fix: Dockerfile to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-8235200
- https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-8235200

.github/workflows/build.yml

@@ -4,79 +4,89 @@ on:
   push:
     branches:
       - master
-    tags:
-      - 'v*'
+  pull_request:
+    branches:
+      - master
+  merge_group:
   workflow_dispatch:
 
+# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-only-cancel-in-progress-jobs-or-runs-for-the-current-workflow
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  HUB_IMAGE: jakejarvis/hugo-extended
+  GHCR_IMAGE: ghcr.io/jakejarvis/hugo-extended
+
 jobs:
   docker:
     runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Prepare tags
-        id: tag
-        env:
-          HUB_IMAGE: jakejarvis/hugo-extended
-          GHCR_IMAGE: ghcr.io/jakejarvis/hugo-extended
-        run: |
-          TAGS="${HUB_IMAGE}:latest,${GHCR_IMAGE}:latest"
-
-          # If triggered by a new tag, add a version tag to the image
-          if [[ $GITHUB_REF == refs/tags/* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/v}
-            TAGS="$TAGS,${HUB_IMAGE}:${VERSION},${GHCR_IMAGE}:${VERSION}"
-          fi
-
-          # Set output parameters
-          echo ::set-output name=tags::${TAGS}
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        with:
+          fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@master
-        with:
-          platforms: all
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@master
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to DockerHub
+        if: ${{ github.ref == 'refs/heads/master' }}
+        uses: docker/login-action@v3
+        with:
+          username: jakejarvis
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        if: ${{ github.ref == 'refs/heads/master' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_PAT }}
 
       - name: Cache Docker layers
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
           restore-keys: |
             ${{ runner.os }}-buildx-
 
-      - name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
-        with:
-          username: jakejarvis
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-
-      - name: Login to GitHub Container Registry
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GHCR_PAT }}
+      - name: Parse Hugo version
+        id: parse_version
+        run: |
+          HUGO_VERSION="$(grep -oP '(?<=^ARG HUGO_VERSION=).+$' Dockerfile)"
+          echo "HUGO_VERSION=$HUGO_VERSION" >> $GITHUB_OUTPUT
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v5
         with:
           builder: ${{ steps.buildx.outputs.name }}
-          context: ./
+          context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.tag.outputs.tags }}
+          push: ${{ github.ref == 'refs/heads/master' }}
+          tags: "${{ env.HUB_IMAGE }}:latest,${{ env.GHCR_IMAGE }}:latest,${{ env.HUB_IMAGE }}:${{ steps.parse_version.outputs.HUGO_VERSION }},${{ env.GHCR_IMAGE }}:${{ steps.parse_version.outputs.HUGO_VERSION }}"
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
 
       - name: Image digest
         run: echo ${{ steps.build.outputs.digest }}
+
+      - name: Update hub description
+        uses: peter-evans/dockerhub-description@v4
+        if: ${{ github.ref == 'refs/heads/master' }}
+        with:
+          username: jakejarvis
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+          repository: ${{ env.HUB_IMAGE }}
+          short-description: "✏️ Hugo Extended for x64 and ARM64 with PostCSS, Babel, Pandoc, and more baked in."
+          readme-filepath: ./README.md
+          enable-url-completion: true

Dockerfile

@@ -1,14 +1,14 @@
 # the following version can be overridden at image build time with --build-arg
-ARG HUGO_VERSION=0.85.0
+# renovate: datasource=github-releases depName=gohugoio/hugo
+ARG HUGO_VERSION=0.124.1
+
 # remove/comment the following line completely to compile vanilla Hugo:
 ARG HUGO_BUILD_TAGS=extended
 
-# Hugo >= v0.81.0 requires Go 1.16+ to build
-ARG GO_VERSION=1.16
-
 # ---
 
-FROM golang:${GO_VERSION}-alpine3.13 AS build
+# Hugo >= v0.81.0 requires Go 1.16+ to build
+FROM golang:1.22-alpine3.18 AS build
 
 # renew global args from above
 # https://docs.docker.com/engine/reference/builder/#scope
@@ -27,8 +27,7 @@ RUN apk add --update --no-cache \
       gcc \
       g++ \
       musl-dev \
-      git && \
-    go get github.com/magefile/mage
+      git
 
 # clone source from Git repo:
 RUN git clone \
@@ -37,23 +36,27 @@ RUN git clone \
       --depth 1 \
       https://github.com/gohugoio/hugo.git ./
 
-RUN mage -v hugo && mage install
+# https://github.com/gohugoio/hugo/commit/241481931f5f5f2803cd4be519936b26d8648dfd
+RUN go build -v -ldflags "-X github.com/gohugoio/hugo/common/hugo.vendorInfo=docker" -tags "$HUGO_BUILD_TAGS" && \
+    mv ./hugo /go/bin/hugo
 
 # fix potential stack size problems on Alpine
 # https://github.com/microsoft/vscode-dev-containers/blob/fb63f7e016877e13535d4116b458d8f28012e87f/containers/hugo/.devcontainer/Dockerfile#L19
-RUN go get github.com/yaegashi/muslstack && \
+RUN go install github.com/yaegashi/muslstack@latest && \
     muslstack -s 0x800000 /go/bin/hugo
 
 # ---
 
-FROM alpine:3.13
+FROM alpine:3.21.0
 
 # renew global args from above & pin any dependency versions
 ARG HUGO_VERSION
 # https://github.com/jgm/pandoc/releases
-ARG PANDOC_VERSION=2.14
+# renovate: datasource=github-releases depName=jgm/pandoc
+ARG PANDOC_VERSION=3.1.13
 # https://github.com/sass/dart-sass-embedded/releases
-ARG DART_SASS_VERSION=1.0.0-beta.7
+# renovate: datasource=github-releases depName=sass/dart-sass-embedded
+ARG DART_SASS_VERSION=1.62.1
 
 LABEL version="${HUGO_VERSION}"
 LABEL repository="https://github.com/jakejarvis/hugo-docker"
@@ -120,6 +123,8 @@ RUN set -euo pipefail && \
     fi && \
     # clean up some junk
     rm -rf /tmp/* /var/tmp/* /var/cache/apk/* && \
+    # tell git to trust /src
+    git config --global --add safe.directory /src && \
     # make super duper sure that everything went OK, exit otherwise
     hugo env && \
     go version && \

renovate.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "automerge": true,
+  "platformAutomerge": true,
+  "regexManagers": [
+    {
+      "fileMatch": [
+        "^Dockerfile$"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?( registryUrl=(?<registryUrl>.*?))?\\s.*?_VERSION=(?<currentValue>.*)\\s"
+      ],
+      "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFiles": [
+        "^Dockerfile$"
+      ],
+      "extractVersion": "^v(?<version>.*)$"
+    }
+  ]
+}