chore(deps): update sonarsource/sonarqube-scan-action action to v5

2025-02-17 10:57:20 +00:00
21 changed files with 258 additions and 631 deletions
--- a/.gitea/workflows/build-push-docker.yml
+++ b/.gitea/workflows/build-push-docker.yml
@@ -43,7 +43,7 @@ jobs:
          REPO: ${{ gitea.repository }}

      - name: Check out repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
          ref: ${{ inputs.release }}
@@ -52,14 +52,14 @@ jobs:
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ${{ inputs.registry }}
          username: ${{ inputs.actions_username }}
          password: ${{ secrets.ACTIONS_TOKEN }}

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ inputs.ghcr_username }}
--- a/.gitea/workflows/changelog.yaml
+++ b/.gitea/workflows/changelog.yaml
@@ -1,67 +0,0 @@
-name: Get Changelog
-on:
-  workflow_call:
-    outputs:
-      release_name:
-        description: "Name of the created release"
-        value: ${{ jobs.get_next_release.outputs.release_name }}
-      changelog:
-        description: "Release changelog"
-        value: ${{ jobs.get_next_release.outputs.clean_changelog }}
-
-jobs:
-  get_next_release:
-    name: Get Next Release
-    runs-on: ubuntu-latest
-    outputs:
-      release_name: ${{ steps.get_next_version.outputs.tag }}
-    #   changelog: ${{ steps.get_next_version.outputs.changelog }}
-      clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6.0.2
-        with:
-          fetch-depth: 0
-
-      - name: Changes since last tag
-        id: changes
-        run: |
-          rm -f .changes
-          git log $(git describe --tags --abbrev=0)..HEAD --no-merges --oneline >> .changes
-          cat .changes
-
-      - name: Check for changes
-        run: |
-          if [[ -z $(grep '[^[:space:]]' .changes) ]] ; then
-            echo "changes=false"
-            echo "changes=false" >> "$GITEA_OUTPUT"
-          else
-            echo "changes=true"
-            echo "changes=true" >> "$GITEA_OUTPUT"
-          fi
-
-      - name: Cancel if no changes
-        if: steps.changes.outputs.changes == 'false'
-        run: exit 1
-
-      - name: Set server URL
-        id: set_srvurl
-        run: |
-          SRVURL=$(echo "${{ gitea.server_url }}" | sed 's/https:\/\/\(.*\)/\1/')
-          echo "srvurl=$SRVURL" >> "$GITEA_OUTPUT"
-
-      - name: Get next version
-        uses: TriPSs/conventional-changelog-action@v6
-        id: get_next_version
-        with:
-          git-url: ${{ steps.set_srvurl.outputs.srvurl }}
-          github-token: ${{ gitea.token }}
-          preset: "conventionalcommits"
-          # preset: "angular"  # This is the default
-          skip-commit: true
-          release-count: 1
-          output-file: false
-          create-summary: true
-          skip-on-empty: true
-          skip-version-file: true
-          skip-tag: true
--- a/.gitea/workflows/ci-docker.yml
+++ b/.gitea/workflows/ci-docker.yml
@@ -12,26 +12,26 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
          format: sonarqube
          no-fail: true

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: test --all-projects
--- a/.gitea/workflows/ci-python-poetry-with-docker.yml
+++ b/.gitea/workflows/ci-python-poetry-with-docker.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 env:
  PATH: ${{ env.PATH }}:/root/.poetry/bin
@@ -20,11 +20,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
@@ -32,7 +32,7 @@ jobs:
          no-fail: true

      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ inputs.python-version }}"

@@ -44,7 +44,7 @@ jobs:
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local

-      - uses: actions/cache@v5
+      - uses: actions/cache@v4
        name: Define cache for dependencies
        with:
          path: ./.venv
@@ -65,15 +65,15 @@ jobs:
          poetry run coverage xml
          sed -i 's@${{ gitea.workspace }}@/github/workspace@g' coverage.xml

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: test --all-projects
--- a/.gitea/workflows/ci-python-poetry.yml
+++ b/.gitea/workflows/ci-python-poetry.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 env:
  PATH: ${{ env.PATH }}:/root/.poetry/bin
@@ -20,12 +20,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ inputs.python-version }}"

