vNext

.github/workflows/ci.yaml

@@ -12,123 +12,46 @@ on:
 env:
   REGISTRY_IMAGE: ghcr.io/yubiuser/webchanges
 
+permissions:
+  contents: read
+
 jobs:
+  build-prepare:
+    runs-on: ubuntu-24.04
+    outputs:
+      REGISTRY_IMAGE: ${{ env.REGISTRY_IMAGE }}
+    steps:
+      # FIXME: can't use env object in reusable workflow inputs: https://github.com/orgs/community/discussions/26671
+      - run: echo "Exposing env vars for reusable workflow"
   build:
-    runs-on: ${{ matrix.runner }}
+    uses: docker/github-builder/.github/workflows/build.yml@v1.12.0
     permissions:
       contents: read
-      packages: write
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-    steps:
-
-      - name: Prepare name for digest up/download
-        run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-
-      -
-        name: Checkout Code
-        uses: actions/checkout@v6.0.2
-
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.0.0
-
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
-
-      -
-        name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: |
-            ${{ env.REGISTRY_IMAGE }}
-      -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.0.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      -
-        name: Build and push Docker image
-        uses: docker/build-push-action@v7.0.0
-        id: build
-        with:
-          context: .
-          platforms: ${{ matrix.platform }}
-          labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
-          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push' || github.event_name == 'release' }}
-
-      - name: Export digest
-        run: |
-          mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
-      - name: Upload digest
-        uses: actions/upload-artifact@v7.0.0
-        with:
-          name: digests-${{ env.PLATFORM_PAIR }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  merge:
-    runs-on: ubuntu-latest
+      packages: write # required to push to GHCR
+      id-token: write # for signing attestation(s) with GitHub OIDC Token
     needs:
-      - build
-    if: |
-      github.actor != 'dependabot[bot]'
-      && ( github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push' || github.event_name == 'release' )
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v8.0.1
-        with:
-          path: /tmp/digests
-          pattern: digests-*
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.0.0
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: |
-            ${{ env.REGISTRY_IMAGE }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha,enable=${{ github.event_name == 'workflow_dispatch' }}
-            type=ref,event=pr
-            type=ref,event=branch
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.0.0
-        with:
-          registry: ghcr.io
+      - build-prepare
+    with:
+      distribute: true
+      setup-qemu: true
+      output: image
+      cache: true
+      cache-scope: build
+      fail-fast: true
+      push: ${{ github.actor != 'dependabot[bot]' && ( github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push' || github.event_name == 'release' ) }}
+      meta-images: ${{ needs.build-prepare.outputs.REGISTRY_IMAGE }}
+      meta-tags: |
+        type=semver,pattern={{version}}
+        type=semver,pattern={{major}}.{{minor}}
+        type=semver,pattern={{major}}
+        type=sha,enable=${{ github.event_name == 'workflow_dispatch' }}
+        type=ref,event=pr
+        type=ref,event=branch
+      platforms: linux/amd64,linux/arm64
+      # FIXME: GHCR does not support the referrers API and spams the registry with sha-tagged images when cosigned: https://github.com/docker/github-builder/issues/109
+      sign: false
+    secrets:
+      registry-auths: |
+        - registry: ghcr.io
           username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Create manifest list and push
-        working-directory: /tmp/digests
-        run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
-      - name: Inspect image
-        run: |
-          docker buildx imagetools inspect --raw ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
-
+          password: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/delete_untagged_images.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Delete all images from repository without tags
-        uses: Chizkiyahu/delete-untagged-ghcr-action@v6.1.0
+        uses: Chizkiyahu/delete-untagged-ghcr-action@v6.1.1
         with:
           token: ${{ secrets.PAT_TOKEN }}
           repository_owner: ${{ github.repository_owner }}

.github/workflows/sync-back-to-dev.yml

@@ -18,7 +18,7 @@ jobs:
     name: Syncing branches
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v7.0.0
       - name: Opening pull request
         run: gh pr create -B development -H main --title 'Sync main back into development' --body 'Created by Github action'
         env:

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
-ARG webchanges_tag=v3.34.1
+ARG webchanges_tag=v3.36.1
 
-FROM python:3.14.1-alpine3.22 AS builder
+FROM python:3.14.5-alpine3.22 AS builder
 ARG webchanges_tag
 ENV PYTHONUTF8=1
 
@@ -32,17 +32,18 @@ RUN python3 -m pip install -r requirements.txt \
 # Install some additional packages used by webchanges (optional)
 # see https://webchanges.readthedocs.io/en/stable/dependencies.html
 RUN python3 -m pip install \
-    html5lib \
     beautifulsoup4 \
-    jsbeautifier \
+    chump \
     cssbeautifier \
+    curl_cffi \
+    html5lib \
     jq \
-    chump \
-    pyopenssl \
+    jsbeautifier \
     minidb \
+    pyopenssl \
     python-dateutil \
-    zstandard \
-    vobject
+    vobject \
+    zstandard
 
 # Copy entrypoint script
 COPY webchanges.py webchanges.py
@@ -60,7 +61,7 @@ RUN python3 -m PyInstaller -F --strip webchanges.py
 
 
 
-FROM alpine:3.23 AS deploy
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS deploy
 ENV APP_USER=webchanges
 ENV PYTHONUTF8=1
 RUN apk add --no-cache tini

README.md

@@ -4,19 +4,20 @@ This repo provides a small docker image for running [webchanges](https://github.
 
 The following optional dependencies of `webchanges` are included (see [Dependencies](https://webchanges.readthedocs.io/en/stable/dependencies.html#dependencies))
 
-|   | Comment  |
-|---|---|
+| | Comment |
+| --- | --- |
+| `beautifulsoup4` | `beautify` filter |
+| `chump` | for `pushover` reporter |
+| `cssbeautifier` | `beautify` filter |
+| `curl_cffi` | to allow curl_cffi backend |
+| `html5lib` | parser for the bs4 method of the html2text filter |
+| `jq` | |
+| `jsbeautifier` | `beautify` filter |
 | `minidb` | to allow importing legacy `urlwatch` databases |
-|  `html5lib` |  parser for the bs4 method of the html2text filter |
-| `beautifulsoup4`  |  `beautify` filter |
-|  `jsbeautifier` | `beautify` filter  |
-|  `cssbeautifier` |  `beautify` filter |
-|  `jq` |   |
-|  `chump` |  for `pushover` reporter |
-|  `pyopenssl` | |
+| `pyopenssl` | |
 | `python-dateutil` | for `--rollback-database` |
-| `zstandard` | for Zstandard compression|
 | `vobject` | for iCal handling |
+| `zstandard` | for Zstandard compression |
 
 ## Versioning