Add containers to repo

containers/.github/label-commenter-config.yml

@@ -0,0 +1,34 @@
+---
+labels:
+  - name: incomplete-template
+    labeled:
+      issue:
+        body: |
+          :wave: @{{ issue.user.login }}, please follow the template provided.
+        action: close
+        locking: lock
+        lock_reason: resolved
+
+  - name: support
+    labeled:
+      issue:
+        body: |
+          :wave: @{{ issue.user.login }}, we use the issue tracker exclusively
+          for bug reports and feature requests. However, this issue appears
+          to be a support request. Please use our support channels
+          to get help.
+          - [Docs](https://https://truecharts.org/)
+          - [Discord](https://discord.gg/tVsPTHWTtr)
+        action: close
+
+  - name: incomplete-docs
+    labeled:
+      pr:
+        body: |
+          :wave: @{{ pull_request.user.login }}, thanks for taking the time to submit this PR. 🙏🏽
+
+          We have noticed that the chart documentation has not been completely updated for this PR.
+          Could you please make sure that the following items have been updated:
+          - `version` in `Chart.yaml` has been updated per [semver](http://semver.org/)
+          - The `artifacthub.io/changes` chart annotation contains a summary of the updates for this new version.  See [Artifact Hub documentation](https://artifacthub.io/docs/topics/annotations/helm/#supported-annotations) for more info.
+          - [Documentation strings](https://github.com/norwoodj/helm-docs#valuesyaml-metadata) have been added to the keys in `values.yaml`.