@@ -37,7 +37,7 @@ jobs:
          poetry config virtualenvs.create true --local
          poetry config virtualenvs.in-project true --local

-      - uses: actions/cache@v5
+      - uses: actions/cache@v4
        name: Define cache for dependencies
        with:
          path: ./.venv
@@ -56,15 +56,15 @@ jobs:
          poetry run coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: test --all-projects
--- a/.gitea/workflows/ci-python-uv-with-docker.yml
+++ b/.gitea/workflows/ci-python-uv-with-docker.yml
@@ -6,25 +6,25 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_HOST_URL:
-    #     required: false
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_HOST_URL:
+        required: false
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

      - name: Run Hadolint
-        uses: hadolint/hadolint-action@v3.3.0
+        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
@@ -32,12 +32,12 @@ jobs:
          no-fail: true

      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ vars.PYTHON_VERSION }}"

      - name: uv cache
-        uses: actions/cache@v5
+        uses: actions/cache@v4
        with:
          path: /tmp/.uv-cache
          key: uv-${{ runner.os }}-${{ hashFiles('uv.lock') }}
@@ -62,17 +62,17 @@ jobs:
      - name: Minimize uv cache
        run: uv cache prune --ci

-      # - name: SonarQube Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     command: snyk
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          command: snyk
+          args: test --all-projects
--- a/.gitea/workflows/ci-python-with-docker.yml
+++ b/.gitea/workflows/ci-python-with-docker.yml
@@ -6,22 +6,22 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
@@ -29,14 +29,14 @@ jobs:
          no-fail: true

      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ inputs.python-version }}"

      - name: Update Pip
        run: pip install -U pip

-      - uses: actions/cache@v5
+      - uses: actions/cache@v4
        name: Define cache for dependencies
        with:
          path: .
@@ -57,15 +57,15 @@ jobs:
          coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: test --all-projects
--- a/.gitea/workflows/ci-python.yml
+++ b/.gitea/workflows/ci-python.yml
@@ -6,30 +6,30 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ inputs.python-version }}"

      - name: Update Pip
        run: pip install -U pip

-      - uses: actions/cache@v5
+      - uses: actions/cache@v4
        name: Define cache for dependencies
        with:
          path: .
@@ -50,15 +50,15 @@ jobs:
          coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python@master
-      #   continue-on-error: true # Sometimes vulns aren't immediately fixable
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: test --all-projects
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python@master
+        continue-on-error: true # Sometimes vulns aren't immediately fixable
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: test --all-projects
--- a/.gitea/workflows/create-release-preexisting-tag.yaml
+++ b/.gitea/workflows/create-release-preexisting-tag.yaml
@@ -1,24 +0,0 @@
-name: Create Gitea Release Pre-Existing Tag
-on:
-  workflow_call:
-    inputs:
-      tag:
-        required: true
-      body:
-        required: false
-    secrets:
-      ACTIONS_TOKEN:
-        required: true
-
-jobs:
-  create_release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create release
-        uses: https://git.tainton.uk/actions/create-release-action@v1.1.0
-        with:
-          release_name: ${{ inputs.tag }}
-          tag: ${{ inputs.tag }}
-          body: ${{ inputs.body }}
-          token: ${{ secrets.ACTIONS_TOKEN }}
--- a/.gitea/workflows/create-release.yml
+++ b/.gitea/workflows/create-release.yml
@@ -19,7 +19,7 @@ jobs:
      clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
    steps:
      - name: Check out repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

@@ -72,7 +72,7 @@ jobs:
    needs: get_next_release
    steps:
      - name: Check out repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0

