DarkHelm.org/plex-playlist
Public Access
4
1
Fork 0
Code Issues 55 Pull Requests 3 Actions 9 Packages Projects 1 Releases Wiki Activity

feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration #74

Merged
darkhelm merged 5 commits from feat/security-audit-precommit-cicd into main 2026-07-13 22:20:10 -04:00
Conversation 0 Commits 5 Files Changed 15 +27 -12
1 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 9f9d2dbf45 - Show all commits

39
.gitea/workflows/renovate.yml
View File

@@ -350,8 +350,11 @@ jobs:
run_renovate_with_endpoint() {
endpoint="$1"
enabled_managers="$2"
batch_label="$3"
export RENOVATE_ENDPOINT="${endpoint}"
echo "Running Renovate with endpoint: ${RENOVATE_ENDPOINT}"
echo "Running Renovate batch '${batch_label}' with endpoint: ${RENOVATE_ENDPOINT}"
echo "Enabled managers for '${batch_label}': ${enabled_managers}"
# shellcheck disable=SC2086
docker run --rm ${DOCKER_ADD_HOST_ARG} \
@@ -388,20 +391,32 @@ jobs:
git config --global --add "url.${RENOVATE_GIT_REWRITE_TO}.insteadOf" "https://x-access-token:${RENOVATE_TOKEN}@dogar.darkhelm.org/"
git config --global --add "url.${RENOVATE_GIT_REWRITE_TO}.insteadOf" "${RENOVATE_GIT_REWRITE_FROM}"
echo "Configured git dogar->kankali rewrite rules"
renovate --platform "${RENOVATE_PLATFORM}" --endpoint "${RENOVATE_ENDPOINT}" --git-url "${RENOVATE_GIT_URL}" --git-author "${RENOVATE_GIT_AUTHOR}" --onboarding="${RENOVATE_ONBOARDING}" --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" --osv-vulnerability-alerts="${RENOVATE_OSV_VULNERABILITY_ALERTS}" DarkHelm.org/plex-playlist'
renovate --platform "${RENOVATE_PLATFORM}" --endpoint "${RENOVATE_ENDPOINT}" --git-url "${RENOVATE_GIT_URL}" --git-author "${RENOVATE_GIT_AUTHOR}" --onboarding="${RENOVATE_ONBOARDING}" --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" --osv-vulnerability-alerts="${RENOVATE_OSV_VULNERABILITY_ALERTS}" --enabled-managers "${enabled_managers}" DarkHelm.org/plex-playlist'
}
if run_renovate_with_endpoint "${BASE_ENDPOINT}" 2>&1 | tee /tmp/renovate.log; then
:
else
primary_status=$?
if [ "${primary_status}" -eq 137 ] || grep -qE '(^|[[:space:]])Killed($|[[:space:]])|exitcode '\''137'\''' /tmp/renovate.log; then
echo "❌ Renovate terminated by OOM/kill signal on primary endpoint; skipping endpoint retry"
exit "${primary_status}"
run_batch_with_fallback() {
enabled_managers="$1"
batch_label="$2"
if run_renovate_with_endpoint "${BASE_ENDPOINT}" "${enabled_managers}" "${batch_label}" 2>&1 | tee -a /tmp/renovate.log; then
return 0
fi
echo "⚠ Renovate run failed with primary endpoint. Retrying with API endpoint form..."
run_renovate_with_endpoint "${API_ENDPOINT}" 2>&1 | tee /tmp/renovate.log
fi
primary_status=$?
if [ "${primary_status}" -eq 137 ]; then
echo "❌ Renovate batch '${batch_label}' terminated by OOM/kill signal on primary endpoint; skipping endpoint retry"
return "${primary_status}"
fi
echo "⚠ Renovate batch '${batch_label}' failed with primary endpoint. Retrying with API endpoint form..."
run_renovate_with_endpoint "${API_ENDPOINT}" "${enabled_managers}" "${batch_label}" 2>&1 | tee -a /tmp/renovate.log
}
: > /tmp/renovate.log
# Run low-memory batches sequentially to keep peak usage below constrained runner limits.
run_batch_with_fallback "docker-compose,dockerfile,github-actions,pep621,custom.regex" "core"
run_batch_with_fallback "npm" "npm"
echo "✓ Renovate execution completed"