3.22

.github/workflows/build-and-release.docker.yml

@@ -0,0 +1,60 @@
+name: Build and Release Docker Images
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Find all Dockerfiles
+        id: find_dockerfiles
+        run: |
+          find . -type f -iname 'Dockerfile' > dockerfiles.txt
+          cat dockerfiles.txt
+
+      - name: Build Docker images and save as tarballs
+        id: build_save
+        run: |
+          mkdir -p docker-images
+          i=0
+          while IFS= read -r dockerfile; do
+            dir=$(dirname "$dockerfile")
+            image_name="image_$i"
+            tag="release-${{ github.run_number }}-$i"
+            tar_name="docker-image-$i.tar"
+            echo "Building $image_name from $dockerfile"
+            docker build -f "$dockerfile" -t "$image_name:$tag" "$dir"
+            docker save -o "docker-images/$tar_name" "$image_name:$tag"
+            echo "Saved docker-images/$tar_name"
+            echo "TAR_PATH_$i=docker-images/$tar_name" >> $GITHUB_ENV
+            ((i++))
+          done < dockerfiles.txt
+          echo "BUILT_IMAGES=$i" >> $GITHUB_ENV
+
+      - name: Create Release
+        id: create_release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: docker-release-${{ github.run_number }}
+          name: Docker Release ${{ github.run_number }}
+          body: |
+            Automated release of all Docker images built from all Dockerfiles found in the repository.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload Docker image tarballs to Release
+        run: |
+          for tar in docker-images/*.tar; do
+            gh release upload ${{ steps.create_release.outputs.tag_name }} "$tar"
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/call_issue_pr_tracker.yml

@@ -8,6 +8,9 @@ on:
   pull_request_review:
     types: [submitted,edited,dismissed]
 
+permissions:
+  contents: read
+
 jobs:
   manage-project:
     permissions:

.github/workflows/call_issues_cron.yml

@@ -4,6 +4,9 @@ on:
     - cron:  '9 11 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     permissions:

.github/workflows/external_trigger.yml

@@ -3,6 +3,9 @@ name: External Trigger Main
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-master:
     runs-on: ubuntu-latest

.github/workflows/external_trigger_scheduler.yml

@@ -5,6 +5,9 @@ on:
     - cron:  '20 * * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   external-trigger-scheduler:
     runs-on: ubuntu-latest

.github/workflows/greetings.yml

@@ -2,8 +2,14 @@ name: Greetings
 
 on: [pull_request_target, issues]
 
+permissions:
+  contents: read
+
 jobs:
   greeting:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/first-interaction@v1

.github/workflows/package_trigger_scheduler.yml

@@ -5,6 +5,9 @@ on:
     - cron:  '15 13 * * 6'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   package-trigger-scheduler:
     runs-on: ubuntu-latest

Dockerfile.armhf

@@ -0,0 +1,102 @@
+# syntax=docker/dockerfile:1
+
+FROM alpine:3.21 AS rootfs-stage
+
+ARG S6_OVERLAY_VERSION="3.2.1.0"
+ARG ROOTFS=/root-out
+ARG REL=v3.22
+ARG ARCH=armhf
+ARG MIRROR=http://dl-cdn.alpinelinux.org/alpine
+ARG PACKAGES=alpine-baselayout,\
+alpine-keys,\
+apk-tools,\
+busybox,\
+libc-utils
+
+# install packages
+RUN \
+  apk add --no-cache \
+    bash \
+    xz
+
+# build rootfs
+RUN \
+  mkdir -p "${ROOTFS}/etc/apk" && \
+  { \
+    echo "${MIRROR}/${REL}/main"; \
+    echo "${MIRROR}/${REL}/community"; \
+  } > "${ROOTFS}/etc/apk/repositories" && \
+  apk --root "${ROOTFS}" --no-cache --keys-dir /etc/apk/keys add --arch ${ARCH} --initdb ${PACKAGES//,/ } && \
+  sed -i -e 's/^root::/root:!:/' /root-out/etc/shadow
+
+# add s6 overlay
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
+RUN tar -C /root-out -Jxpf /tmp/s6-overlay-noarch.tar.xz
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${ARCH}.tar.xz /tmp
+RUN tar -C /root-out -Jxpf /tmp/s6-overlay-${ARCH}.tar.xz
+
+# add s6 optional symlinks
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-noarch.tar.xz /tmp
+RUN tar -C /root-out -Jxpf /tmp/s6-overlay-symlinks-noarch.tar.xz && unlink /root-out/usr/bin/with-contenv
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-symlinks-arch.tar.xz /tmp
+RUN tar -C /root-out -Jxpf /tmp/s6-overlay-symlinks-arch.tar.xz
+
+# Runtime stage
+FROM scratch
+COPY --from=rootfs-stage /root-out/ /
+ARG BUILD_DATE
+ARG VERSION
+ARG MODS_VERSION="v3"
+ARG PKG_INST_VERSION="v1"
+ARG LSIOWN_VERSION="v1"
+ARG WITHCONTENV_VERSION="v1"
+LABEL build_version="Linuxserver.io version:- ${VERSION} Build-date:- ${BUILD_DATE}"
+LABEL maintainer="TheLamer"
+
+ADD --chmod=755 "https://raw.githubusercontent.com/linuxserver/docker-mods/mod-scripts/docker-mods.${MODS_VERSION}" "/docker-mods"
+ADD --chmod=755 "https://raw.githubusercontent.com/linuxserver/docker-mods/mod-scripts/package-install.${PKG_INST_VERSION}" "/etc/s6-overlay/s6-rc.d/init-mods-package-install/run"
+ADD --chmod=755 "https://raw.githubusercontent.com/linuxserver/docker-mods/mod-scripts/lsiown.${LSIOWN_VERSION}" "/usr/bin/lsiown"
+ADD --chmod=755 "https://raw.githubusercontent.com/linuxserver/docker-mods/mod-scripts/with-contenv.${WITHCONTENV_VERSION}" "/usr/bin/with-contenv"
+
+# environment variables
+ENV PS1="$(whoami)@$(hostname):$(pwd)\\$ " \
+  HOME="/root" \
+  TERM="xterm" \
+  S6_CMD_WAIT_FOR_SERVICES_MAXTIME="0" \
+  S6_VERBOSITY=1 \
+  S6_STAGE2_HOOK=/docker-mods \
+  VIRTUAL_ENV=/lsiopy \
+  PATH="/lsiopy/bin:$PATH"
+
+RUN \
+  echo "**** install runtime packages ****" && \
+  apk add --no-cache \
+    alpine-release \
+    bash \
+    ca-certificates \
+    catatonit \
+    coreutils \
+    curl \
+    findutils \
+    jq \
+    netcat-openbsd \
+    procps-ng \
+    shadow \
+    tzdata && \
+  echo "**** create abc user and make our folders ****" && \
+  groupmod -g 1000 users && \
+  useradd -u 911 -U -d /config -s /bin/false abc && \
+  usermod -G users abc && \
+  mkdir -p \
+    /app \
+    /config \
+    /defaults \
+    /lsiopy && \
+  echo "**** cleanup ****" && \
+  rm -rf \
+    /tmp/*
+
+# add local files
+COPY root/ /
+
+ENTRYPOINT ["/init"]

