build: update build config

.gitattributes

@@ -60,6 +60,8 @@
 *.php        text
 *.python     text
 *.sql        text
+**/Dockerfile text eol=lf
+**/*.Dockerfile text eol=lf
 
 
 # Archives

.github/dependabot.yml

@@ -1,16 +1,17 @@
 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: "09:00"
-    commit-message:
-      prefix: fix
-      prefix-development: chore
-      include: scope
-    labels:
-      - gha
-      - dependencies
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: "14:00"
+  commit-message:
+    prefix: ci
+    prefix-development: ci
+    include: scope
+  labels:
+  - dependencies
+  - gha
+  - pinned

.github/stale.yml

@@ -1,24 +0,0 @@
-# Configuration for probot-stale - https://github.com/probot/stale
-
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 60
-
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - pinned
-  - security
-
-# Label to use when marking an issue as stale
-staleLabel: wontfix
-
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed in 7 days if no further activity occurs.
-  Thank you for your contributions.
-
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false

.github/workflows/build.yml

@@ -8,17 +8,26 @@ name: Build
 
 on:
   push:
-    branches:    # build all branches
-    - '**'
-    tags-ignore: # but don't build tags
+    branches-ignore:  # build all branches except:
+    - 'dependabot/**'  # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
+    tags-ignore:  # don't build tags
     - '**'
     paths-ignore:
     - '**/*.md'
+    - '.editorconfig'
+    - '.git*'
     - '.github/*.yml'
-  schedule:
-    # https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
-    - cron: '0 0 * * *'
+    - '.github/workflows/stale.yml'
   pull_request:
+    paths-ignore:
+    - '**/*.md'
+    - '.editorconfig'
+    - '.git*'
+    - '.github/*.yml'
+    - '.github/workflows/stale.yml'
+  schedule:
+    # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
+    - cron: '0 17 * * 3'
   workflow_dispatch:
     # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
 
@@ -31,21 +40,35 @@ env:
   TRIVY_CACHE_DIR: ~/.trivy/cache
 
 jobs:
+
+  ###########################################################
   build:
-    runs-on: ubuntu-latest
+  ###########################################################
+
+    runs-on: ubuntu-latest  # https://github.com/actions/runner-images#available-images
+    timeout-minutes: 10
 
     steps:
-    - name: Show environment variables
+    - name: "Show: GitHub context"
+      env:
+        GITHUB_CONTEXT: ${{ toJSON(github) }}
+      run: echo $GITHUB_CONTEXT
+
+
+    - name: "Show: environment variables"
       run: env | sort
 
+
     - name: Git Checkout
-      uses: actions/checkout@v4 #https://github.com/actions/checkout
+      uses: actions/checkout@v4  # https://github.com/actions/checkout
+
 
     - name: Check Dockerfile
       uses: hadolint/hadolint-action@v3.1.0
       with:
         dockerfile: image/Dockerfile
 
+
     - name: Cache trivy cache
       uses: actions/cache@v4
       with:
@@ -55,37 +78,54 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-trivy-
 
+
     - name: Configure fast APT repository mirror
       uses: vegardit/fast-apt-mirror.sh@v1
 
+
     - name: Install dos2unix
       run: sudo apt-get install --no-install-recommends -y dos2unix
 
+
+    - name: "Determine if docker images shall be published"
+      run: |
+        # ACT -> https://nektosact.com/usage/index.html#skipping-steps
+        set -x
+        if [[ $GITHUB_REF_NAME == 'main' && $GITHUB_EVENT_NAME != 'pull_request' && -z "$ACT" ]]; then
+          echo "DOCKER_PUSH_GHCR=true" >> "$GITHUB_ENV"
+          if [[ -n "${{ secrets.DOCKER_HUB_USERNAME }}" ]]; then
+            echo "DOCKER_PUSH=true" >> "$GITHUB_ENV"
+          fi
+        fi
+
+
     - name: Login to docker.io
-      if: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
+      if: ${{ env.DOCKER_PUSH }}
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_HUB_USERNAME }}
         password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
+
     - name: Login to ghcr.io
-      if: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
+      if: ${{ env.DOCKER_PUSH_GHCR }}
       uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ github.token }}
 
+
     - name: Build docker image
       env:
-        DOCKER_PUSH: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }}
         TRIVY_GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        bash build-image.sh
+      run: bash build-image.sh
+
 
     - name: Delete untagged images
       uses: actions/github-script@v7
-      if: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
+      if: ${{ env.DOCKER_PUSH_GHCR }}
+      continue-on-error: true
       with:
         github-token: ${{ secrets.GHA_DELETE_PACKAGES }}
         script: |

.github/workflows/stale.yml

@@ -0,0 +1,56 @@
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
+name: Stale issues
+
+on:
+  schedule:
+    - cron: '0 16 * * 1'
+  workflow_dispatch:
+    # https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Git checkout
+      uses: actions/checkout@v4  # https://github.com/actions/checkout
+
+    - name: Run stale action
+      uses: actions/stale@v9  # https://github.com/actions/stale
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        days-before-stale: 90
+        days-before-close: 14
+        stale-issue-message: >
+          This issue has been automatically marked as stale because it has not had
+          recent activity. It will be closed in 14 days if no further activity occurs.
+          If the issue is still valid, please add a respective comment to prevent this 
+          issue from being closed automatically. Thank you for your contributions.
+        stale-issue-label: stale
+        close-issue-label: wontfix
+        exempt-issue-labels: |
+          enhancement
+          pinned
+          security
+
+    - name: Run stale action (for enhancements)
+      uses: actions/stale@v9  # https://github.com/actions/stale
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        days-before-stale: 360
+        days-before-close: 14
+        stale-issue-message: >
+          This issue has been automatically marked as stale because it has not had
+          recent activity. It will be closed in 14 days if no further activity occurs.
+          If the issue is still valid, please add a respective comment to prevent this 
+          issue from being closed automatically. Thank you for your contributions.
+        stale-issue-label: stale
+        close-issue-label: wontfix
+        only-labels: enhancement
+        exempt-issue-labels: |
+          pinned
+          security

.gitignore

@@ -14,16 +14,16 @@ bin/
 **/.*.md.html
 
 # IntelliJ
-.idea
-*.iml
-*.ipr
-*.iws
+/.idea
+/*.iml
+/*.ipr
+/*.iws
 
 # NetBeans
 nb-configuration.xml
 
 # Visual Studio Code
-.vscode
+/.vscode
 
 # OSX
 .DS_Store

README.md

@@ -24,7 +24,7 @@ ## <a name="what-is-it"></a>What is it?
 
 Opinionated docker image is currently based on the [Debian](https://www.debian.org/) docker image [`debian:bookworm-slim`](https://hub.docker.com/_/debian?tab=tags&name=bookworm-slim) to run an [OpenLDAP 2.5](https://www.openldap.org/doc/admin25/) server.
 
-It is automatically built **daily** to include the latest OS security fixes.
+It is automatically built **weekly** to include the latest OS security fixes.
 
 To keep the image light and simple, it does not configure TLS. Instead we recommend configuring a [Traefik 2.x](https://traefik.io) [TCP service](https://docs.traefik.io/routing/services/#configuring-tcp-services) with e.g. an auto-renewing [Let's Encrypt configuration](https://docs.traefik.io/https/acme/) in front of the OpenLDAP service.