containers/.github/renovate.json5

@@ -0,0 +1,364 @@
+{
+  semanticCommits: "enabled",
+  extends: ["helpers:pinGitHubActionDigests"],
+  dependencyDashboard: true,
+  dependencyDashboardTitle: "Renovate Dashboard 🤖",
+  suppressNotifications: ["prIgnoreNotification"],
+  commitMessageTopic: "{{depName}}",
+  commitMessageExtra: "to {{newVersion}}",
+  commitMessageSuffix: "",
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 25,
+  pinDigests: true,
+  automerge: true,
+  gitAuthor: "TrueCharts-Admin <bot@truecharts.org>",
+  packageRules: [
+    // Setup datasources for github actions
+    {
+      matchManagers: ["github-actions"],
+      commitMessageTopic: "github-action {{depName}} [skip ci]",
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      enabled: true,
+      automerge: true,
+      matchUpdateTypes: ["major", "minor", "patch", "digest", "pin"],
+      pinDigests: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      semanticCommitScope: "images",
+      separateMinorPatch: true,
+      automerge: true,
+    },
+    // Add labels according to package and update types
+    {
+      matchDatasources: ["docker"],
+      matchUpdateTypes: ["major"],
+      commitMessagePrefix: "feat(images)!: ",
+      labels: ["renovate/image", "dep/major", "automerge"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      matchUpdateTypes: ["minor"],
+      semanticCommitType: "feat",
+      labels: ["renovate/image", "dep/minor", "automerge"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      matchUpdateTypes: ["patch"],
+      semanticCommitType: "fix",
+      labels: ["renovate/image", "dep/patch", "automerge"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      matchUpdateTypes: ["digest"],
+      semanticCommitType: "fix",
+      labels: ["renovate/image", "dep/digest", "automerge"],
+      automerge: true,
+    },
+    // matchPackagePatterns
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>14)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackagePatterns: ["^bitnami/postgresql$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{4})-(?<minor>\\d{2})-(?<patch>\\d{2})$",
+      matchPackagePatterns: ["^.*oznu\\/homebridge$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      matchPackagePatterns: ["^jupyter\\/.+$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ubuntu$",
+      matchPackagePatterns: ["^zabbix\\/zabbix-.*$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^stable-(?<major>\\d{1})(?<minor>\\d{1})(?<patch>\\d{2}).*$",
+      matchPackagePatterns: ["^jitsi\\/.*$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackagePatterns: ["^penpot\\/.*$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^\\d*-jammy-(?<variant>.+)-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackagePatterns: ["^.+\\/koush\\/scrypted$"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-.*$",
+      matchPackagePatterns: ["^.*linuxserver\\/deluge$"],
+      automerge: true,
+    },
+    // matchPackageNames
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-postgres-tomcat$",
+      matchPackageNames: ["xwiki"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["fireflyiii/core"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-\\d+\\.\\d+\\.\\d+$",
+      matchPackageNames: ["netboxcommunity/netbox"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{2})(?<minor>\\d{2})(?<patch>\\d{2})$",
+      matchPackageNames: ["photoprism/photoprism"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["cloudflare/cloudflared"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^version-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["linuxserver/calibre-web"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^version-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["linuxserver/heimdall"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^postgresql-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["ghcr.io/umami-software/umami"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^version-v(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d*)$",
+      matchPackageNames: ["linuxserver/mylar3"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^[a-z0-9]{9}-v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-go\\d+\\.\\d+\\.\\d+$",
+      matchPackageNames: ["storjlabs/storagenode"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-php8\\.0-apache$",
+      matchPackageNames: ["joyqi/typecho"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^v\\.(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["difegue/lanraragi"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^RELEASE\\.(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)T\\d+-\\d+-\\d+Z$",
+      matchPackageNames: ["minio/minio"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^RELEASE\\.(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)T\\d+-\\d+-\\d+Z$",
+      matchPackageNames: ["minio/mc"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^apache-(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d*)-prod$",
+      matchPackageNames: ["kimai/kimai2"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      matchPackageNames: ["rssbridge/rss-bridge"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      matchPackageNames: ["alexta69/metube"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^focal-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["codeproject/senseai-server"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^latest-(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      matchPackageNames: ["wangqiru/ttrss"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(-\\d+)?$",
+      matchPackageNames: ["kiwix/kiwix-serve"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-omnibus$",
+      matchPackageNames: ["ghcr.io/analogj/scrutiny"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)-(?<minor>\\d+)-(?<patch>\\d+)$",
+      matchPackageNames: ["diygod/rsshub"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-amd64(nvidia)?$",
+      matchPackageNames: ["blakeblackshear/frigate"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{1,4})\\.(?<minor>\\d+)\\.(?<patch>\\d+)$",
+      matchPackageNames: ["kopia/kopia"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2).*$",
+      matchPackageNames: ["alicevision/meshroom"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      matchPackageNames: ["itzg/bungeecord"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^java8-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      matchPackageNames: ["itzg/bungeecord"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^java11-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      matchPackageNames: ["itzg/bungeecord"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^java17-(?<major>\\d{4})\\.(?<minor>\\d{1,2})\\.(?<patch>\\d{1,2})$",
+      matchPackageNames: ["itzg/bungeecord"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{4})\\.(?<minor>d{1,2})\\.(?<patch>\\d{1,2})(-java\\d{1,2}.*)?$",
+      matchPackageNames: ["itzg/minecraft-server"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d{4})(?<minor>\\d{2})(?<patch>\\d{2})$",
+      matchPackageNames: ["ankicommunity/anki-sync-server"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)-jdk17$",
+      matchPackageNames: ["jenkins/jenkins"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^x64-v(?<major>\\d*)\\.(?<minor>\\d*)\\.(?<patch>\\d*)$",
+      matchPackageNames: ["housewrecker/gaps"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d*)\\.(?<minor>\\d*)\\.(?<patch>\\d*)-\\d*$",
+      matchPackageNames: ["sameersbn/apt-cacher-ng"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^release-(?<major>\\d*)\\.(?<minor>\\d*)$",
+      matchPackageNames: ["mattermost/mattermost-enterprise-edition"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-.+$",
+      matchPackageNames: ["corentinth/it-tools"],
+      automerge: true,
+    },
+    {
+      matchDatasources: ["docker"],
+      automerge: true,
+      matchUpdateTypes: ["major", "minor", "patch", "digest", "pin"],
+    },
+    //
+    // Version strategies
+    //
+    // Versioning for linuxserver two-three digit container versions
+    {
+      matchPackagePatterns: ["^linuxserver\\/", "^deepquestai\\/"],
+      versioning: "regex:^(?<compatibility>.*?(\\d+\\.)??)(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d+)?(-r?p?\\d)?$",
+    },
+    {
+      matchDatasources: ["docker"],
+      versioning: "loose",
+      matchPackageNames: [
+        "ghcr.io/onedr0p/plex",
+        "ghcr.io/onedr0p/qbittorrent",
+        "sirfragalot/hyperion.ng",
+      ],
+    },
+    {
+      matchDatasources: ["docker"],
+      matchPackageNames: [
+        "quay.io/helmpack/chart-releaser",
+        "jnorwood/helm-docs",
+        "quay.io/git-chglog/git-chglog",
+      ],
+      automerge: false,
+      matchUpdateTypes: ["major", "minor", "patch", "digest", "pin"],
+      labels: ["renovate/image", "ci"],
+    },
+  ],
+}

