From f68e126c9d9349682c84c40e942223f472b3520a Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 15:45:20 +0100 Subject: [PATCH 01/11] Create docker-publish.yml --- .github/workflows/docker-publish.yml | 98 ++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 .github/workflows/docker-publish.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml new file mode 100644 index 0000000..c094564 --- /dev/null +++ b/.github/workflows/docker-publish.yml @@ -0,0 +1,98 @@ +name: Docker + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +on: + schedule: + - cron: '31 9 * * *' + push: + branches: [ "main" ] + # Publish semver tags as releases. + tags: [ 'v*.*.*' ] + pull_request: + branches: [ "main" ] + +env: + # Use docker.io for Docker Hub if empty + REGISTRY: ghcr.io + # github.repository as / + IMAGE_NAME: ${{ github.repository }} + + +jobs: + build: + + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 + with: + cosign-release: 'v2.2.4' + + # Set up BuildKit Docker container builder to be able to build + # multi-platform images and export cache + # https://github.com/docker/setup-buildx-action + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ${{ env.REGISTRY }} + if: github.event_name != 'pull_request' + uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + # Build and push Docker image with Buildx (don't push on PR) + # https://github.com/docker/build-push-action + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + # Sign the resulting Docker image digest except on PRs. + # This will only write to the public Rekor transparency log when the Docker + # repository is public to avoid leaking data. If you would like to publish + # transparency data even for private images, pass --force to cosign below. + # https://github.com/sigstore/cosign + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' }} + env: + # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} + # This step uses the identity token to provision an ephemeral certificate + # against the sigstore community Fulcio instance. + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} From ce133d03e306cfa871f1859522ec41be785ac2e7 Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:11:18 +0100 Subject: [PATCH 02/11] Update cron schedule to nightly and add Docker metadata tags --- .github/workflows/docker-publish.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index c094564..27b4e37 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -7,7 +7,7 @@ name: Docker on: schedule: - - cron: '31 9 * * *' + - cron: '31 22 * * *' push: branches: [ "main" ] # Publish semver tags as releases. @@ -68,6 +68,11 @@ jobs: uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=schedule,enable=true,priority=1000,pattern=nightly + type=semver,pattern={{version}} + type=ref,event=branch + type=ref,event=pr # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action From ab3eac5732647bafea3a9c34b89dded7f681bfc1 Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:15:17 +0100 Subject: [PATCH 03/11] Update Docker build context to source/AAS.TwinEngine.DataEngine --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 27b4e37..ad38746 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -80,7 +80,7 @@ jobs: id: build-and-push uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 with: - context: . + context: source/AAS.TwinEngine.DataEngine push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} From f0a85a922cf7b8d269aae881c37cb819324028a3 Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:20:45 +0100 Subject: [PATCH 04/11] Update Docker build context and specify Dockerfile path --- .github/workflows/docker-publish.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index ad38746..59f915d 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -80,7 +80,8 @@ jobs: id: build-and-push uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 with: - context: source/AAS.TwinEngine.DataEngine + context: ./source + file: source/AAS.TwinEngine.DataEngine/Dockerfile push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} From d48a4f69490a8902beb6fcfb257283461092475b Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:30:03 +0100 Subject: [PATCH 05/11] Update docker-publish.yml --- .github/workflows/docker-publish.yml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 59f915d..6268926 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -88,17 +88,17 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} + # # Sign the resulting Docker image digest except on PRs. + # # This will only write to the public Rekor transparency log when the Docker + # # repository is public to avoid leaking data. If you would like to publish + # # transparency data even for private images, pass --force to cosign below. + # # https://github.com/sigstore/cosign + # - name: Sign the published Docker image + # if: ${{ github.event_name != 'pull_request' }} + # env: + # # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable + # TAGS: ${{ steps.meta.outputs.tags }} + # DIGEST: ${{ steps.build-and-push.outputs.digest }} + # # This step uses the identity token to provision an ephemeral certificate + # # against the sigstore community Fulcio instance. + # run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} From 28f5df698b7d4ea6c89635d7cd67d1d30ba07e48 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:36:38 +0100 Subject: [PATCH 06/11] Bump actions/setup-dotnet from 4.3.1 to 5.0.1 (#11) * Update dependabot.yml * Update dependabot.yml * Bump actions/setup-dotnet from 4.3.1 to 5.0.1 Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4.3.1 to 5.0.1. