Merge pull request 'Merge testing in main: Release 1.0.3' (#20) from testing into main

Reviewed-on: #20

.gitea/workflows/main.yaml

@@ -9,6 +9,10 @@ jobs:
   release-and-publish:
     name: Build, Publish Packages (Stable) & Create Release
     runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
@@ -19,18 +23,58 @@ jobs:
           toolchain: stable
           cache: false
 
-      - name: Install Cross-Compilation Toolchains & Dependencies
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
-          rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu i686-unknown-linux-gnu
 
-      - name: Install Packaging Tools (Prebuilt Binaries)
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
         run: |
           mkdir -p ~/.cargo/bin
-          curl -fsSL https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar -xz -C ~/.cargo/bin
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-          ~/.cargo/bin/cargo-binstall -y --no-symlinks cargo-deb cargo-generate-rpm
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: ~/.cargo/bin
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
 
       - name: Run Tests
         run: |

.gitea/workflows/renovate.yaml

@@ -0,0 +1,25 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 4 * * 1"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    name: Dependency-Updates prüfen & Pull Requests erstellen
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:44.79.2
+    steps:
+      - name: Renovate ausführen
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ gitea.server_url || github.server_url }}/api/v1/
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ gitea.repository || github.repository }}
+          RENOVATE_AUTODISCOVER: "false"
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@creative-dragonslayer.de>"
+          RENOVATE_HOST_RULES: >-
+            [{"hostType":"cargo","matchHost":"gitea.creative-dragonslayer.de","token":"${{ secrets.RENOVATE_TOKEN }}"}]
+          LOG_LEVEL: info

.gitea/workflows/security-scan.yaml

@@ -0,0 +1,95 @@
+name: Security Scans
+
+on:
+  push:
+    branches:
+      - main
+      - testing
+      - dev
+  pull_request:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    name: Trivy & OSV-Scanner
+    runs-on: ubuntu-latest
+    env:
+      TRIVY_VERSION: "0.74.0"
+      OSV_SCANNER_VERSION: "2.5.1"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Trivy-Binary
+        id: cache-trivy
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trivy
+          key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }}
+
+      - name: Install Trivy
+        if: steps.cache-trivy.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL -o trivy.tar.gz \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          tar -xzf trivy.tar.gz trivy
+          chmod +x trivy
+          mv trivy "$HOME/.local/bin/trivy"
+          rm -f trivy.tar.gz
+
+      - name: Ermittle Cache-Datum für Trivy-DB
+        run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV"
+
+      - name: Cache Trivy-Schwachstellen-Datenbank
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/trivy
+          key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }}
+          restore-keys: |
+            trivy-db-${{ runner.os }}-
+
+      - name: Run Trivy Scanner
+        run: |
+          trivy fs \
+            --scanners vuln,secret,misconfig \
+            --severity CRITICAL,HIGH \
+            --format json \
+            --output trivy-results.json \
+            --exit-code 0 \
+            .
+
+      - name: Cache OSV-Scanner-Binary
+        id: cache-osv-scanner
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/osv-scanner
+          key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }}
+
+      - name: Install OSV-Scanner
+        if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
+            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
+          chmod +x "$HOME/.local/bin/osv-scanner"
+
+      - name: Run OSV-Scanner
+        run: |
+          set +e
+          osv-scanner scan source --recursive --format json --output-file osv-results.json .
+          echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+        run: |
+          python3 scripts/report-security-issue.py trivy-results.json osv-results.json

.gitea/workflows/testing.yaml

@@ -9,6 +9,10 @@ jobs:
   build-and-publish:
     name: Build, Publish Packages (Testing) & Create Preview Release
     runs-on: ubuntu-latest
+    env:
+      CARGO_BINSTALL_VERSION: "1.23.0"
+      CARGO_DEB_VERSION: "3.8.0"
+      CARGO_GENERATE_RPM_VERSION: "0.21.0"
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7
@@ -19,18 +23,58 @@ jobs:
           toolchain: stable
           cache: false
 
-      - name: Install Cross-Compilation Toolchains & Dependencies
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Alte Paketierungs-Ausgaben aus dem Cache entfernen
+        run: rm -rf target/debian target/generate-rpm target/arch
+
+      - name: Install Cross-Compilation Toolchains (apt)
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu gcc-i686-linux-gnu
-          rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu i686-unknown-linux-gnu
 
-      - name: Install Packaging Tools (Prebuilt Binaries)
+      - name: Ermittle Rust-Version für Rustup-Target-Cache-Key
+        run: echo "RUST_VERSION=$(rustc --version | awk '{print $2}')" >> "$GITHUB_ENV"
+
+      - name: Cache Rustup Cross-Compilation-Targets
+        id: cache-rustup-targets
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/aarch64-unknown-linux-gnu
+            ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/i686-unknown-linux-gnu
+          key: rustup-targets-${{ runner.os }}-${{ env.RUST_VERSION }}
+
+      - name: Add Rust Cross-Compilation Targets
+        if: steps.cache-rustup-targets.outputs.cache-hit != 'true'
+        run: rustup target add aarch64-unknown-linux-gnu i686-unknown-linux-gnu
+
+      - name: PATH um Cargo-bin-Verzeichnis ergänzen
         run: |
           mkdir -p ~/.cargo/bin
-          curl -fsSL https://github.com/cargo-bins/cargo-binstall/releases/latest/download/cargo-binstall-x86_64-unknown-linux-musl.tgz | tar -xz -C ~/.cargo/bin
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-          ~/.cargo/bin/cargo-binstall -y --no-symlinks cargo-deb cargo-generate-rpm
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cache Packaging-Tools (cargo-binstall, cargo-deb, cargo-generate-rpm)
+        id: cache-packaging-tools
+        uses: actions/cache@v6
+        with:
+          path: ~/.cargo/bin
+          key: packaging-tools-${{ runner.os }}-${{ env.CARGO_BINSTALL_VERSION }}-${{ env.CARGO_DEB_VERSION }}-${{ env.CARGO_GENERATE_RPM_VERSION }}
+
+      - name: Install Packaging Tools (Prebuilt Binaries)
+        if: steps.cache-packaging-tools.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL "https://github.com/cargo-bins/cargo-binstall/releases/download/v${CARGO_BINSTALL_VERSION}/cargo-binstall-x86_64-unknown-linux-musl.tgz" | tar -xz -C ~/.cargo/bin
+          ~/.cargo/bin/cargo-binstall -y --no-symlinks "cargo-deb@${CARGO_DEB_VERSION}" "cargo-generate-rpm@${CARGO_GENERATE_RPM_VERSION}"
 