containers/.github/stale.yml

@@ -0,0 +1,32 @@
+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue or Pull Request becomes stale
+daysUntilStale: 45
+
+# Number of days of inactivity before a stale Issue or Pull Request is closed.
+daysUntilClose: 5
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+- on-hold
+- pinned
+
+# Label to use when marking as stale
+staleLabel: stale
+
+issues:
+  # Comment to post when marking as stale. Set to `false` to disable
+  markComment: >
+    This Issue has been automatically marked as "stale" because it has not had recent activity (for 45 days). It will be closed if no further activity occurs. Thanks for the feedback.
+  # Comment to post when closing a stale Issue or Pull Request.
+  closeComment: >
+    Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.
+pulls:
+  # Comment to post when marking as stale. Set to `false` to disable
+  markComment: >
+    This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 45 days). It will be closed if no further activity occurs. Thank you for your contribution.
+  # Comment to post when closing a stale Issue or Pull Request.
+  closeComment: >
+    Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary.
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 30

containers/.github/update-version-file.sh

@@ -0,0 +1,21 @@
+#/bin/bash
+
+app="${1}"
+
+if test -f "/apps/${app}/latest-version.sh"; then
+  version=$(bash "/apps/${app}/latest-version.sh")
+  if [[ ! -z "${version}" || "${version}" != "null" ]]; then
+    echo "${version}" | tee "/apps/${app}/VERSION" >/dev/null
+    echo "App: ${app} using version: ${version}"
+  fi
+fi
+
+if test -f "/apps/${app}/BASE"; then
+  if test -f "/apps/${app}/latest-base.sh"; then
+    base=$(bash "/apps/${app}/latest-base.sh")
+    if [[ ! -z "${base}" || "${base}" != "null" ]]; then
+      echo "${base}" | tee "/apps/${app}/BASE" >/dev/null
+      echo "App: ${app} using Base: ${base}"
+    fi
+  fi
+fi

