chore: Sync with WeblateOrg/meta

Author: nijel

.github/renovate.json

@@ -137,6 +137,17 @@
       "matchStrings": [
         "renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\s+version: (?<currentValue>.*)\\s"
       ]
+    },
+    {
+      "customType": "regex",
+      "fileMatch": [
+        "^Dockerfile$"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*?(release=(?<release>.*?))?\\s*depName=(?<depName>.*?)?\\sENV .*?_VERSION=\"(?<currentValue>.*)\""
+      ],
+      "registryUrlTemplate": "https://deb.debian.org/debian?{{#if release }}release={{release}}{{else}}suite=stable{{/if}}&components=main,contrib,non-free&binaryArch=amd64",
+      "datasourceTemplate": "deb"
     }
   ]
 }

.github/workflows/closing.yml

@@ -9,6 +9,10 @@ on:
   issues:
     types: [closed]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -24,7 +28,11 @@ jobs:
       if: |
         github.actor != 'renovate[bot]' &&
         github.event.issue.state_reason == 'completed' &&
-        (contains(github.event.issue.labels.*.name, 'question') && ! contains(github.event.issue.labels.*.name, 'duplicate') && ! contains(github.event.issue.labels.*.name, 'wontfix')) || join(github.event.issue.labels.*.name) == ''
+        (
+          contains(github.event.issue.labels.*.name, 'question') &&
+          ! contains(github.event.issue.labels.*.name, 'duplicate') &&
+          ! contains(github.event.issue.labels.*.name, 'wontfix')
+        ) || join(github.event.issue.labels.*.name) == ''
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         issue-number: ${{ github.event.issue.number }}

.github/workflows/container-build.yml

@@ -57,3 +57,5 @@ jobs:
         skip-extraction: ${{ steps.cache.outputs.cache-hit }}
     - name: Build the Docker image
       run: .github/bin/docker-build
+permissions:
+  contents: read

.github/workflows/container-ci.yml

@@ -326,3 +326,5 @@ jobs:
       run: .github/bin/get-buildx-args publish-${{ inputs.variant }}
     - name: Publish the Docker images
       run: .github/bin/docker-build publish-${{ inputs.variant }}
+permissions:
+  contents: read

.github/workflows/container-test.yml

@@ -109,3 +109,5 @@ jobs:
     - name: Shutdown service
       working-directory: docker-compose
       run: ./test-stop
+permissions:
+  contents: read

.github/workflows/pre-commit.yml

@@ -8,7 +8,6 @@ name: Pre-commit check
 on:
   push:
     branches-ignore:
-    - deepsource-fix-**
     - renovate/**
     - weblate
   pull_request:
@@ -35,13 +34,13 @@ jobs:
       id: detect
       run: |
         if test -f requirements-lint.txt ; then
-          echo "method=requirements" >> $GITHUB_OUTPUT
+          echo "method=requirements" >> "$GITHUB_OUTPUT"
         elif test -f pyproject.toml && grep -q dependency-groups pyproject.toml ; then
-          echo "method=pep735" >> $GITHUB_OUTPUT
+          echo "method=pep735" >> "$GITHUB_OUTPUT"
         elif test -f pyproject.toml && grep -q dependency-groups pyproject.toml ; then
-          echo "method=pyproject" >> $GITHUB_OUTPUT
+          echo "method=pyproject" >> "$GITHUB_OUTPUT"
         else
-          echo "method=uvx" >> $GITHUB_OUTPUT
+          echo "method=uvx" >> "$GITHUB_OUTPUT"
         fi
     - name: pre-commit (PEP 735)
       if: steps.detect.outputs.method == 'pep735'
@@ -60,7 +59,7 @@ jobs:
       run: uv pip install --system -r requirements-lint.txt
     - name: Install dependencies
       if: steps.detect.outputs.method == 'pyproject'
-      run: uv pip install --system $(sed -n 's/.*"\(pre-commit==\([^"]*\)\)".*/\1/p' pyproject.toml)
+      run: uv pip install --system "$(sed -n 's/.*"\(pre-commit==\([^"]*\)\)".*/\1/p' pyproject.toml)"
     - name: pre-commit (installed)
       if: steps.detect.outputs.method == 'requirements' || steps.detect.outputs.method == 'pyproject'
       run: pre-commit run --all

.github/workflows/readme-sync.yml

@@ -24,3 +24,5 @@ jobs:
         password: ${{ secrets.DOCKERHUB_PASSWORD }}
         repository: weblate/weblate
         short-description: ${{ github.event.repository.description }}
+permissions:
+  contents: read

.github/workflows/semgrep.yml

@@ -22,3 +22,5 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - run: semgrep ci
+permissions:
+  contents: read

.pre-commit-config.yaml

@@ -47,5 +47,9 @@ repos:
   hooks:
   - id: shfmt
 
+- repo: https://github.com/rhysd/actionlint
+  rev: v1.7.7
+  hooks:
+  - id: actionlint
 ci:
   autoupdate_schedule: quarterly