           terraform_version: 1.7.5
           cli_config_credentials_token: ${{ secrets.tf-api-token }}
       - name: Clone repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Clone blackbox repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: xaked/blackbox
           path: blackbox
@@ -52,7 +52,7 @@ jobs:
           private-key-name: id_ed25519
           known-hosts: ${{ secrets.ssh-known-hosts }}
       - name: Restore terraform cache
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: cache-terraform-restore
         with:
           path: .terraform
@@ -72,7 +72,7 @@ jobs:
         shell: bash
         run: printf "${{ steps.tfplan.outputs.exitcode }}" > exitcode;
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v6
         with:
           name: artifacts
           path: |
@@ -85,7 +85,7 @@ jobs:
             exit 1;
           fi
       - name: Save terraform cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         id: cache-terraform-save
         with:
           path: .terraform

cog.toml

@@ -10,3 +10,6 @@
 # tf-apply = { path = ".gitea/workflows/tf-apply.yml" }
 # tf-docs = { path = ".gitea/workflows/tf-docs.yml" }
 # tf-plan = { path = ".gitea/workflows/tf-plan.yml" }
+[commit_types]
+version = { bump_patch = true, changelog_title = "Version" }
+chore = { bump_patch = true, changelog_title = "Chore" }