containers/.github/workflows/containers.build.yaml

@@ -0,0 +1,353 @@
+name: "Containers: Test-and-Build"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+    - master
+    paths:
+    - 'apps/**'
+    - 'base/**'
+    - ".github/workflows/containers.build.yaml"
+  pull_request:
+    paths:
+    - 'apps/**'
+    - 'base/**'
+    - ".github/workflows/containers.build.yaml"
+
+env:
+  # How long to sleep before running the tests (gives the application time to start)
+  GOSS_SLEEP: 30
+  # Number of times to run the goss test
+  GOSS_ITERATIONS: 3
+
+# Detect which folders in project-root (which contain the containers) contain changes
+jobs:
+  changes:
+    name: Get changes
+    runs-on: ubuntu-24.04
+    outputs:
+      matrix: "{\"container\": ${{ steps.reduce.outputs.containers }} }"
+    steps:
+    - name: Checkout
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+      id: filter
+      with:
+        list-files: json
+        filters: |
+          changed:
+          - 'apps/**'
+          - 'dev/**'
+          - 'base/**'
+    - run: echo '${{ toJson(steps.filter.outputs) }}' > changes.json
+    - id: reduce
+      run: |
+        CONTAINERS=$(jq --raw-output '.changed_files | fromjson | .[] |= sub("(?<filepath>(?<first_directory>(?<root1>[/]?)[^/]+/)(?<second_directory>(?<root2>[/]?)[^/]+)(?<extra_paths>.+))"; "\(.second_directory)") | unique' changes.json)
+        echo ::set-output name=containers::${CONTAINERS}
+
+  hadolint:
+    name: Run hadolint
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+    - name: hadolint
+      uses: reviewdog/action-hadolint@73fec8b28091e5082c19df69815dd749d97b882a # v1.46.0
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        reporter: github-pr-review
+        filter_mode: diff_context
+        hadolint_ignore: DL3007
+        fail_on_error: true
+
+  build:
+    permissions:
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations.
+    name: Build
+    runs-on: ubuntu-24.04
+    needs:
+    - hadolint
+    - changes
+    strategy:
+      matrix: ${{ fromJson(needs.changes.outputs.matrix) }}
+      fail-fast: false
+    if: "!contains(github.event.head_commit.message, '[ci-skip]')"
+    steps:
+    - name: Checkout
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+    # Define if tests and push should be run against which versions/platforms
+    - name: Prepare
+      id: prep
+      run: |
+        # Make sure we have the latest version in the version file
+        # To avoid publishing a new container version with an old tag
+        bash ./.github/update-version-file.sh "${{ matrix.container }}"
+        if test -f "./apps/${{ matrix.container }}/VERSION"; then
+          CATEGORY="apps"
+          VERSION=$(cat ./${CATEGORY}/${{ matrix.container }}/VERSION)
+        elif test -f "./apps/${{ matrix.container }}/Dockerfile"; then
+          CATEGORY="apps"
+          echo ::set-output name=category::${CATEGORY}
+          VERSION="$(head -1 ./${CATEGORY}/${{ matrix.container }}/Dockerfile |  cut -d'@' -f1 | sed 's/^FROM.*://' )"
+          VERSION=$(echo $VERSION | sed "s/latest-//g")
+          VERSION=$(echo $VERSION | sed "s/stable-//g")
+          VERSION=$(echo $VERSION | sed "s/edge-//g")
+          VERSION=$(echo $VERSION | sed "s/build-//g")
+          VERSION=$(echo $VERSION | sed "s/cpu-//g")
+          VERSION=$(echo $VERSION | sed "s/gpu-//g")
+          VERSION=$(echo $VERSION | sed "s/release-//g")
+          VERSION=$(echo $VERSION | sed "s/release_//g")
+          VERSION=$(echo $VERSION | sed "s/version-//g")
+          VERSION=$(echo $VERSION | sed "s/version_//g")
+          VERSION=$(echo $VERSION | sed "s/apache-//g")
+          VERSION=$(echo $VERSION | sed "s/ubuntu-//g")
+          VERSION=$(echo $VERSION | sed "s/focal-//g")
+          VERSION=$(echo $VERSION | sed "s/fpm-//g")
+          VERSION=$(echo $VERSION | sed "s/vaapi-//g")
+          VERSION=$(echo $VERSION | sed "s/cuda-//g")
+          VERSION=$(echo $VERSION | sed "s/-centos7//g")
+          VERSION=$(echo $VERSION | sed "s/java[0-9]*-//g")
+          VERSION="${VERSION#*V.}"
+          VERSION="${VERSION#*v.}"
+          VERSION="${VERSION#*v-}"
+          VERSION="${VERSION#*v}"
+          VERSION="${VERSION%-*}"
+          if (echo "$VERSION" | grep -Pq "^\d+\.\d+$"); then
+            VERSION="${VERSION}.0"
+          fi;
+        else
+          CATEGORY="base"
+          VERSION=$(cat ./${CATEGORY}/${{ matrix.container }}/VERSION) || VERSION="$(head -1 ./${CATEGORY}/${{ matrix.container }}/Dockerfile |  cut -d'@' -f1 | sed 's/^FROM.*://' )"
+          VERSION=$(echo $VERSION | sed "s/latest-//g")
+          VERSION=$(echo $VERSION | sed "s/stable-//g")
+          VERSION="${VERSION#*V.}"
