.drone.yml

@@ -39,7 +39,6 @@ steps:
     when:
       event:
         - tag
-        - cron
 
 ---
 kind: pipeline
@@ -82,7 +81,6 @@ steps:
     when:
       event:
         - tag
-        - cron
 
 ---
 kind: pipeline
@@ -106,7 +104,6 @@ steps:
 trigger:
   event:
     - tag
-    - cron
 
 depends_on:
   - linux-amd64

.gitea/workflows/vulnscan.yaml

@@ -1,4 +1,3 @@
----
 name: Vulnerability Scan
 
 on:
@@ -15,24 +14,15 @@ jobs:
 
     steps:
       - name: Pull docker image
-        run: docker pull docker.asperti.com/paspo/hugo:latest
+        run: docker pull docker.asperti.com/${{ github.repository_owner }}/hugo:latest
-
-      - name: Setup trivy
-        run: |
-          echo "Installing Trivy for arch: $(uname -m)"
-          case $(uname -m) in
-            x86_64)
-              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-64bit.deb ;;
-            aarch64)
-              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-ARM64.deb ;;
-            *) exit 1 ;;
-          esac
-          dpkg -i /tmp/trivy.deb
 
       - name: Run Trivy vulnerability scanner
         id: scan
-        run: |
+        uses: aquasecurity/trivy-action@master
-          trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json docker.asperti.com/paspo/hugo:latest > trivy-results.json
+        with:
+          image-ref: "docker.asperti.com/${{ github.repository_owner }}/hugo:latest"
+          format: "json"
+          output: "trivy-results.json"
 
       # if some vulnerability is found, we fail
       - name: check output

Dockerfile

@@ -1,26 +1,24 @@
-##### this stage will download latest tarball
+##### this stage will download latest deb package
 
 FROM alpine:latest as prep
 
 ARG HUGO_ARCH=amd64
 
 RUN \
-    apk --no-cache upgrade && \
+    apk -U add lastversion && \
-    apk --no-cache add curl jq && \
+    wget $(lastversion --filter "hugo_extended_.*\-${HUGO_ARCH}\.deb$" --pre gohugoio/hugo  --format assets ) -O /tmp/hugo.deb
-    LATEST_RELEASE=$(curl -L -s -H 'Accept: application/json' https://github.com/gohugoio/hugo/releases/latest | jq --raw-output ".tag_name" | sed 's/^v//' ) && \
+
-    LATEST_RELEASE=0.139.4 && \
-    URL="https://github.com/gohugoio/hugo/releases/download/v${LATEST_RELEASE}/hugo_extended_${LATEST_RELEASE}_linux-${HUGO_ARCH}.tar.gz " && \
-    echo "Downloading: ${URL}" && \
-    wget "${URL}" -O - | tar xzv -C /tmp
 
 ##### final image
 
-FROM alpine:latest
+FROM debian:12-slim
 
-COPY --from=prep /tmp/hugo /usr/local/bin/hugo
+COPY --from=prep /tmp/hugo.deb /tmp/hugo.deb
 
 RUN \
-    apk --no-cache upgrade && \
+    apt update && \
-    apk --no-cache add git gcompat libstdc++
+    DEBIAN_FRONTEND=noninteractive apt -y upgrade && \
+    apt install -y /tmp/hugo.deb && \
+    rm -rf /var/lib/apt/lists/ /tmp/hugo.deb
 
 ENTRYPOINT [ "/usr/local/bin/hugo" ]

README.md

@@ -48,3 +48,7 @@ steps:
     commands:
       - "hugo -s /drone/src --gc --minify"
 ```
+
+## TODO
+
+- Auto build and update based on hugo version