--- a/.gitea/workflows/docker-compose-deploy.yml
+++ b/.gitea/workflows/docker-compose-deploy.yml
@@ -1,96 +0,0 @@
-name: Docker Compose Deploy Stack
-
-on:
-  workflow_call:
-    secrets:
-      DEPLOY_HOST:
-        required: true
-        type: string
-      DEPLOY_USERNAME:
-        required: true
-        type: string
-      DEPLOY_SSHKEY:
-        required: true
-        type: string
-      DEPLOY_PORT:
-        required: true
-        type: string
-      PUSHOVER_USER_TOKEN:
-        required: true
-        type: string
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:      
-      - name: "[ON RUNNER] Notify Build Start"
-        uses: https://git.tainton.uk/actions/pushover-action@v1.1.4
-        env:
-          PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
-          PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
-        with:
-          message: "Deploying stack ${{ gitea.repository }}"
-          title: 'Stack Deployment Started'
-          url: "${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
-          url_title: 'View Logs'
-
-      - name: "[ON RUNNER] Checkout the repo"
-        uses: actions/checkout@v6
-      
-      - name: "[ON RUNNER] Set project variables"
-        run: |
-          projectname="${{ gitea.event.repository.name }}"
-          echo "project_name=$projectname" >> $GITEA_ENV
-          echo "project_folder=/home/${{ secrets.DEPLOY_USERNAME }}/$projectname" >> $GITEA_ENV
-
-      - name: "[ON RUNNER] Create env file"
-        run: |
-          rm -f ".env"
-          touch ".env"
-          echo "$ALLVARS" | jq -r '. | to_entries[] | select(.key | startswith("DC_")) | .key + "=" + .value' >> ".env"
-          echo "$ALLSECRETS" | jq -r '. | to_entries[] | select(.key | startswith("DC_")) | .key + "=" + .value' >> ".env"
-        env:
-          ALLVARS: ${{ toJSON(vars) }}
-          ALLSECRETS: ${{ toJSON(secrets) }}
-      
-      - name: "[ON HOST] Make directory if not exists"
-        uses: appleboy/ssh-action@v1.2.5
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USERNAME }}
-          key: ${{ secrets.DEPLOY_SSHKEY }}
-          port: ${{ secrets.DEPLOY_PORT }}
-          script: |
-            mkdir -p ${{ env.project_folder }}
-      
-      - name: "[ON HOST] SCP files to host"
-        uses: appleboy/scp-action@v1.0.0
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USERNAME }}
-          port: ${{ secrets.DEPLOY_PORT }}
-          key: ${{ secrets.DEPLOY_SSHKEY }}
-          source: "./compose.yaml,./.env"
-          target: "${{ env.project_folder }}/"
-      
-      - name: "[ON HOST] Deploy Stack"
-        uses: appleboy/ssh-action@v1.2.5
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USERNAME }}
-          key: ${{ secrets.DEPLOY_SSHKEY }}
-          port: ${{ secrets.DEPLOY_PORT }}
-          script: |
-            cd ${{ env.project_folder }}
-            docker compose --env-file .env up --detach
-      
-      - name: "[ON RUNNER] Notify Build End"
-        uses: https://git.tainton.uk/actions/pushover-action@v1.1.4
-        env:
-          PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
-          PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
-        with:
-          message: "Deployed stack ${{ gitea.repository }}"
-          title: 'Stack Deployment ${{ job.status }}'
-          url: "${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
-          url_title: 'View Logs'
--- a/.gitea/workflows/docker-compose-remove.yml
+++ b/.gitea/workflows/docker-compose-remove.yml
@@ -1,65 +0,0 @@
-name: Docker Compose Remove Stack
-
-on:
-  workflow_call:
-    secrets:
-      DEPLOY_HOST:
-        required: true
-        type: string
-      DEPLOY_USERNAME:
-        required: true
-        type: string
-      DEPLOY_SSHKEY:
-        required: true
-        type: string
-      DEPLOY_PORT:
-        required: true
-        type: string
-      PUSHOVER_USER_TOKEN:
-        required: true
-        type: string
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "[ON RUNNER] Notify Build Start"
-        uses: https://git.tainton.uk/actions/pushover-action@v1.1.4
-        env:
-          PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
-          PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
-        with:
-          message: "Removing stack ${{ gitea.repository }}"
-          title: 'Stack Removal Started'
-          url: "${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
-          url_title: 'View Logs'
-
-      - name: "[ON RUNNER] Set project variables"
-        run: |
-          projectname="${{ gitea.event.repository.name }}"
-          echo "project_name=$projectname" >> $GITEA_ENV
-          echo "project_folder=/home/${{ secrets.DEPLOY_USERNAME }}/$projectname" >> $GITEA_ENV
-
-      - name: "[ON HOST] Remove Stack"
-        uses: appleboy/ssh-action@v1.2.5
-        with:
-          host: ${{ secrets.DEPLOY_HOST }}
-          username: ${{ secrets.DEPLOY_USERNAME }}
-          key: ${{ secrets.DEPLOY_SSHKEY }}
-          port: ${{ secrets.DEPLOY_PORT }}
-          script: |
-            cd ${{ env.project_folder }}
-            docker compose --env-file .env down
-            cd ..
-            rm -rf ${{ env.project_folder }}
-      
-      - name: "[ON RUNNER] Notify Build End"
-        uses: https://git.tainton.uk/actions/pushover-action@v1.1.4
-        env:
-          PUSHOVER_APP_TOKEN: ${{ secrets.PUSHOVER_APP_TOKEN }}
-          PUSHOVER_USER_TOKEN: ${{ secrets.PUSHOVER_USER_TOKEN }}
-        with:
-          message: "Removed stack ${{ gitea.repository }}"
-          title: 'Stack Removal ${{ job.status }}'
-          url: "${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
-          url_title: 'View Logs'
--- a/.gitea/workflows/release-with-tag.yaml
+++ b/.gitea/workflows/release-with-tag.yaml
@@ -1,71 +0,0 @@
-name: Release w/ Tag
-on:
-  workflow_call:
-    outputs:
-      tag_name:
-        description: "Tag name"
-        value: ${{ jobs.get_next_release.outputs.release_name }}
-      changelog:
-        description: "Changelog"
-        value: ${{ jobs.get_next_release.outputs.clean_changelog }}
-
-jobs:
-  get_next_release:
-    name: Get Next Release
-    runs-on: ubuntu-latest
-    outputs:
-      release_name: ${{ steps.get_next_version.outputs.tag }}
-    #   changelog: ${{ steps.get_next_version.outputs.changelog }}
-      clean_changelog: ${{ steps.get_next_version.outputs.clean_changelog }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6.0.2
-        with:
-          fetch-depth: 0
-
-      - name: Changes since last tag
-        id: changes
-        run: |
-          rm -f .changes
-          git log $(git describe --tags --abbrev=0)..HEAD --no-merges --oneline >> .changes
-          cat .changes
-
-      - name: Check for changes
-        run: |
-          if [[ -z $(grep '[^[:space:]]' .changes) ]] ; then
-            echo "changes=false"
-            echo "changes=false" >> "$GITEA_OUTPUT"
-          else
-            echo "changes=true"
-            echo "changes=true" >> "$GITEA_OUTPUT"
-          fi
-
-      - name: Cancel if no changes
-        if: steps.changes.outputs.changes == 'false'
-        run: exit 1
-
-      - name: Set server URL
-        id: set_srvurl
-        run: |
-          SRVURL=$(echo "${{ gitea.server_url }}" | sed 's/https:\/\/\(.*\)/\1/')
-          echo "srvurl=$SRVURL" >> "$GITEA_OUTPUT"
-
-      - name: Get next version
-        uses: TriPSs/conventional-changelog-action@v6
-        id: get_next_version
-        with:
-          git-url: ${{ steps.set_srvurl.outputs.srvurl }}
-          github-token: ${{ gitea.token }}
-          preset: "conventionalcommits"
-          # preset: "angular"  # This is the default
-          skip-commit: true
-          release-count: 1
-          output-file: false
-          create-summary: true
-          skip-on-empty: true
-          skip-version-file: true
-          skip-tag: false
-      
-      - name: Cancel if no changelog
-        if: steps.get_next_version.outputs.skipped == 'true'
-        run: exit 1
--- a/.github/workflows/build-push-attest-docker.yml
+++ b/.github/workflows/build-push-attest-docker.yml
@@ -24,7 +24,7 @@ jobs:
      success: ${{ steps.set_flag.outputs.success }}
    steps:
      - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.release }}

