Migrate to Debian, run non-root, split CI, align with org scaffolding

.github/settings.yml

@@ -0,0 +1,22 @@
+_extends: .github
+# https://github.com/apps/settings
+# https://github.com/repository-settings/app
+
+repository:
+  description: Docker DHCP Relay
+  topics: docker, dhcp, dhcp-relay, isc-dhcp
+
+  private: false
+  has_issues: true
+  has_wiki: false
+  has_downloads: true
+  has_projects: false
+
+  default_branch: master
+
+  allow_squash_merge: true
+  allow_rebase_merge: true
+  allow_merge_commit: false
+
+  enable_automated_security_fixes: true
+  enable_vulnerability_alerts: true

.github/workflows/autoassign.yml

@@ -1,14 +1,31 @@
-name: Issue assignment
+name: Issue and PR assignment
 
 on:
   issues:
     types: [opened]
+  pull_request:
+    types: [opened]
 
 jobs:
-  auto-assign:
+  auto-assign-issue:
+    if: github.event_name == 'issues'
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
         - name: 'Auto-assign issue'
-          uses: pozil/auto-assign-issue@v1
+          uses: pozil/[email protected]
+          with:
+            assignees: modem7
+
+  auto-assign-pr:
+    if: github.event_name == 'pull_request' && github.actor != 'renovate[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+        - name: 'Auto-assign PR'
+          uses: pozil/[email protected]
           with:
-            assignees: modem7
+            assignees: modem7

.github/workflows/dhcrelay-freshness.yml

@@ -0,0 +1,49 @@
+name: Check dhcrelay freshness
+
+on:
+  schedule:
+    # Weekly - Debian security backports to isc-dhcp-relay land on the order
+    # of weeks/months, not days, so there's no value checking more often.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve current Debian package version
+        id: debian
+        run: |
+          docker run --rm debian:trixie-slim sh -c \
+            "apt-get update -qq && apt-cache policy isc-dhcp-relay | awk '/Candidate:/ {print \$2}'" \
+            > debian_version.txt
+          echo "version=$(cat debian_version.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve currently published image version
+        id: published
+        run: |
+          published=$(curl -fsS "https://hub.docker.com/v2/repositories/modem7/dhcprelay/tags?page_size=100" \
+            | jq -r '.results[].name' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -1)
+          echo "version=$published" >> "$GITHUB_OUTPUT"
+
+      - name: Compare and open a tracking issue if stale
+        if: steps.published.outputs.version != '' && !startsWith(steps.debian.outputs.version, steps.published.outputs.version)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEBIAN_VERSION: ${{ steps.debian.outputs.version }}
+          PUBLISHED_VERSION: ${{ steps.published.outputs.version }}
+        run: |
+          set -eu
+          existing=$(gh issue list --label dependencies --state open --search "dhcrelay version is out of date in:title" --json number --jq 'length')
+          if [ "$existing" -gt 0 ]; then
+            echo "An open freshness issue already exists, skipping."
+          else
+            gh issue create \
+              --title "dhcrelay version is out of date" \
+              --label dependencies \
+              --body "Debian trixie currently offers isc-dhcp-relay ${DEBIAN_VERSION}, but the latest published image tag is ${PUBLISHED_VERSION}. Trigger a rebuild via the Woodpecker pipeline's manual event to pick up the update. This issue needs closing manually once the new image is published."
+          fi

.github/workflows/lint.yml

@@ -0,0 +1,25 @@
+name: Lint Dockerfile
+
+on:
+  push:
+    paths:
+      - Dockerfile
+      - .github/workflows/lint.yml
+  pull_request:
+    paths:
+      - Dockerfile
+      - .github/workflows/lint.yml
+  workflow_dispatch:
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/[email protected]
+
+      - name: Run hadolint
+        run: |
+          docker run --rm -v "$PWD":/work -w /work \
+            hadolint/hadolint:v2.15.1-alpine@sha256:a1d49ae1a4e83c1dbad26b8c1ad7588c8bd1e04f4866b34ad3cac50335198552 \
+            sh -c "hadolint --version && hadolint Dockerfile"

