release: version 3.4.0

- now seems to need linux-headers, see https://github.com/socketry/nio4r/issues/225

.github/workflows/cd.yml

@@ -14,13 +14,22 @@ jobs:
     - name: Extract dyndnsd version from tag name
       run: |
         echo "DYNDNSD_VERSION=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV
+
     # https://github.com/marketplace/actions/build-and-push-docker-images
-    - name: Build and push Docker image for dyndnsd ${{ env.DYNDNSD_VERSION }}
-      uses: docker/build-push-action@v1
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v1
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v1
       with:
         username: cmur2
         password: ${{ secrets.DOCKER_TOKEN }}
-        repository: cmur2/dyndnsd
-        path: docker
-        build_args: DYNDNSD_VERSION=${{ env.DYNDNSD_VERSION }}
-        tag_with_ref: true
+
+    - name: Build and push Docker image for dyndnsd ${{ env.DYNDNSD_VERSION }}
+      uses: docker/build-push-action@v2
+      with:
+        context: docker
+        build-args: |
+          DYNDNSD_VERSION=${{ env.DYNDNSD_VERSION }}
+        push: true
+        tags: cmur2/dyndnsd:v${{ env.DYNDNSD_VERSION }}

.github/workflows/ci.yml

@@ -19,15 +19,23 @@ jobs:
         - '2.5'
         - '2.6'
         - '2.7'
+        - '3.0'
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby ${{ matrix.ruby-version }}
       uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby-version }}
-    - name: Install dependencies
-      run: |
-        bundle
-    - name: Test
+        bundler-cache: true  # runs 'bundle install' and caches installed gems automatically
+    - name: Lint and Test
       run: |
         bundle exec rake ci
+
+    # https://github.com/marketplace/actions/build-and-push-docker-images
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v1
+
+    - name: Test building Docker image for dyndnsd
+      uses: docker/build-push-action@v2
+      with:
+        context: docker

.rubocop.yml

@@ -1,3 +1,7 @@
+require:
+- rubocop-rake
+- rubocop-rspec
+
 AllCops:
   TargetRubyVersion: '2.5'
   NewCops: enable
@@ -86,3 +90,9 @@ Style/SymbolArray:
 
 Style/TrailingCommaInArrayLiteral:
   Enabled: false
+
+RSpec/ExampleLength:
+  Max: 20
+
+RSpec/MultipleExpectations:
+  Max: 20

CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 3.4.0 (April 2, 2021)
+
+IMPROVEMENTS:
+
+- **change** Docker image to run as non-root user `65534` by default, limits attack surface for security and gives OpenShift compatibility
+
+## 3.3.3 (April 1, 2021)
+
+OTHER:
+
+- update base of Docker image to Alpine 3.13.4 to fix security vulnerabilities
+
+## 3.3.2 (February 20, 2021)
+
+OTHER:
+
+- update to use `docker/build-push-action@v2` for releasing Docker image in GHA
+
+## 3.3.1 (February 18, 2021)
+
+OTHER:
+
+- update base of Docker image to Alpine 3.13.2 to fix security vulnerabilities
+
+## 3.3.0 (January 18, 2021)
+
+OTHER:
+
+- update base of Docker image to Alpine 3.13
+
+## 3.2.0 (January 14, 2021)
+
+IMPROVEMENTS:
+
+- Add Ruby 3.0 support
+
 ## 3.1.3 (December 20, 2020)
 
 OTHER:

Gemfile

@@ -3,5 +3,3 @@
 source 'https://rubygems.org'
 
 gemspec
-
-gem 'solargraph', git: 'https://github.com/zaratan/solargraph.git', branch: 'fix_rubocop_1_0'

Rakefile

@@ -28,4 +28,5 @@ end
 
 task default: [:rubocop, :spec, 'bundle:audit', :solargraph]
 
+desc 'Run all tasks desired for CI'
 task ci: ['solargraph:init', :default, :hadolint]

docker/Dockerfile

@@ -1,15 +1,21 @@
-FROM alpine:3.12
+FROM alpine:3.13.4
 
 EXPOSE 5353 8080
 
-ARG DYNDNSD_VERSION=3.0.0
+ARG DYNDNSD_VERSION=3.4.0
 
 RUN apk --no-cache add openssl ca-certificates && \
     apk --no-cache add ruby ruby-etc ruby-io-console ruby-json ruby-webrick && \
-    apk --no-cache add --virtual .build-deps ruby-dev build-base tzdata && \
+    apk --no-cache add --virtual .build-deps linux-headers ruby-dev build-base tzdata && \
     gem install --no-document dyndnsd -v ${DYNDNSD_VERSION} && \
     # set timezone to Berlin
     cp /usr/share/zoneinfo/Europe/Berlin /etc/localtime && \
     apk del .build-deps
 
+# Follow the principle of least privilege: run as unprivileged user.
+# Running as non-root enables running this image in platforms like OpenShift
+# that do not allow images running as root.
+# User ID 65534 is usually user 'nobody'.
+USER 65534
+
 ENTRYPOINT ["dyndnsd", "/etc/dyndnsd/config.yml"]

dyndnsd.gemspec

@@ -36,10 +36,12 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'webrick', '>= 1.6.1'
 
   s.add_development_dependency 'bundler'
-  s.add_development_dependency 'bundler-audit', '~> 0.7.0'
+  s.add_development_dependency 'bundler-audit', '~> 0.8.0'
   s.add_development_dependency 'rack-test'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'rspec'
-  s.add_development_dependency 'rubocop', '~> 1.6.1'
-  # s.add_development_dependency 'solargraph', '~> 0.39.0'
+  s.add_development_dependency 'rubocop', '~> 1.12.0'
+  s.add_development_dependency 'rubocop-rake', '~> 0.5.1'
+  s.add_development_dependency 'rubocop-rspec', '~> 2.2.0'
+  s.add_development_dependency 'solargraph', '~> 0.40.0'
 end

lib/dyndnsd/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dyndnsd
-  VERSION = '3.1.3'
+  VERSION = '3.4.0'
 end

spec/dyndnsd/daemon_spec.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'spec_helper'
+require_relative '../spec_helper'
 
 describe Dyndnsd::Daemon do
   include Rack::Test::Methods