+          VERSION="${VERSION#*v.}"
+          VERSION="${VERSION#*v-}"
+          VERSION="${VERSION#*v}"
+          VERSION="${VERSION%-*}"
+          if (echo "$VERSION" | grep -Pq "^\d+\.\d+$"); then
+            VERSION="${VERSION}.0"
+          fi;
+        fi
+        echo ::set-output name=category::${CATEGORY}
+        echo ::set-output name=version::${VERSION}
+        PLATFORM="linux/amd64"
+        echo ::set-output name=platform::${PLATFORM}
+        if test -f "./${CATEGORY}/${{ matrix.container }}/goss.yaml"; then
+          echo ::set-output name=goss::true
+        else
+          echo ::set-output name=goss::false
+        fi
+        if [ "${{github.event_name}}" == "pull_request" ]; then
+          echo ::set-output name=push::false
+          echo ::set-output name=cache_from::"type=registry,ref=ghcr.io/truecharts/${{ matrix.container }}:buildcache" || echo ::set-output name=cache_from::""
+          echo ::set-output name=cache_to::""
+        else
+          echo ::set-output name=push::true
+          echo ::set-output name=cache_from::"type=registry,ref=ghcr.io/truecharts/${{ matrix.container }}:buildcache"
+          echo ::set-output name=cache_to::"type=registry,ref=ghcr.io/truecharts/${{ matrix.container }}:buildcache,mode=max"
+        fi
+
+    - name: Commit and Push Housekeeping
+      run: |
+        git config user.name "TrueCharts-Bot"
+        git config user.email "bot@truecharts.org"
+        # add only VERSION and BASE files
+        git add ./apps/${{ matrix.container }}/VERSION ./apps/${{ matrix.container }}/BASE || true
+        git commit -sm "Update ${{ matrix.container }} version file" || exit 0
+        git push
+
+    - name: Get Time
+      id: time
+      uses: nanzm/get-time-action@887e4db9af58ebae64998b7105921b816af77977 # v2.0
+      with:
+        timeZone: 1
+        format: 'YYYYMMDDHHmmss'
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
+      with:
+        platforms: amd64
+        
+    - uses: sigstore/cosign-installer@main
+        
+    - name: Install Syft
+      uses: anchore/sbom-action/download-syft@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
+
+    - name: Login to Quay
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+      if: github.event_name != 'pull_request'
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_TCCR_USER }}
+        password: ${{ secrets.QUAY_TCCR_TOKEN }}
+
+    - name: Login to GHCR
+      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
+      if: github.event_name != 'pull_request'
+      with:
+        registry: ghcr.io
+        username: ${{ secrets.GHCR_USERNAME }}
+        password: ${{ secrets.GHCR_TOKEN }}
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
+      with:
+        # list of Docker images to use as base name for tags
+        images: |
+          quay.io/tccr/${{ matrix.container }}
+          tccr.io/tccr/${{ matrix.container }}
+
+    # Install and configure Buildx
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+      with:
+        install: true
+        version: latest
+        driver-opts: image=moby/buildkit:latest
+
+    # Install the GOSS testing framework
+    - name: Set up goss/dgoss
+      uses: e1himself/goss-installation-action@fbb6fb55d3e59c96045b2500eeb8ce0995d99ac1 # v1.2.1
+      if: ${{ steps.prep.outputs.goss == 'true' }}
+      with:
+        version: 'v0.3.16'
+
+    # Creates a local build to run tests on
+    - name: Build and Load local test-container
+      if: ${{ steps.prep.outputs.goss == 'true' }}
+      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
+      with:
+        build-args: |
+          VERSION=${{ steps.prep.outputs.version }}
+          CONTAINER_NAME=${{ matrix.container }}
+          CONTAINER_VER=${{ steps.prep.outputs.version }}
+        context: .
+        file: ./${{ steps.prep.outputs.category }}/${{ matrix.container }}/Dockerfile
+        load: true
+        tags: |
+          tccr.io/tccr/${{ matrix.container }}:test
+        cache-from: ${{ steps.prep.outputs.cache_from }}
+        cache-to: ${{ steps.prep.outputs.cache_to }}
+
+    # Run GOSS tests if included with the container
+    - name: Run GOSS tests
+      if: ${{ steps.prep.outputs.goss == 'true' }}
+      env:
+        GOSS_FILE: ./${{ steps.prep.outputs.category }}/${{ matrix.container }}/goss.yaml
+      run:  |
+        for i in $(seq 1 ${{ env.GOSS_ITERATIONS }}); do
+          echo "Running GOSS test iteration $i of ${{ env.GOSS_ITERATIONS }}..."
+          dgoss run tccr.io/tccr/${{ matrix.container }}:test
+        done
+
+    # Push if not a PR, otherwise just test the build process for all requested platforms
+    - name: Build and Push
+      id: push
+      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
