Switch to alpine image of Node.js in CI

Reviewed-on: #114

.drone.yml

@@ -15,24 +15,27 @@ trigger:
 
 steps:
   - name: reuse
-    image: fsfe/reuse:3.0.2-debian
+    image: fsfe/reuse:4.0.3-debian@sha256:20e70745bf4aa1d37f4ac054f4df045e4f7df7f4ec95d7abd2e263aa1323f399
   - name: lint
-    image: node:20.12.2
+    image: node:20.17.0-alpine@sha256:2d07db07a2df6830718ae2a47db6fedce6745f5bcd174c398f2acdda90a11c03
     commands:
       - npm ci
-      - npm run lint
+      - npm run lint -- --no-fix
   - name: audit
-    image: node:20.12.2
+    image: node:20.17.0-alpine@sha256:2d07db07a2df6830718ae2a47db6fedce6745f5bcd174c398f2acdda90a11c03
     commands:
       - npm install -g better-npm-audit
       - better-npm-audit audit --production --level=moderate
   - name: docker-dry-run
-    image: plugins/docker:20.17.3
+    image: plugins/docker:20.18.4@sha256:a8d3d86853c721492213264815f1d00d3ed13f42f5c1855a02f47fa4d5f1e042
     settings:
       registry: git.wtf-eg.de
       repo: git.wtf-eg.de/kompetenzinventar/frontend
       target: ki-frontend
       dry_run: true
+    when:
+      event:
+        - pull_request
 
 ---
 kind: pipeline
@@ -50,7 +53,7 @@ depends_on:
 
 steps:
   - name: docker-publish
-    image: plugins/docker:20.17.3
+    image: plugins/docker:20.18.4@sha256:a8d3d86853c721492213264815f1d00d3ed13f42f5c1855a02f47fa4d5f1e042
     settings:
       registry: git.wtf-eg.de
       repo: git.wtf-eg.de/kompetenzinventar/frontend
@@ -77,7 +80,7 @@ depends_on:
 
 steps:
   - name: deploy-dev
-    image: appleboy/drone-ssh:1.7.5
+    image: appleboy/drone-ssh:1.7.5@sha256:995677e073454912f26d4c0fdd2f9df2e1f5a30d6603d3f2ece667311b6babb3
     settings:
       host:
         - dev01.wtf-eg.net
@@ -99,14 +102,14 @@ trigger:
 
 steps:
   - name: reuse
-    image: fsfe/reuse:3.0.2-debian
+    image: fsfe/reuse:4.0.3-debian@sha256:20e70745bf4aa1d37f4ac054f4df045e4f7df7f4ec95d7abd2e263aa1323f399
   - name: lint
-    image: node:20.12.2
+    image: node:20.17.0-alpine@sha256:2d07db07a2df6830718ae2a47db6fedce6745f5bcd174c398f2acdda90a11c03
     commands:
       - npm ci
-      - npm run lint
+      - npm run lint -- --no-fix
   - name: docker-publish
-    image: plugins/docker:20.17.3
+    image: plugins/docker:20.18.4@sha256:a8d3d86853c721492213264815f1d00d3ed13f42f5c1855a02f47fa4d5f1e042
     settings:
       registry: git.wtf-eg.de
       repo: git.wtf-eg.de/kompetenzinventar/frontend

.reuse/dep5

@@ -1,28 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: ki-frontend
-Upstream-Contact: Scammo <kontakt@samuelbrinkmann.de>
-Source: https://git.wtf-eg.de/kompetenzinventar/ki-frontend
-
-Files: package.json package-lock.json
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: AGPL-3.0-or-later
-
-Files: .browserslistrc .dockerignore .eslintrc.js .gitignore 
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: AGPL-3.0-or-later
-
-Files: src/assets/img/wtf*
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: LicenseRef-WTF
-
-Files: src/assets/language_level.json src/assets/skill_level.json
-Copyright: WTF Kooperative eG <https://wtf-eg.de/>
-License: AGPL-3.0-or-later
-
-Files: public/img/bootstrap-icons-1.5.0/*
-Copyright: Copyright (c) 2019-2020 The Bootstrap Authors
-License: MIT
-
-Files: public/fonts/Lato*
-Copyright: 2010-2015, Łukasz Dziedzic (dziedzic@typoland.com)
-License: OFL-1.1-RFN

