fix: combine psql commands

Reviewed-on: #9

.gitea/workflows/cron.yaml

@@ -0,0 +1,45 @@
+name: Nightly Rebuild
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - id: get-latest-tag
+        run: |
+          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+      - id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        with:
+          images: jcabillot/docker-ttrss
+          tags: |
+            type=raw,value=latest
+            type=raw,value=${{ steps.get-latest-tag.outputs.tag }},enable=${{ steps.get-latest-tag.outputs.tag != '' }}
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true

.gitea/workflows/docker-build.yaml

@@ -1,46 +0,0 @@
-name: Docker Build and Push
-
-on:
-  pull_request:
-    branches: [master]
-  push:
-    branches: [master]
-  schedule:
-    - cron: '0 0 * * *'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: jcabillot/ttrss
-          tags: |
-            #type=ref,event=branch
-            #type=ref,event=pr
-            #type=sha
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          pull: true

.gitea/workflows/main.yaml

@@ -0,0 +1,63 @@
+name: Main Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        with:
+          images: jcabillot/docker-ttrss
+          tags: |
+            type=raw,value=latest
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - run: docker build --load -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}
+
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+      - name: Configure git auth
+        run: |
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@scm.cabillot.eu/web/docker-ttrss.git"
+      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEFAULT_BUMP: patch
+          RELEASE_BRANCHES: master
+          WITH_V: true
+          GIT_API_TAGGING: false

.gitea/workflows/pr.yaml

@@ -0,0 +1,23 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [master]
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - run: docker build --load -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}

.gitea/workflows/tag.yaml

@@ -0,0 +1,38 @@
+name: Tag Release
+
+on:
+  push:
+    tags: ['*']
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        continue-on-error: true
+        with:
+          dockerfile: Dockerfile
+
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        with:
+          images: jcabillot/docker-ttrss
+          tags: |
+            type=ref,event=tag
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          pull: true

Dockerfile

@@ -1,7 +1,8 @@
-FROM alpine:3.23
+FROM alpine:3.24
 LABEL description="A complete, self-hosted Tiny Tiny RSS (TTRSS) environment." \
     maintainer="Julien Cabillot <dockerimages@cabillot.eu>"
 
+# hadolint ignore=DL3018
 RUN set -xe && \
     apk update && apk upgrade && \
     apk add --no-cache --virtual=run-deps \
@@ -53,6 +54,7 @@ RUN git clone "https://git.tt-rss.org/fox/tt-rss.git/" "/var/www/ttrss" && \
     git clone --depth=1 https://github.com/levito/tt-rss-feedly-theme.git /var/www/ttrss/themes.local/levito-feedly-git && \
     git clone --depth=1 https://github.com/Gravemind/tt-rss-feedlish-theme.git /var/www/ttrss/themes.local/gravemind-feedly-git
 
+# hadolint ignore=DL3002
 USER root
 
 ENTRYPOINT ["/init"]

renovate.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Detect s6-overlay release version in Dockerfile curl download",
+      "managerFilePatterns": [
+        "/^Dockerfile$/"
+      ],
+      "matchStrings": [
+        "s6-overlay/releases/download/v(?<currentValue>[0-9.]+)/s6-overlay"
+      ],
+      "depNameTemplate": "just-containers/s6-overlay",
+      "datasourceTemplate": "github-releases"
+    }
+  ]
+}

tests/test.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+set -euo pipefail
+
+IMAGE="$1"
+CONTAINER_NAME="test-$(echo "$IMAGE" | tr ':/' '-')-$$"
+DB_CONTAINER="ttrss-db-$$"
+TMPDIR="$(mktemp -d)"
+trap 'docker rm -f "$CONTAINER_NAME" 2>/dev/null; docker rm -f "$DB_CONTAINER" 2>/dev/null; rm -rf "$TMPDIR"' EXIT
+
+DOCKER_GW=$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}')
+BASE_URL="http://${DOCKER_GW}:8080"
+FAILED=0
+PASSED=0
+
+assert_eq() {
+  local desc="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "PASS: $desc"
+    PASSED=$((PASSED + 1))
+  else
+    echo "FAIL: $desc (expected '$expected', got '$actual')"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+assert_contains() {
+  local desc="$1" pattern="$2" file="$3"
+  if grep -qEi "$pattern" "$file"; then
+    echo "PASS: $desc"
+    PASSED=$((PASSED + 1))
+  else
+    echo "FAIL: $desc"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+echo "Starting PostgreSQL..."
+docker pull postgres:16-alpine > /dev/null 2>&1
+SOCKET_DIR="$TMPDIR/pg-socket"
+mkdir -p "$SOCKET_DIR"
+docker run -d --name "$DB_CONTAINER" \
+  -v "$SOCKET_DIR:/var/run/postgresql" \
+  -e POSTGRES_DB=ttrss -e POSTGRES_USER=ttrss -e POSTGRES_PASSWORD=ttrss \
+  postgres:16-alpine
+
+echo "Waiting for PostgreSQL to be ready..."
+for i in $(seq 1 30); do
+  if docker exec "$DB_CONTAINER" pg_isready -U ttrss -d ttrss 2>/dev/null; then
+    echo "PostgreSQL ready (attempt $i)"
+    break
+  fi
+  sleep 2
+done
+
+echo "Starting TTRSS..."
+docker run -d --name "$CONTAINER_NAME" \
+  -v "$SOCKET_DIR:/run/postgresql" \
+  -e DB_HOST=db -e DB_PORT=5432 \
+  --link "$DB_CONTAINER:db" -p 8080:8080 "$IMAGE"
+
+echo "Waiting for TTRSS to be ready..."
+READY=false
+for i in $(seq 1 60); do
+  if curl -s -o /dev/null "$BASE_URL/"; then
+    echo "TTRSS ready (attempt $i)"
+    READY=true
+    break
+  fi
+  sleep 3
+done
+
+if [ "$READY" = false ]; then
+  echo "Container did not become ready within 3 minutes"
+  echo "=== Container logs ==="
+  docker logs "$CONTAINER_NAME" 2>&1 || true
+  exit 1
+fi
+
+# Ensure www-data role exists for Unix socket connection
+docker exec -e PGPASSWORD=ttrss "$DB_CONTAINER" psql -U ttrss -d ttrss -c "CREATE ROLE www-data WITH LOGIN;" 2>/dev/null; docker exec -e PGPASSWORD=ttrss "$DB_CONTAINER" psql -U ttrss -d ttrss -c "GRANT ALL ON DATABASE ttrss TO www-data;" 2>/dev/null || true
+
+echo "Updating TT-RSS database schema..."
+echo yes | docker exec -i -u www-data -e DB_HOST=db -e DB_PORT=5432 "$CONTAINER_NAME" php /var/www/ttrss/update.php --update-schema 2>&1 || true
+sleep 2
+
+# Test 1: HTTP status
+STATUS=$(curl -s -o "$TMPDIR/body" -w '%{http_code}' "$BASE_URL/")
+echo "HTTP status: $STATUS"
+assert_eq "HTTP 200" "200" "$STATUS"
+
+# Test 2: Content-Type contains text/html
+curl -s -o /dev/null -D "$TMPDIR/headers" "$BASE_URL/"
+assert_contains "Content-Type text/html" "text/html" "$TMPDIR/headers"
+
+# Test 3: Body contains HTML
+assert_contains "Body is HTML" "<html|DOCTYPE" "$TMPDIR/body"
+
+echo ""
+echo "$PASSED/$(($PASSED + $FAILED)) tests passed"
+if [ "$FAILED" -gt 0 ]; then
+  exit 1
+fi