+      with:
+        build-args: |
+          VERSION=${{ steps.prep.outputs.version }}
+          CONTAINER_NAME=${{ matrix.container }}
+          CONTAINER_VER=${{ steps.prep.outputs.version }}
+        context: .
+        platforms: ${{ steps.prep.outputs.platform }}
+        file: ./${{ steps.prep.outputs.category }}/${{ matrix.container }}/Dockerfile
+        push: ${{ steps.prep.outputs.push }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: ${{ steps.prep.outputs.cache_from }}
+        cache-to: ${{ steps.prep.outputs.cache_to }}
+        tags: |
+          quay.io/tccr/${{ matrix.container }}:latest
+          quay.io/tccr/${{ matrix.container }}:v${{ steps.prep.outputs.version }}
+          quay.io/tccr/${{ matrix.container }}:build${{ steps.time.outputs.time }}
+
+    - name: Set quay to Public
+      if: github.event_name != 'pull_request'
+      run: |
+        curl -X POST -H "Content-Type: application/json" -d '{"visibility": "public"}' -H "Authorization: Bearer ${{ secrets.QUAY_TCCR_API_TOKEN }}" "https://quay.io/api/v1/repository/tccr/${{ matrix.container }}/changevisibility"
+      
+    - name: Sign the images
+      if: github.event_name != 'pull_request'
+      run: |
+         cosign sign quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} -y -a "repo=${{ github.repository }}" -a "workflow=${{ github.workflow }}" -a "ref=${{ github.sha }}"
+        
+    - name: Verify the pushed tags
+      if: github.event_name != 'pull_request'
+      run: |
+         cosign verify quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/containers/.github/workflows/containers.build.yaml@refs/heads/master
+      
+    - name: Generate SBOM 
+      if: github.event_name != 'pull_request'
+      run: |
+        syft "quay.io/tccr/${{ matrix.container }}:v${{ steps.prep.outputs.version }}@${{ steps.push.outputs.digest }}" -o spdx-json=${{ matrix.container }}-sbom-spdx.json
+      
+    - name: Attach SBOM to image
+      if: github.event_name != 'pull_request'
+      run: |
+        cosign attest --predicate ${{ matrix.container }}-sbom-spdx.json --type spdx "quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }}" -y
+
+        
+    - name: Verify SBOM attestation
+      if: github.event_name != 'pull_request'
+      run: |
+        cosign verify-attestation quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }}  --type https://spdx.dev/Document --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/containers/.github/workflows/containers.build.yaml@refs/heads/master | jq '.payload |= @base64d | .payload | fromjson'
+        
+    - name: Generate provenance
+      id: gen-prov
+      if: github.event_name != 'pull_request'
+      run: |
+        wget https://github.com/slsa-framework/slsa-github-generator/releases/download/v1.5.0/slsa-generator-container-linux-amd64
+        chmod +x slsa-generator-container-linux-amd64
+        # Generate a predicate only.
+        ./slsa-generator-container-linux-amd64 generate --predicate="${{ matrix.container }}-predicate.json"
+      env:
+        UNTRUSTED_IMAGE: "quay.io/tccr/${{ matrix.container }}"
+        UNTRUSTED_DIGEST: "${{ steps.push.outputs.digest }}"
+        GITHUB_CONTEXT: "${{ toJSON(github) }}"
+          
+    - name: Sign provenance
+      id: sign-prov
+      if: github.event_name != 'pull_request'
+      run: |
+        cosign attest --predicate="${{ matrix.container }}-predicate.json" \
+          --type slsaprovenance \
+          --yes \
+          "quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }}"
+      env:
+        COSIGN_EXPERIMENTAL: 1
+        
+    - name: Verify provenance attestation
+      if: github.event_name != 'pull_request'
+      id: verf-prov
+      run: |
+        cosign verify-attestation quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --type slsaprovenance --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/containers/.github/workflows/containers.build.yaml@refs/heads/master | jq '.payload |= @base64d | .payload | fromjson'
+      env:
+        COSIGN_EXPERIMENTAL: 1
+          
+  container-build-complete:
+    needs: [build]
+    name: Container Build Completed
+    runs-on: ubuntu-latest
+    steps:
+      - name: complete message
+        run: echo "Container Build and Tests Completed Successfully"
+
+  automerge:
+    needs: [container-build-complete]
+    if: github.event_name == 'pull_request'
+    name: Automerge build
+    runs-on: ubuntu-latest
+    steps:
+      - name: automerge
+        uses: pascalgn/automerge-action@7961b8b5eec56cc088c140b56d864285eabd3f67 # v0.16.4
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: "${{ secrets.BOT_TOKEN }}"
+          UPDATE_RETRIES: 12
+          UPDATE_RETRY_SLEEP: 60000

