jfxs/commitizen-semantic-release repository overview

⁠Commitizen semantic-release

A Node.js⁠ Docker image with commitizen⁠ and semantic-release⁠:

• lightweight image based on a debian-slim,
• multiarch with support of amd64 and arm64,
• automatically updated: Renovate tracks the semantic-release, commitizen, plugins, Task and base image versions and opens the merge requests,
• image signed with Cosign⁠,
• a software bill of materials (SBOM) attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Running Commitizen and semantic-release

⁠Sign a commit

Use task⁠ with the git task template⁠:

task git:signed-commit KEY_PATH|K=<key_full_path> MESSAGE|M=<message> [OPTION|O="<options>"] [PULL|P=<n|N>]

or manual:

# Start a container with the mount point of your private key and your git repository
docker run -d --name commit -v "<absolute_path_private_key_dir>:/Private" -v "$(pwd):/data" jfxs/commitizen-semantic-release sleep infinity
# Import your private key
docker exec -it commit /bin/sh -c 'export GPG_TTY=$(tty); gpg --batch --import /Private/<private_key>'
# Commit
docker exec -it commit /bin/sh -c 'export GPG_TTY=$(tty); git commit -S --signoff -m "Your commit message"'
# Stop and delete the container
docker stop commit && docker rm commit

⁠Commitizen with cz-conventional-changelog

Use task⁠ with the git task template⁠:

task git:commitizen KEY_PATH|K=<key_full_path> [PULL|P=<n|N>]

or manual:

# Start a container with the mount point of your private key and your git repository
docker run -d --name commit -v "<absolute_path_private_key_dir>:/Private" -v "$(pwd):/data" jfxs/commitizen-semantic-release sleep infinity
# Import your private key
docker exec -it commit /bin/sh -c 'export GPG_TTY=$(tty); gpg --batch --import /Private/<private_key>'
# Commit
docker exec -it commit /bin/sh -c 'export GPG_TTY=$(tty); npx cz --signoff'
# Stop and delete the container
docker stop commit && docker rm commit

⁠Files owned by root on Linux, running as your own user

The container runs as root by default (this is what GitLab CI needs). On Linux a root container leaves root-owned files in your .git directory. The git task template (task install-templates to update it) therefore runs the container as your own user on Linux, and as the image default on macOS and Windows:

# Linux: automatically --user <your uid>:<your gid>. To keep root or force another user:
task git:commitizen KEY_PATH|K=<key_full_path> DOCKER_USER=root
task git:commitizen KEY_PATH|K=<key_full_path> DOCKER_USER=1000:1000

The same works for signed-commit and signed-commit-amend. DOCKER_RUN_OPTS and DOCKER_EXEC_OPTS add options to docker run and docker exec.

For the manual commands, add --user "$(id -u):$(id -g)" to the docker run command (the docker exec commands use the same user). The image works with any user id: the home directory (/home/node) is writable by everyone, and /data is a git safe directory in the system git configuration.

Limits:

• if a runner overrides HOME, the .czrc file of the image (in /home/node) is not found by Commitizen,
• a passphrase-protected key asks for the passphrase in the terminal (-it is used for that).

⁠semantic-release

Example of usage with Gitlab-CI:

 ...
gitlab-release:
  # Use a fixed tag (see "Versioning" below) rather than the latest one to get reproducible releases.
  image: jfxs/commitizen-semantic-release:<semantic-release_version>-<increment>
  stage: gitlab-release
  script:
    - semantic-release
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

⁠Development

The tasks are provided by the task templates⁠ (Taskfile.d/ is not versioned, download it first):

task install-templates     # download the task templates
task 00:10-build-local     # build the image locally
task 00:30-test            # smoke test, non-root test and semantic-release dry-run
task 00:999-pre-commit     # all the checks (linters, build and tests)

The versions of semantic-release, commitizen, their plugins and Task are the ARG of the Dockerfile: Renovate⁠ opens the merge requests to update them.

⁠Built with

Docker latest tag is 25.0.9-001, 25.0, 25⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component commitizen-semantic-release.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Docker tag definition:

• the semantic-release version used,
• a dash
• an increment to differentiate build with the same version starting at 001

<semantic-release_version>-<increment>

Example: 25.0.9-001

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the software bill of materials (SBOM) attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.