chore: upgrade to latest workflows

Author: 11notes

.github/workflows/docker.yml

@@ -1,6 +1,9 @@
 name: docker
 run-name: ${{ inputs.run-name }}
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   workflow_dispatch:
     inputs:
@@ -52,13 +55,13 @@ jobs:
     steps:
       # CHECKOUT REPOSITORY
       - name: init / checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
         with:
           ref: ${{ github.ref_name }}
 
       - name: matrix / setup list
         id: setup-matrix
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { existsSync, readFileSync } = require('node:fs');
@@ -152,15 +155,15 @@ jobs:
       # ╚═════════════════════════════════════════════════════╝
       # CHECKOUT ALL DEPTHS (ALL TAGS)
       - name: init / checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
         with:
           ref: ${{ github.ref_name }}
           fetch-depth: 0
 
       # SETUP ENVIRONMENT VARIABLES AND INPUTS
       - name: init / setup environment
         id: setup-environment
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { existsSync, readFileSync } = require('node:fs');
@@ -228,6 +231,20 @@ jobs:
               merge_tags:[],
             };
 
+            try{
+              const response = await fetch('https://raw.githubusercontent.com/11notes/static/refs/heads/master/src/semver/latest.json');
+              if(!response.ok){
+                throw new Error(`error fetching OpenSSL version: ${response.status}`);
+              }
+              const result = await response.json();
+              for(const dep in result){
+                docker.app[`${dep}_version`] = `${result[dep]}`;
+                core.info(`setting APP_${String(dep).toUpperCase()}_VERSION to ${result[dep]}`);
+              }
+            }catch(e){
+              core.warning(e);
+            }
+
             docker.cache.name = `${docker.image.name}:${docker.image.prefix}buildcache${docker.image.suffix}`;
             docker.cache.grype = `${docker.cache.registry}${docker.image.name}:${docker.image.prefix}grype${docker.image.suffix}`;
             docker.app.prefix = docker.image.prefix;
@@ -600,7 +617,7 @@ jobs:
       # ╚═════════════════════════════════════════════════════╝
       # CHECKOUT ALL DEPTHS (ALL TAGS)
       - name: init / checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
         with:
           ref: master
           fetch-depth: 0

.github/workflows/org.build.yml

@@ -1,36 +1,56 @@
 name: org.build
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   workflow_dispatch:
     inputs:
       ref:
         description: 'reference'
         required: true
+
       etc:
         description: 'base64 encoded json string'
         required: false
         default: 'null'
 
+      release:
+        description: 'create a release'
+        required: false
+        default: 'true'
+
+      readme:
+        description: 'create a readme'
+        required: false
+        default: 'true'
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       # check if additional builds need to happen
       - name: etc to environment variable
         if: github.event.inputs.etc != 'null'
-        uses: actions/github-script@62c3794a3eb6788d9a2a72b219504732c0c9a298
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { Buffer } = require('node:buffer');
 
             (async()=>{
               try{
                 const etc = JSON.parse(Buffer.from('${{ github.event.inputs.etc }}', 'base64').toString('ascii'));
-                for(const k in etc){
-                  core.exportVariable(`WORKFLOW_ETC_${String(k).toUpperCase()}`, `${etc[k]}`);
+                core.exportVariable('WORKFLOW_BUILD_BASE64JSON', Buffer.from(JSON.stringify({build:etc?.build})).toString('base64'));
+                if(etc?.unraid){
+                  core.exportVariable(`WORKFLOW_BUILD_UNRAID`, `${etc.unraid}`);
+                  core.exportVariable('WORKFLOW_BUILD_UNRAID_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"unraid", uid:99, gid:100, build:etc?.build})).toString('base64'));
+                }
+                if(etc?.nobody){
+                  core.exportVariable(`WORKFLOW_BUILD_NOBODY`, `${etc.nobody}`);
+                  core.exportVariable('WORKFLOW_BUILD_NOBODY_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"nobody", uid:65534, gid:65534, build:etc?.build})).toString('base64'));
                 }
               }catch(e){
-                core.setFailed(`could not parse etc: ${e}`);
+                core.setFailed(`could not parse: ${e}`);
               }
             })();
 
@@ -41,24 +61,24 @@ jobs:
           workflow: docker.yml
           wait-for-completion: false
           token: "${{ secrets.REPOSITORY_TOKEN }}"
-          inputs: '{ "release":"true", "readme":"true", "run-name":"build ${{ github.event.inputs.ref }}" }'
+          inputs: '{ "release":"${{ github.event.inputs.release }}", "readme":"${{ github.event.inputs.readme }}", "run-name":"build ${{ github.event.inputs.ref }}", "etc":"${{ env.WORKFLOW_BUILD_BASE64JSON }}" }'
 