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](https://github.com/actions/setup-dotnet/compare/67a3573c9a986a3f9c594539f4ab511d57bb3ce9...2016bd2012dba4e32de620c46fe006a3ac9f0602) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --------- Signed-off-by: dependabot[bot] Co-authored-by: mm-psy <147830298+mm-psy@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/dependabot.yml | 6 ++++++ .github/workflows/dotnet.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f95adb1..50bb708 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,11 +6,17 @@ version: 2 updates: - package-ecosystem: "nuget" + open-pull-requests-limit: 30 directory: "/source" schedule: interval: "weekly" cooldown: default-days: 3 + groups: + non-major: + update-types: + - "minor" + - "patch" - package-ecosystem: "docker" directory: "/source/AAS.TwinEngine.DataEngine" diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 196bccf..49774f1 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 - name: Setup .NET - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 + uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1 with: dotnet-version: 8.0.x - name: Restore dependencies From 5ced613cfaf7fd204aa15e448a222967dc60ae0b Mon Sep 17 00:00:00 2001 From: mm-psy <147830298+mm-psy@users.noreply.github.com> Date: Mon, 1 Dec 2025 16:37:02 +0100 Subject: [PATCH 07/11] Revert "Bump actions/setup-dotnet from 4.3.1 to 5.0.1 (#11)" (#26) This reverts commit 28f5df698b7d4ea6c89635d7cd67d1d30ba07e48. --- .github/dependabot.yml | 6 ------ .github/workflows/dotnet.yml | 2 +- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 50bb708..f95adb1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,17 +6,11 @@ version: 2 updates: - package-ecosystem: "nuget" - open-pull-requests-limit: 30 directory: "/source" schedule: interval: "weekly" cooldown: default-days: 3 - groups: - non-major: - update-types: - - "minor" - - "patch" - package-ecosystem: "docker" directory: "/source/AAS.TwinEngine.DataEngine" diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 49774f1..196bccf 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -20,7 +20,7 @@ jobs: steps: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 - name: Setup .NET - uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1 + uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 with: dotnet-version: 8.0.x - name: Restore dependencies From f07de4d84001d4ce3f5d74b5215e2873f9ab4dc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 10:30:51 +0100 Subject: [PATCH 08/11] Bump docker/build-push-action from 5.0.0 to 6.18.0 (#27) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.0.0 to 6.18.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/0565240e2d4ab88bba5387d719585280857ece09...263435318d21b8e681c14492fe198d362a7d2c83) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 6.18.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 6268926..872f9a0 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -78,7 +78,7 @@ jobs: # https://github.com/docker/build-push-action - name: Build and push Docker image id: build-and-push - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: ./source file: source/AAS.TwinEngine.DataEngine/Dockerfile From 201cea70afe313e9f113f5b74e2bb6c871f35524 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 10:31:07 +0100 Subject: [PATCH 09/11] Bump actions/checkout from 4 to 6 (#30) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 872f9a0..d8bb780 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer From bd9c42142926948369eb754c16d0d3295b6cddc4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 10:31:40 +0100 Subject: [PATCH 10/11] Bump docker/metadata-action from 5.0.0 to 5.10.0 (#28) Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.0.0 to 5.10.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/96383f45573cb7f253c731d3b3ab81c87ef81934...c299e40c65443455700f0fdfc63efafe5b349051) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index d8bb780..7ff6c04 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -65,7 +65,7 @@ jobs: # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | From 565a26f909960c0e9b1d9be996ac593e58929c50 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 09:48:15 +0000 Subject: [PATCH 11/11] Bump AasCore.Aas3_0 from 1.0.4 to 1.0.5 --- updated-dependencies: - dependency-name: AasCore.Aas3_0 dependency-version: 1.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .../AAS.TwinEngine.DataEngine/AAS.TwinEngine.DataEngine.csproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/AAS.TwinEngine.DataEngine/AAS.TwinEngine.DataEngine.csproj b/source/AAS.TwinEngine.DataEngine/AAS.TwinEngine.DataEngine.csproj index 1a8bb05..602dfee 100644 --- a/source/AAS.TwinEngine.DataEngine/AAS.TwinEngine.DataEngine.csproj +++ b/source/AAS.TwinEngine.DataEngine/AAS.TwinEngine.DataEngine.csproj @@ -20,7 +20,7 @@ - +