@@ -32,7 +32,7 @@ jobs:
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -59,7 +59,7 @@ jobs:
            ghcr.io/${{ github.repository }}:${{ inputs.release }}

      - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.push.outputs.digest }}
--- a/.github/workflows/ci-docker.yml
+++ b/.github/workflows/ci-docker.yml
@@ -1,43 +1,40 @@
 name: Docker CI
 on:
  workflow_call:
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
-
-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
          format: sonarqube
          no-fail: true
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python-3.10@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --all-projects
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif

-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python-3.10@master
-      #   continue-on-error: true # To make sure that SARIF upload gets called
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: --sarif-file-output=snyk.sarif --all-projects
-
-      # - name: Upload result to GitHub Code Scanning
-      #   uses: github/codeql-action/upload-sarif@v4
-      #   with:
-      #     sarif_file: snyk.sarif
--- a/.github/workflows/ci-python-poetry-with-docker.yml
+++ b/.github/workflows/ci-python-poetry-with-docker.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
@@ -21,56 +21,46 @@ jobs:
        run: |
          PYTHON_VERSION=${{ inputs.python-version }}
          echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
-
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
-
-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
          format: sonarqube
          no-fail: true
-
      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ steps.python-version.outputs.value }}"
-
      - name: Setup Poetry
        uses: abatilo/actions-poetry@v4
-
      - name: Install dependencies
        run: poetry install
-
      - name: Lint
        run: |
          poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
          cat lintreport.txt
-
      - name: Unit Test
        run: |
          poetry run coverage run -m pytest -v --junitxml=testresults.xml
          poetry run coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
-
-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python-3.10@master
-      #   continue-on-error: true # To make sure that SARIF upload gets called
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: --sarif-file-output=snyk.sarif --all-projects
-
-      # - name: Upload result to GitHub Code Scanning
-      #   uses: github/codeql-action/upload-sarif@v4
-      #   with:
-      #     sarif_file: snyk.sarif
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python-3.10@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --all-projects
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif
--- a/.github/workflows/ci-python-poetry.yml
+++ b/.github/workflows/ci-python-poetry.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
@@ -21,47 +21,38 @@ jobs:
        run: |
          PYTHON_VERSION=${{ inputs.python-version }}
          echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
-
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
-
      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ steps.python-version.outputs.value }}"
-
      - name: Setup Poetry
        uses: abatilo/actions-poetry@v4
-
      - name: Install dependencies
        run: poetry install
-
      - name: Lint
        run: poetry run pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
-
      - name: Unit Test
        run: |
          poetry run coverage run -m pytest -v --junitxml=testresults.xml
          poetry run coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
-
-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python-3.10@master
-      #   continue-on-error: true # To make sure that SARIF upload gets called
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: --sarif-file-output=snyk.sarif --all-projects
-
-      # - name: Upload result to GitHub Code Scanning
-      #   uses: github/codeql-action/upload-sarif@v4
-      #   with:
-      #     sarif_file: snyk.sarif
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python-3.10@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --all-projects
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif
--- a/.github/workflows/ci-python-with-docker.yml
+++ b/.github/workflows/ci-python-with-docker.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
@@ -21,57 +21,47 @@ jobs:
        run: |
          PYTHON_VERSION=${{ inputs.python-version }}
          echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
-
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
-
-      - uses: hadolint/hadolint-action@v3.3.0
+      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          output-file: hadolint.out
          format: sonarqube
          no-fail: true
-
      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ steps.python-version.outputs.value }}"
-
      - name: Update Pip
        run: |
          pip install -U pip
-
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install -r requirements-dev.txt
-
      - name: Lint
        run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
-
      - name: Unit Test
        run: |
          coverage run -m pytest -v --junitxml=testresults.xml
          coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
-
-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python-3.10@master
-      #   continue-on-error: true # To make sure that SARIF upload gets called
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: --sarif-file-output=snyk.sarif --all-projects
-
-      # - name: Upload result to GitHub Code Scanning
-      #   uses: github/codeql-action/upload-sarif@v4
-      #   with:
-      #     sarif_file: snyk.sarif
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python-3.10@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --all-projects
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif
--- a/.github/workflows/ci-python.yml
+++ b/.github/workflows/ci-python.yml
@@ -6,11 +6,11 @@ on:
        type: string
        default: "3.11"
        description: "Version of Python to use for testing environment"
-    # secrets:
-    #   SONAR_TOKEN:
-    #     required: true
-    #   SNYK_TOKEN:
-    #     required: true
+    secrets:
+      SONAR_TOKEN:
+        required: true
+      SNYK_TOKEN:
+        required: true

