diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 2eef3db..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,24 +0,0 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 -updates: - # Maintain dependencies for Go - - package-ecosystem: "gomod" - directory: "/" - schedule: - interval: "weekly" - - # Maintain dependencies for build tools - - package-ecosystem: "gomod" - directory: "/tools" - schedule: - interval: "weekly" - - # Maintain dependencies for GitHub Actions - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8960976..c7bff20 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,8 +15,13 @@ jobs: name: Main Process runs-on: ubuntu-latest env: - GO_VERSION: 1.23 + # Keep in sync with go.mod. Capped at 1.22 because the plugin is run by + # yaegi (bundled in Traefik) and even Traefik v3.7.1 ships yaegi v0.16.1, + # which only supports Go 1.22. Building on the floor makes go build / go + # test reject newer stdlib before yaegi_test does. + GO_VERSION: 1.22 GOLANGCI_LINT_VERSION: v1.63.4 + # yaegi_test guard — pin to the version current Traefik bundles. YAEGI_VERSION: v0.16.1 CGO_ENABLED: 0 defaults: diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml new file mode 100644 index 0000000..b119786 --- /dev/null +++ b/.github/workflows/renovate.yml @@ -0,0 +1,38 @@ +name: Renovate + +# Self-hosted Renovate: opens dependency-update PRs on a weekly schedule. +# Config lives in /renovate.json. Requires a repo/org secret RENOVATE_TOKEN +# (a PAT with `repo` + `workflow` scope, or a fine-grained token with +# contents:write + pull-requests:write) so Renovate can push branches and open +# PRs. Trigger manually from the Actions tab via "Run workflow" to test. + +on: + schedule: + - cron: "0 4 * * 1" # every Monday at 04:00 UTC + workflow_dispatch: + inputs: + logLevel: + description: "Renovate log level" + required: false + default: "info" + +permissions: + contents: read + +concurrency: + group: renovate + cancel-in-progress: false + +jobs: + renovate: + runs-on: ubuntu-latest + steps: + - name: Run Renovate + uses: renovatebot/github-action@v46.1.14 + with: + token: ${{ secrets.RENOVATE_TOKEN }} + env: + RENOVATE_REPOSITORIES: ${{ github.repository }} + RENOVATE_ONBOARDING: "false" + RENOVATE_REQUIRE_CONFIG: "required" + LOG_LEVEL: ${{ github.event.inputs.logLevel || 'info' }} diff --git a/examples/appsec-enabled/docker-compose.yml b/examples/appsec-enabled/docker-compose.yml index 5834f2b..6724854 100644 --- a/examples/appsec-enabled/docker-compose.yml +++ b/examples/appsec-enabled/docker-compose.yml @@ -47,7 +47,7 @@ services: - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422" crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/behind-proxy/docker-compose.yml b/examples/behind-proxy/docker-compose.yml index 36faf4c..2f69c27 100644 --- a/examples/behind-proxy/docker-compose.yml +++ b/examples/behind-proxy/docker-compose.yml @@ -79,7 +79,7 @@ services: crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/captcha/README.md b/examples/captcha/README.md index 95c825b..59788db 100644 --- a/examples/captcha/README.md +++ b/examples/captcha/README.md @@ -52,7 +52,7 @@ More information is available on configuring Crowdsec in the [official documenta ```yaml ... crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 volumes: # For captcha and ban mixed decision - './profiles.yaml:/etc/crowdsec/profiles.yaml:ro' diff --git a/examples/captcha/docker-compose.yml b/examples/captcha/docker-compose.yml index d3387e3..0cda948 100644 --- a/examples/captcha/docker-compose.yml +++ b/examples/captcha/docker-compose.yml @@ -55,7 +55,7 @@ services: - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaHTMLFilePath=/captcha.html" crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/custom-ban-page/docker-compose.yml b/examples/custom-ban-page/docker-compose.yml index 78cec29..3948fdf 100644 --- a/examples/custom-ban-page/docker-compose.yml +++ b/examples/custom-ban-page/docker-compose.yml @@ -46,7 +46,7 @@ services: - "traefik.http.middlewares.crowdsec.plugin.bouncer.banFilePath=/ban.html" crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/custom-captcha/docker-compose.yml b/examples/custom-captcha/docker-compose.yml index be3a125..526dd98 100644 --- a/examples/custom-captcha/docker-compose.yml +++ b/examples/custom-captcha/docker-compose.yml @@ -59,7 +59,7 @@ services: - "traefik.http.middlewares.crowdsec.plugin.bouncer.captchaHTMLFilePath=/captcha.html" crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/redis-cache/docker-compose.yml b/examples/redis-cache/docker-compose.yml index 1e3a52c..a2d8965 100644 --- a/examples/redis-cache/docker-compose.yml +++ b/examples/redis-cache/docker-compose.yml @@ -71,7 +71,7 @@ services: crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/tls-auth/docker-compose.yml b/examples/tls-auth/docker-compose.yml index d1d6c48..07387d7 100644 --- a/examples/tls-auth/docker-compose.yml +++ b/examples/tls-auth/docker-compose.yml @@ -71,7 +71,7 @@ services: # Define AppSec host and port informations - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422" crowdsec: - image: crowdsecurity/crowdsec:latest + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/examples/trusted-ips/docker-compose.yml b/examples/trusted-ips/docker-compose.yml index 987bc53..71ef97e 100644 --- a/examples/trusted-ips/docker-compose.yml +++ b/examples/trusted-ips/docker-compose.yml @@ -65,7 +65,7 @@ services: crowdsec: - image: crowdsecurity/crowdsec:v1.6.1-2 + image: crowdsecurity/crowdsec:v1.6.8 container_name: "crowdsec" restart: unless-stopped environment: diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..e1ab9c8 --- /dev/null +++ b/renovate.json @@ -0,0 +1,75 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": ["config:recommended"], + "labels": ["dependencies"], + "ignorePaths": ["**/vendor/**", "**/node_modules/**"], + "rangeStrategy": "bump", + "prConcurrentLimit": 1, + "branchPrefix": "renovate/", + "commitMessagePrefix": "⬆️ renovate: ", + "groupName": "all", + "dependencyDashboard": false, + "packageRules": [ + { + "description": "Cap the Go version at what yaegi supports. The plugin is interpreted by yaegi (bundled in Traefik), and even Traefik v3.7.1 ships yaegi v0.16.1 = Go 1.22. A newer Go would break the plugin on every current Traefik. Raise this only once Traefik ships a yaegi supporting a newer Go.", + "matchManagers": ["gomod"], + "matchDepNames": ["go", "toolchain"], + "allowedVersions": "<1.23" + }, + { + "description": "whoami is a throwaway demo backend; leave it on latest", + "matchPackageNames": ["traefik/whoami"], + "enabled": false + } + ], + "customManagers": [ + { + "description": "Plugin self-pin in docker-compose CLI args (--experimental.plugins.bouncer.version=vX)", + "customType": "regex", + "managerFilePatterns": ["/(^|/)docker-compose[^/]*\\.ya?ml$/"], + "matchStrings": [ + "experimental\\.plugins\\.bouncer\\.version=(?v[0-9]+\\.[0-9]+\\.[0-9]+)" + ], + "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin", + "datasourceTemplate": "github-tags" + }, + { + "description": "Plugin self-pin in the Traefik Helm values (version: \"vX\")", + "customType": "regex", + "managerFilePatterns": ["/^examples/kubernetes/traefik/values\\.ya?ml$/"], + "matchStrings": [ + "version:\\s*\"(?v[0-9]+\\.[0-9]+\\.[0-9]+)\"" + ], + "depNameTemplate": "maxlerebourg/crowdsec-bouncer-traefik-plugin", + "datasourceTemplate": "github-tags" + }, + { + "description": "Traefik image tag in the Traefik Helm values (no repository key, so match by file)", + "customType": "regex", + "managerFilePatterns": ["/^examples/kubernetes/traefik/values\\.ya?ml$/"], + "matchStrings": ["tag:\\s*(?v[0-9]+\\.[0-9]+\\.[0-9]+)"], + "depNameTemplate": "traefik", + "datasourceTemplate": "docker" + }, + { + "description": "Crowdsec image tag in the Crowdsec Helm values (no repository key, so match by file)", + "customType": "regex", + "managerFilePatterns": [ + "/^examples/kubernetes/crowdsec/values\\.ya?ml$/" + ], + "matchStrings": ["tag:\\s*(?v[0-9]+\\.[0-9]+\\.[0-9]+)"], + "depNameTemplate": "crowdsecurity/crowdsec", + "datasourceTemplate": "docker" + }, + { + "description": "Pinned Traefik binary in the e2e mock suite (TRAEFIK_VERSION:-vX in common.sh)", + "customType": "regex", + "managerFilePatterns": ["/^tests/e2e/mock/lib/common\\.sh$/"], + "matchStrings": [ + "TRAEFIK_VERSION:-(?v[0-9]+\\.[0-9]+\\.[0-9]+)" + ], + "depNameTemplate": "traefik/traefik", + "datasourceTemplate": "github-releases" + } + ] +}