Jenkinsfile

@@ -94,7 +94,11 @@ pipeline {
           env.DOCKERHUB_LINK = 'https://hub.docker.com/r/' + env.DOCKERHUB_IMAGE + '/tags/'
           env.PULL_REQUEST = env.CHANGE_ID
           env.TEMPLATED_FILES = 'Jenkinsfile README.md LICENSE .editorconfig ./.github/CONTRIBUTING.md ./.github/FUNDING.yml ./.github/ISSUE_TEMPLATE/config.yml ./.github/ISSUE_TEMPLATE/issue.bug.yml ./.github/ISSUE_TEMPLATE/issue.feature.yml ./.github/PULL_REQUEST_TEMPLATE.md ./.github/workflows/external_trigger_scheduler.yml ./.github/workflows/greetings.yml ./.github/workflows/package_trigger_scheduler.yml ./.github/workflows/call_issue_pr_tracker.yml ./.github/workflows/call_issues_cron.yml ./.github/workflows/permissions.yml ./.github/workflows/external_trigger.yml'
+          if ( env.SYFT_IMAGE_TAG == null ) {
+            env.SYFT_IMAGE_TAG = 'latest'
+          }
         }
+        echo "Using syft image tag ${SYFT_IMAGE_TAG}"
         sh '''#! /bin/bash
               echo "The default github branch detected as ${GH_DEFAULT_BRANCH}" '''
         script{
@@ -778,7 +782,7 @@ pipeline {
               docker run --rm \
                 -v /var/run/docker.sock:/var/run/docker.sock:ro \
                 -v ${TEMPDIR}:/tmp \
-                ghcr.io/anchore/syft:latest \
+                ghcr.io/anchore/syft:${SYFT_IMAGE_TAG} \
                 ${LOCAL_CONTAINER} -o table=/tmp/package_versions.txt
               NEW_PACKAGE_TAG=$(md5sum ${TEMPDIR}/package_versions.txt | cut -c1-8 )
               echo "Package tag sha from current packages in buit container is ${NEW_PACKAGE_TAG} comparing to old ${PACKAGE_TAG} from github"
@@ -890,6 +894,7 @@ pipeline {
                 -e WEB_AUTH=\"${CI_AUTH}\" \
                 -e WEB_PATH=\"${CI_WEBPATH}\" \
                 -e NODE_NAME=\"${NODE_NAME}\" \
+                -e SYFT_IMAGE_TAG=\"${CI_SYFT_IMAGE_TAG:-${SYFT_IMAGE_TAG}}\" \
                 -t ghcr.io/linuxserver/ci:latest \
                 python3 test_build.py'''
         }

package_versions.txt

@@ -17,21 +17,21 @@ coreutils               9.7-r1            apk
 coreutils-env           9.7-r1            apk     
 coreutils-fmt           9.7-r1            apk     
 coreutils-sha512sum     9.7-r1            apk     
-curl                    8.14.0-r2         apk     
+curl                    8.14.1-r1         apk     
 findutils               4.10.0-r0         apk     
-jq                      1.7.1-r0          apk     
+jq                      1.8.0-r0          apk     
 libapk2                 2.14.9-r2         apk     
 libattr                 2.5.2-r2          apk     
 libbsd                  0.12.2-r0         apk     
-libcrypto3              3.5.0-r0          apk     
-libcurl                 8.14.0-r2         apk     
+libcrypto3              3.5.1-r0          apk     
+libcurl                 8.14.1-r1         apk     
 libidn2                 2.3.7-r0          apk     
 libintl                 0.24.1-r0         apk     
 libmd                   1.1.0-r0          apk     
 libncursesw             6.5_p20250503-r0  apk     
 libproc2                4.0.4-r3          apk     
 libpsl                  0.21.5-r3         apk     
-libssl3                 3.5.0-r0          apk     
+libssl3                 3.5.1-r0          apk     
 libunistring            1.3-r0            apk     
 linux-pam               1.7.0-r4          apk     
 musl                    1.2.5-r10         apk