       # UNRAID
       - name: build container image for unraid
-        if: env.WORKFLOW_ETC_UNRAID == 'true'
+        if: env.WORKFLOW_BUILD_UNRAID == 'true'
         uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7
         with:
           workflow: docker.yml
           wait-for-completion: false
           token: "${{ secrets.REPOSITORY_TOKEN }}"
-          inputs: '{ "release":"false", "readme":"false", "run-name":"build unraid ${{ github.event.inputs.ref }}", "etc":"eyJzZW12ZXJzdWZmaXgiOiJ1bnJhaWQiLCJ1aWQiOjk5LCJnaWQiOjEwMH0=" }'
+          inputs: '{ "release":"false", "readme":"false", "run-name":"build unraid ${{ github.event.inputs.ref }}", "etc":"${{ env.WORKFLOW_BUILD_UNRAID_BASE64JSON }}" }'
 
       # NOBODY
       - name: build container image for nobody
-        if: env.WORKFLOW_ETC_NOBODY == 'true'
+        if: env.WORKFLOW_BUILD_NOBODY == 'true'
         uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7
         with:
           workflow: docker.yml
           wait-for-completion: false
           token: "${{ secrets.REPOSITORY_TOKEN }}"
-          inputs: '{ "release":"false", "readme":"false", "run-name":"build nobody ${{ github.event.inputs.ref }}", "etc":"eyJzZW12ZXJzdWZmaXgiOiJub2JvZHkiLCJ1aWQiOjY1NTM0LCJnaWQiOjY1NTM0fQ==" }'
+          inputs: '{ "release":"false", "readme":"false", "run-name":"build nobody ${{ github.event.inputs.ref }}", "etc":"${{ env.WORKFLOW_BUILD_NOBODY_BASE64JSON }}" }'

.github/workflows/org.readme.yml

@@ -1,5 +1,8 @@
 name: org.readme
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   workflow_dispatch:
 

.github/workflows/org.update.yml

@@ -1,12 +1,25 @@
 name: org.update
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   workflow_dispatch:
     inputs:
       etc:
         description: 'base64 encoded json string'
         required: true
 
+      release:
+        description: 'create a release'
+        required: false
+        default: 'true'
+
+      readme:
+        description: 'create a readme'
+        required: false
+        default: 'true'
+
 jobs:
   update:
     runs-on: ubuntu-latest
@@ -17,27 +30,34 @@ jobs:
 
     steps:
       - name: init / checkout
-        uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
         with:
           ref: 'master'
           fetch-depth: 0
 
       - name: update / setup node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: '20'
+          node-version: '24'
       - run: npm i semver
 
       - name: update / compare latest with current version
-        uses: actions/github-script@62c3794a3eb6788d9a2a72b219504732c0c9a298
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             (async()=>{
               const { Buffer } = require('node:buffer');
               const { inspect } = require('node:util');
               const { existsSync, readFileSync, writeFileSync } = require('node:fs');
               const { resolve } = require('node:path');
-              const semver = require('semver')
+              const semver = require('semver');
+
+              const semverExceptions = (s) => {
+                switch('${{ github.event.repository.name }}'){
+                  case 'docker-chrony': core.warning(`semver exception found for chrony version ${s}, setting version to major.minor`); return(s.split('.').slice(0, 2).join('.'));
+                }
+                return(s);
+              }
 
               // defaults
               const json = `${{ toJSON(github.event.inputs) }}`;
@@ -54,6 +74,8 @@ jobs:
                         core.setFailed(`input does not contain valid semver version: ${inspect(job.inputs, {showHidden:false, depth:null, colors:true})}`);
                       }else if(!job.inputs?.tag){
                         core.setFailed(`input does not contain valid git tag: ${inspect(job.inputs, {showHidden:false, depth:null, colors:true})}`);
+                      }else if(job.inputs.version == 'null' || null === job.inputs.version){
+                        core.setFailed(`input version is null: ${inspect(job.inputs, {showHidden:false, depth:null, colors:true})}`);
                       }
                     }catch(e){
                       core.setFailed(`could not parse github.event.inputs.etc: ${n.etc} (${Buffer.from(n.etc, 'base64').toString('ascii')})`);
@@ -81,28 +103,35 @@ jobs:
               }
 