Dockerfile

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-FROM node:20.12.2-alpine as builder
+FROM node:20.17.0-alpine@sha256:2d07db07a2df6830718ae2a47db6fedce6745f5bcd174c398f2acdda90a11c03 as builder
 
 COPY package.json package-lock.json ./
 RUN npm install
@@ -15,7 +15,7 @@ COPY src src
 RUN npm ci && npm run build
 
 
-FROM nginx:1.24-alpine as ki-frontend
+FROM nginx:1.27-alpine@sha256:c04c18adc2a407740a397c8407c011fc6c90026a9b65cceddef7ae5484360158 as ki-frontend
 
 LABEL org.opencontainers.image.source=https://git.wtf-eg.de/kompetenzinventar/ki-frontend.git
 LABEL org.opencontainers.image.url=https://git.wtf-eg.de/kompetenzinventar/ki-frontend

REUSE.toml

@@ -0,0 +1,40 @@
+version = 1
+SPDX-PackageName = "ki-frontend"
+SPDX-PackageSupplier = "Scammo <kontakt@samuelbrinkmann.de>"
+SPDX-PackageDownloadLocation = "https://git.wtf-eg.de/kompetenzinventar/ki-frontend"
+
+[[annotations]]
+path = ["package.json", "package-lock.json", "renovate.json"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = [".browserslistrc", ".dockerignore", ".eslintrc.js", ".gitignore", "REUSE.toml"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = "src/assets/img/wtf**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "LicenseRef-WTF"
+
+[[annotations]]
+path = ["src/assets/language_level.json", "src/assets/skill_level.json"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "WTF Kooperative eG <https://wtf-eg.de/>"
+SPDX-License-Identifier = "AGPL-3.0-or-later"
+
+[[annotations]]
+path = "public/img/bootstrap-icons-1.5.0/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Copyright (c) 2019-2020 The Bootstrap Authors"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = "public/fonts/Lato**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2010-2015, Łukasz Dziedzic (dziedzic@typoland.com)"
+SPDX-License-Identifier = "OFL-1.1-RFN"

package.json

@@ -7,22 +7,25 @@
     "lint": "vue-cli-service lint"
   },
   "devDependencies": {
-    "@babel/eslint-parser": "7.23.10",
-    "@vue/cli-plugin-babel": "~5.0.8",
-    "@vue/cli-plugin-eslint": "~5.0.8",
-    "@vue/cli-plugin-router": "~5.0.8",
-    "@vue/cli-service": "~5.0.8",
-    "@vue/compiler-sfc": "^3.4.19",
-    "bootstrap": "^5.3.3",
-    "bootstrap-icons": "^1.11.3",
-    "core-js": "^3.38.1",
-    "eslint": "^7.32.0",
-    "eslint-plugin-vue": "^9.27.0",
-    "sass": "^1.77.8",
-    "sass-loader": "^14.2.1",
-    "v-tooltip": "^4.0.0-beta.17",
-    "vue": "^3.4.0",
-    "vue-router": "^4.4.3",
-    "vuex": "^4.1.0"
+    "@babel/eslint-parser": "7.25.1",
+    "@vue/cli-plugin-babel": "5.0.8",
+    "@vue/cli-plugin-eslint": "5.0.8",
+    "@vue/cli-plugin-router": "5.0.8",
+    "@vue/cli-service": "5.0.8",
+    "@vue/compiler-sfc": "3.4.38",
+    "bootstrap": "5.3.3",
+    "bootstrap-icons": "1.11.3",
+    "core-js": "3.38.1",
+    "eslint": "8.57.0",
+    "eslint-plugin-vue": "9.28.0",
+    "sass": "1.77.8",
+    "sass-loader": "16.0.1",
+    "v-tooltip": "4.0.0-beta.17",
+    "vue": "3.4.38",
+    "vue-router": "4.4.3",
+    "vuex": "4.1.0"
+  },
+  "optionalDependencies": {
+    "sass-embedded": "1.77.8"
   }
 }

renovate.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    "group:linters",
+    "group:test",
+    "npm:unpublishSafe",
+    ":disableDependencyDashboard",
+    ":maintainLockFilesWeekly",
+    ":pinAllExceptPeerDependencies",
+    ":separateMultipleMajorReleases"
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": [
+        "node"
+      ],
+      "allowedVersions": "/^[1-9][02468]\\./"
+    }
+  ]
+}