Staging

.github/workflows/build_image.yml

@@ -6,15 +6,15 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Workflow run cleanup action
-              uses: rokroskar/workflow-run-cleanup-action@v0.3.3
+              uses: rokroskar/workflow-run-cleanup-action@ee1451b869ba1e381729b3d40489997021f0d562 # v0.3.3
               env:
                 GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-            - uses: actions/setup-python@v6
+            - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
               with:
                 python-version: '3.14' # Version range or exact version of a Python version to use, using SemVer's version range syntax
-            - uses: actions/checkout@v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - name: Build with retry
-              uses: Wandalen/wretry.action@v3.8.0
+              uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0
               with:
                 command: docker build --no-cache  . 
                 attempt_limit: 3

.github/workflows/create_release_image.yml

@@ -11,17 +11,17 @@ jobs:
      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
-     - uses: actions/checkout@master
+     - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
      - name: Set up Docker Buildx
-       uses: docker/setup-buildx-action@v4
+       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Login to de.NBI OCI
-       uses: docker/login-action@v4
+       uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
        with:
           registry: oci.bi.denbi.de
           username: ${{ secrets.OCI_DENBI_USERNAME }}
           password: ${{ secrets.OCI_DENBI_TOKEN }}
      - name: Build and publish image to de.NBI OCI
-       uses: docker/build-push-action@v7
+       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        env:
           REPOSITORY: https://github.com/deNBI/cloud-user-docs/archive/master.tar.gz  
        with:

.github/workflows/main.yml

@@ -9,20 +9,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Workflow run cleanup action
-      uses: rokroskar/workflow-run-cleanup-action@v0.3.3
+      uses: rokroskar/workflow-run-cleanup-action@ee1451b869ba1e381729b3d40489997021f0d562 # v0.3.3
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - uses: actions/checkout@master
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
     - name: Login to de.NBI OCI
-      uses: docker/login-action@v4
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
       with:
           registry: oci.bi.denbi.de
           username: ${{ secrets.OCI_DENBI_USERNAME }}
           password: ${{ secrets.OCI_DENBI_TOKEN }}
     - name: Build and publish image to de.NBI OCI
-      uses: docker/build-push-action@v7
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
       env:
           REPOSITORY: https://github.com/deNBI/cloud-user-docs/archive/staging.tar.gz  
       with:

Dockerfile

@@ -1,37 +1,57 @@
-# Use a stable Python base image (Debian 12 based)
-FROM python:3.14-slim@sha256:b877e50bd90de10af8d82c57a022fc2e0dc731c5320d762a27986facfc3355c1
+# --- Build Stage for Webhook ---
+# Use Alpine for the builder to maintain consistency
+FROM golang:1.26-alpine AS builder
+
+# Install git to fetch dependencies
+RUN apk add --no-cache git
+
+# Clone and build webhook as a static binary (CGO_ENABLED=0)
+# This ensures it runs on Alpine's musl libc
+RUN git clone https://github.com/adnanh/webhook.git /build \
+    && cd /build \
+    && CGO_ENABLED=0 go build -o webhook .
+
+# --- Final Stage ---
+FROM python:3.13-alpine
 
 # Set environment variables
 ENV WEBHOOK_URL_PREFIX="wiki/hooks"
 
 # Install system dependencies
-RUN apt update && apt upgrade && apt install -y --no-install-recommends \
-    unzip apache2 build-essential python3-dev python3-pip \
-    python3-setuptools python3-wheel python3-cffi libcairo2 \
-    libpango-1.0-0 libpangocairo-1.0-0 libgdk-pixbuf-2.0-0 \
-    libffi-dev shared-mime-info git wget curl ca-certificates \
-    && apt clean && rm -rf /var/lib/apt/lists/*
+# apache2 = Apache, util-linux = for 'flock' in update.sh
+RUN apk add --no-cache \
+    apache2 \
+    git \
+    ca-certificates \
+    util-linux
 
-# Copy and install Python dependencies
-ADD requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+# Create required directories
+# Alpine's httpd uses /var/www/localhost/htdocs by default,
+# but we'll keep your custom paths.
+RUN mkdir -p /var/webhook /srv_root/docs /var/www/html/wiki /run/httpd /var/log/httpd
 
-# Install webhook binary
-RUN wget -qO- https://github.com/adnanh/webhook/releases/download/2.8.3/webhook-linux-amd64.tar.gz \
-    | tar xzv --strip 1 -C /usr/local/bin
+# Copy and install Python dependencies
+# We use --no-cache-dir to keep the image slim
+COPY requirements.txt .
+RUN pip install --no-cache-dir --upgrade pip && \
+    pip install --no-cache-dir -r requirements.txt
 
-# Create required directories
-RUN mkdir -p /var/webhook /srv_root/docs /var/www/html/wiki
+# Copy the statically built webhook binary from the builder stage
+COPY --from=builder /build/webhook /usr/local/bin/webhook
 
 # Copy your scripts and config files
-ADD update.sh /usr/local/bin/update.sh
+COPY update.sh /usr/local/bin/update.sh
 COPY config/hooks.json /usr/local/bin/hooks.json
-COPY config/apache2.conf /etc/apache2/apache2.conf
-ADD start.sh /usr/local/bin/start.sh
+# Apache config path changes from /etc/apache2 to /etc/httpd in Alpine
+COPY config/apache2.conf /etc/httpd/httpd.conf
+COPY start.sh /usr/local/bin/start.sh
 
 # Ensure shell scripts are executable
 RUN chmod +x /usr/local/bin/start.sh /usr/local/bin/update.sh
 
 # Set container entrypoint
 ENTRYPOINT ["/usr/local/bin/start.sh"]
 
+
+
+