               // semver
-              const latest = semver.valid(semver.coerce(job.inputs.version));
-              const current = semver.valid(semver.coerce(job.json.semver.version));
+              const latest = semverExceptions(semver.valid(semver.coerce(job.inputs.version)));
+              const current = semverExceptions(semver.valid(semver.coerce(job.json.semver.version)));
               const tag = semver.valid(semver.coerce(job.inputs.tag));
-              const checks = {latestTagExists:true};
+              const checks = {latestTagExists:false};
 
               try{
                 const tag = await fetch(`https://hub.docker.com/v2/repositories/${job.json.image}/tags/${latest}`);
-                if(tag.status === 404){
-                  checks.latestTagExists = false;
+                if(tag.status === 200){
+                  checks.latestTagExists = true;
                 }
               }catch(e){
                 core.warning(e);
               }
 
               // compare
-              if((latest && latest !== current) || !checks.latestTagExists){
+              if(latest && latest !== current && !checks.latestTagExists){
                 core.info(`new ${semver.diff(current, latest)} release found (${latest}), updating ...`)
                 job.json.semver.version = latest;
 
-                // check if app has a build version
-                if(job.inputs?.build){
+                // check if app has additional parameters
+                const build = {};
+                if(job.inputs?.build && typeof(job.inputs.build) === 'string'){
+                  build.args = {
+                    version_build:job.inputs.build,
+                  };
                   job.json.build.args.version_build = job.inputs.build;
+                }else if(job.inputs?.build?.args){
+                  build.args = job.inputs.build.args;
+                  job.json.build.args.version_build = job.inputs.build.args;
                 }
 
                 // update .json
@@ -111,13 +140,14 @@ jobs:
 
                   // export variables
                   core.exportVariable('WORKFLOW_UPDATE', true);
+                  core.exportVariable('WORKFLOW_UPDATE_BASE64JSON', Buffer.from(JSON.stringify({build:build})).toString('base64'));
                   if(job.inputs?.unraid){
                     core.exportVariable('WORKFLOW_UPDATE_UNRAID', 'true');
-                    core.exportVariable('WORKFLOW_UPDATE_UNRAID_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"unraid", uid:99, gid:100})).toString('base64'));
+                    core.exportVariable('WORKFLOW_UPDATE_UNRAID_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"unraid", uid:99, gid:100, build:build})).toString('base64'));
                   }
                   if(job.inputs?.nobody){
                     core.exportVariable('WORKFLOW_UPDATE_NOBODY', 'true');
-                    core.exportVariable('WORKFLOW_UPDATE_NOBODY_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"nobody", uid:65534, gid:65534})).toString('base64'));
+                    core.exportVariable('WORKFLOW_UPDATE_NOBODY_BASE64JSON', Buffer.from(JSON.stringify({semversuffix:"nobody", uid:65534, gid:65534, build:build})).toString('base64'));
                   }
                   core.exportVariable('LATEST_TAG', semver.inc(tag, semver.diff(current, latest)));
                   core.exportVariable('LATEST_VERSION', latest);
@@ -155,13 +185,13 @@ jobs:
         uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7
         with:
           workflow: docker.yml
-          wait-for-completion: false
+          wait-for-completion: true
           token: "${{ secrets.REPOSITORY_TOKEN }}"
-          inputs: '{ "release":"true", "readme":"true", "run-name":"update v${{ env.LATEST_VERSION }}" }'
+          inputs: '{ "release":"${{ github.event.inputs.release }}", "readme":"${{ github.event.inputs.readme }}", "run-name":"update v${{ env.LATEST_VERSION }}", "etc":"${{ env.WORKFLOW_UPDATE_BASE64JSON }}" }'
           ref: "v${{ env.LATEST_TAG }}"
 
       - name: update / build container image for unraid
-        if: env.WORKFLOW_UPDATE_UNRAID == 'true' && steps.checkout.outcome == 'success' && steps.build.outcome == 'success'
+        if: env.WORKFLOW_UPDATE_UNRAID == 'true' && steps.build.outputs.workflow-conclusion == 'success'
         uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7
         with:
           workflow: docker.yml
@@ -171,7 +201,7 @@ jobs:
           ref: "v${{ env.LATEST_TAG }}"
 
       - name: update / build container image for nobody
-        if: env.WORKFLOW_UPDATE_NOBODY == 'true' && steps.checkout.outcome == 'success' && steps.build.outcome == 'success'
+        if: env.WORKFLOW_UPDATE_NOBODY == 'true' && steps.build.outputs.workflow-conclusion == 'success'
         uses: the-actions-org/workflow-dispatch@3133c5d135c7dbe4be4f9793872b6ef331b53bc7
         with:
           workflow: docker.yml

.github/workflows/org.version.yml

@@ -1,6 +1,9 @@
 name: org.version
 run-name: org.version ${{ inputs.version }}
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 on:
   workflow_dispatch:
     inputs:
@@ -17,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: setup config
-        uses: actions/github-script@62c3794a3eb6788d9a2a72b219504732c0c9a298
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { Buffer } = require('node:buffer');