containers/.github/workflows/housekeeping.yaml

@@ -0,0 +1,36 @@
+name: "Housekeeping"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/housekeeping.yaml"
+  schedule:
+    - cron: "0 1 * * *"
+
+jobs:
+  housekeeping:
+    runs-on: ubuntu-latest
+    name: "Housekeeping"
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.BOT_TOKEN }}
+
+      - name: Containers - Fetch new application versions
+        run: |
+          find ./apps -maxdepth 1 -mindepth 1 -type d -exec basename {} \; | while read app; do
+            bash ./.github/update-version-file.sh "${app}"
+          done
+
+      - name: Commit and Push Housekeeping
+        run: |
+          git config user.name "TrueCharts-Bot"
+          git config user.email "bot@truecharts.org"
+          git add --all
+          git commit -sm "Daily Housekeeping" || exit 0
+          git push

containers/.github/workflows/scarf.yaml

@@ -0,0 +1,36 @@
+name: "Scarf-Processing"
+
+on:
+  workflow_dispatch:
+
+jobs:
+  housekeeping:
+    runs-on: ubuntu-latest
+    name: "Add to Scarf"
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.BOT_TOKEN }}
+      - name: Containers - Fetch new application versions
+        env:
+          scarf_key: ${{ secrets.SCARF_SECRET }}
+        run: |
+          PLAIN='jackett'
+
+          ajson="Accept:application/json"
+          credentials="Authorization: Bearer ${scarf_key}"
+          CT="Content-Type:application/json"
+
+          for group in apps dev mirror base; do
+            for i in ${group}/*; do
+              PLAIN=$( echo $i | cut -d'/' -f2 )
+
+              data='{"name":"tccr/'${PLAIN}'","backendUrl":"https://quay.io/tccr/'${PLAIN}'","longDescription":"","shortDescription":"example description","website":"https://truecharts.org","libraryType":"docker","publicUrl":"https://tccr.io/tccr/'${PLAIN}'"}'
+              url="https://scarf.sh/api/v1/packages"
+
+              curl --header "$ajson" --header "$credentials" --data "$data" --header "$CT" "$url"
+
+            done
+          done

containers/.github/workflows/schedule-sync-labels.yaml

@@ -0,0 +1,25 @@
+---
+name: "Schedule: Sync labels"
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+  schedule:
+    - cron: "0 * * * *"
+
+jobs:
+  labels:
+    name: Sync Labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        with:
+          token: ${{ secrets.BOT_TOKEN }}
+
+      - name: Sync Labels
+        uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2
+        with:
+          config-file: |
+              https://raw.githubusercontent.com/truecharts/.github/main/.github/labels.yaml
+          token: "${{ secrets.BOT_TOKEN }}"
+          delete-other-labels: true

containers/.github/workflows/stale.yaml

@@ -0,0 +1,38 @@
+---
+name: "Mark or close stale issues and PRs"
+on:
+  workflow_dispatch:
+  schedule:
+    # Run the stalebot every day at 8pm UTC
+    - cron: "00 20 * * *"
+
+jobs:
+  stale:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check for stale issues and PRs
+        uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9
+        with:
+          repo-token: ${{ secrets.BOT_TOKEN }}
+          days-before-issue-stale: 180
+          days-before-pr-stale: 180
+          days-before-close: 14
+          days-before-pr-close: 14
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not had recent activity.
+            It will be closed in two weeks if no further activity occurs.
+            Thank you for your contributions.
+          stale-pr-message: >
+            This pull request has been automatically marked as stale because it has not had
+            recent activity. It will be closed in two weeks if no further activity occurs.
+            Thank you for your contributions.
+          close-issue-message: >
+            This issue has been automatically closed due to inactivity.
+            Please re-open if this still requires investigation.
+          close-pr-message: >
+            This pull request has been automatically closed due to inactivity.
+            Please re-open if these changes are still required.
+          stale-pr-label: "stale"
+          stale-issue-label: "stale"
+          exempt-issue-labels: "keepalive"
+          exempt-pr-labels: "keepalive"