.hadolint.yaml

@@ -1,3 +1,3 @@
 override:
   style:
-    - DL3018
+    - DL3008

.woodpecker.yml

@@ -0,0 +1,99 @@
+when:
+  - event: [push, manual]
+    branch: master
+    path:
+      # Scoped to what actually gets baked into the image - docs/CI-only
+      # changes elsewhere shouldn't trigger a rebuild/republish.
+      include:
+        - Dockerfile
+        - entrypoint.sh
+        - .woodpecker.yml
+
+steps:
+  # Resolves the DHCPv4/v6 relay version tag (e.g. "4.4.3") from Debian's
+  # live apt index for isc-dhcp-relay, rather than a version pinned in the
+  # Dockerfile - the package is deliberately left unpinned there so every
+  # rebuild picks up Debian's latest security backport automatically.
+  - name: prepare-tags
+    image: debian:trixie-slim
+    commands:
+      - apt-get update -qq
+      - pkg_ver=$(apt-cache policy isc-dhcp-relay | awk '/Candidate:/ {print $2}')
+      - relay_ver=$(echo "$pkg_ver" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
+      - printf "latest\n%s\n" "$relay_ver" > .tags
+      - echo "Tags to publish:" && cat .tags
+
+  - name: build-and-push
+    image: woodpeckerci/plugin-docker-buildx
+    privileged: true
+    depends_on: [prepare-tags]
+    settings:
+      repo: modem7/dhcprelay
+      dockerfile: Dockerfile
+      context: .
+      purge: true
+      compress: true
+      build_args:
+        BUILDKIT_INLINE_CACHE: "1"
+      cache_from:
+        - type=registry\,ref=modem7/dhcprelay:latest
+      platforms: linux/amd64,linux/arm64
+      username:
+        from_secret: docker_username
+      password:
+        from_secret: docker_password
+      tags_file: .tags
+
+  - name: pushrm-dockerhub
+    image: chko/docker-pushrm
+    depends_on:
+      - build-and-push
+    environment:
+      DOCKER_USER:
+        from_secret: docker_username
+      DOCKER_PASS:
+        from_secret: docker_password
+      PUSHRM_FILE: README.md
+      PUSHRM_SHORT: Docker DHCP Relay
+      PUSHRM_TARGET: modem7/dhcprelay
+    when:
+      - status: [success]
+
+  # Single dynamic-status notifier, replacing notify-slack-success/failure.
+  # CI_PIPELINE_STATUS must stay bare ($VAR, not ${VAR}) - Woodpecker
+  # resolves ${VAR} at compile time, before this value exists
+  # (woodpecker-ci/woodpecker#6826).
+  - name: notify-slack
+    image: alpine
+    depends_on:
+      - build-and-push
+    environment:
+      SLACK_WEBHOOK:
+        from_secret: slack_hook
+    commands:
+      - apk add --no-cache curl jq >/dev/null
+      - COMMIT_SHORT=$(echo "$CI_COMMIT_SHA" | cut -c1-10)
+      - >
+        PAYLOAD=$(jq -n
+        --arg status "$CI_PIPELINE_STATUS"
+        --arg branch "$CI_COMMIT_BRANCH"
+        --arg output "${CI_REPO}#${CI_PIPELINE_NUMBER}"
+        --arg output_url "$CI_PIPELINE_URL"
+        --arg build "$CI_PIPELINE_NUMBER"
+        --arg commit "$COMMIT_SHORT"
+        --arg commit_url "$CI_PIPELINE_FORGE_URL"
+        --arg author "$CI_COMMIT_AUTHOR"
+        --arg message "$CI_COMMIT_MESSAGE"
+        '{attachments:[{color:(if $status == "success" then "good" else "danger" end),fields:[
+        {title:"Status",value:$status,short:true},
+        {title:"Branch",value:$branch,short:true},
+        {title:"Output",value:("<"+$output_url+"|"+$output+">"),short:true},
+        {title:"Build Number",value:$build,short:true},
+        {title:"Commit",value:("<"+$commit_url+"|"+$commit+">"),short:true},
+        {title:"Author",value:$author,short:true},
+        {title:"Commit Message",value:$message,short:false}
+        ]}]}')
+      - >
+        curl -fsS -X POST -H 'Content-type: application/json' --data "$PAYLOAD" "$SLACK_WEBHOOK"
+    when:
+      - status: [success, failure]