 jobs:
  ci:
@@ -21,50 +21,41 @@ jobs:
        run: |
          PYTHON_VERSION=${{ inputs.python-version }}
          echo "value=${PYTHON_VERSION:-"3.11"}" >> $GITHUB_OUTPUT
-
      - name: Check out repository code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 0
-
      - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "${{ steps.python-version.outputs.value }}"
-
      - name: Update Pip
        run: |
          pip install -U pip
-
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install -r requirements-dev.txt
-
      - name: Lint
        run: pylint --fail-under=8 --recursive=yes --output-format=parseable --output=lintreport.txt .
-
      - name: Unit Test
        run: |
          coverage run -m pytest -v --junitxml=testresults.xml
          coverage xml
          sed -i 's@${{ github.workspace }}@/github/workspace@g' coverage.xml
-
-      # - name: SonarQube Cloud Scan
-      #   uses: SonarSource/sonarqube-scan-action@v7.0.0
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      # - name: Snyk Vulnerability Scan
-      #   uses: snyk/actions/python-3.10@master
-      #   continue-on-error: true # To make sure that SARIF upload gets called
-      #   env:
-      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      #   with:
-      #     args: --sarif-file-output=snyk.sarif --all-projects
-
-      # - name: Upload result to GitHub Code Scanning
-      #   uses: github/codeql-action/upload-sarif@v4
-      #   with:
-      #     sarif_file: snyk.sarif
+      - name: SonarQube Cloud Scan
+        uses: SonarSource/sonarqube-scan-action@v5.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - name: Snyk Vulnerability Scan
+        uses: snyk/actions/python-3.10@master
+        continue-on-error: true # To make sure that SARIF upload gets called
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif --all-projects
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -17,7 +17,7 @@ jobs:
      release_name: ${{ steps.tag_version.outputs.new_tag }}
      success: ${{ steps.set_flag.outputs.success }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

--- a/renovate.json
+++ b/renovate.json
@@ -1,35 +1,26 @@
 {
+  "extends": [
+    "config:recommended"
+  ],
+  "ignorePaths": [
+    "**/.archive/**"
+  ],
+  "platformCommit": "enabled",
+  "dependencyDashboardAutoclose": true,
  "assignAutomerge": false,
  "assigneesFromCodeOwners": false,
-  "dependencyDashboardAutoclose": true,
-  "extends": ["config:recommended"],
-  "ignorePaths": ["**/.archive/**"],
-  "labels": ["type/dependencies"],
-  "platformCommit": "enabled",
  "rebaseWhen": "behind-base-branch",
  "rollbackPrs": true,
-  "semanticCommits": "enabled",
-  "semanticCommitScope": "deps",
-  "semanticCommitType": "feat",
-  "osvVulnerabilityAlerts": true,
-  "dependencyDashboardOSVVulnerabilitySummary": "all",
+  "labels": [
+    "type/dependencies"
+  ],
  "vulnerabilityAlerts": {
-    "commitMessagePrefix": "[SECURITY] ",
    "enabled": true,
-    "labels": ["security", "type/dependencies"],
+    "labels": [
+      "security",
+      "type/dependencies"
+    ],
+    "commitMessagePrefix": "[SECURITY] ",
    "prCreation": "immediate"
-  },
-  "lockFileMaintenance": {
-    "enabled": true
-  },
-  "packageRules": [
-    {
-      "matchDepTypes": ["devDependencies"],
-      "automerge": true
-    },
-    {
-      "matchUpdateTypes": ["patch"],
-      "automerge": true
-    }
-  ]
+  }
 }