       - name: Run Tests
         run: |

.gitea/workflows/trufflehog-scan.yaml

@@ -0,0 +1,59 @@
+name: TruffleHog Secret Scan
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+jobs:
+  trufflehog-scan:
+    name: TruffleHog
+    runs-on: ubuntu-latest
+    env:
+      TRUFFLEHOG_VERSION: "3.97.4"
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Lokales bin-Verzeichnis zum PATH hinzufügen
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Cache TruffleHog-Binary
+        id: cache-trufflehog
+        uses: actions/cache@v6
+        with:
+          path: ~/.local/bin/trufflehog
+          key: trufflehog-bin-${{ runner.os }}-${{ env.TRUFFLEHOG_VERSION }}
+
+      - name: Install TruffleHog
+        if: steps.cache-trufflehog.outputs.cache-hit != 'true'
+        run: |
+          curl -fsSL -o trufflehog.tar.gz \
+            "https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}/trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz"
+          tar -xzf trufflehog.tar.gz trufflehog
+          chmod +x trufflehog
+          mv trufflehog "$HOME/.local/bin/trufflehog"
+          rm trufflehog.tar.gz
+
+      - name: Run TruffleHog Scanner
+        run: |
+          set +e
+          trufflehog git file://. --results=verified,unknown --fail --json > trufflehog-results.json
+          echo "TRUFFLEHOG_EXIT=$?" >> "$GITHUB_ENV"
+
+      - name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
+        env:
+          GITEA_URL: ${{ gitea.server_url || github.server_url }}
+          REPO: ${{ gitea.repository || github.repository }}
+          TOKEN: ${{ secrets.SECURITY_TOKEN }}
+          RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
+          ISSUE_TITLE: "Security-Scan: TruffleHog Secrets"
+          ISSUE_LABEL: "security-scan-trufflehog"
+        run: |
+          python3 scripts/report-security-issue.py "" "" trufflehog-results.json

.gitea/workflows/unit-tests.yaml

@@ -0,0 +1,38 @@
+name: Unit-Tests
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - testing
+
+jobs:
+  test:
+    name: Unit-Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      - name: Install Rust Toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          cache: false
+
+      - name: Cache Cargo-Abhängigkeiten & Build-Artefakte
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Run Tests
+        run: cargo test

.gitignore

@@ -109,3 +109,4 @@ fabric.properties
 # Built Visual Studio Code Extensions
 *.vsix
 
+.junie/plans

.idea/jsonSchemas.xml

@@ -17,6 +17,15 @@
                   <Item>
                     <option name="path" value=".gitea/workflows/testing.yaml" />
                   </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/renovate.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/security-scan.yaml" />
+                  </Item>
+                  <Item>
+                    <option name="path" value=".gitea/workflows/trufflehog-scan.yaml" />
+                  </Item>
                 </list>
               </option>
             </SchemaInfo>

.idea/runConfigurations/Run.xml

@@ -0,0 +1,20 @@
+<component name="ProjectRunConfigurationManager">
+  <configuration default="false" name="Run" type="CargoCommandRunConfiguration" factoryName="Cargo Command" nameIsGenerated="true">
+    <option name="buildProfileId" value="dev" />
+    <option name="command" value="run" />
+    <option name="workingDirectory" value="file://$PROJECT_DIR$" />
+    <envs />
+    <option name="emulateTerminal" value="true" />
+    <option name="channel" value="DEFAULT" />
+    <option name="requiredFeatures" value="true" />
+    <option name="allFeatures" value="false" />
+    <option name="withSudo" value="false" />
+    <option name="buildTarget" value="REMOTE" />
+    <option name="backtrace" value="SHORT" />
+    <option name="isRedirectInput" value="false" />
+    <option name="redirectInputPath" value="" />
+    <method v="2">
+      <option name="CARGO.BUILD_TASK_PROVIDER" enabled="true" />
+    </method>
+  </configuration>
+</component>

.idea/rust-template.iml

@@ -4,6 +4,7 @@
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" />
       <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" />
+      <excludeFolder url="file://$MODULE_DIR$/.junie/plans" />
       <excludeFolder url="file://$MODULE_DIR$/target" />
     </content>
     <orderEntry type="inheritedJdk" />

Cargo.lock

@@ -866,7 +866,7 @@ dependencies = [
 
 [[package]]
 name = "mirror-package"
-version = "1.0.0"
+version = "1.0.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -874,7 +874,6 @@ dependencies = [
  "logger-ctdra",
  "reqwest",
  "serde",
- "serde_json",
  "tokio",
 ]
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mirror-package"
-version = "1.0.0"
+version = "1.0.3"
 edition = "2024"
 authors = ['DragonSlayer_14']
 readme = "README.md"
@@ -15,7 +15,6 @@ clap = { version = "4.6.6", features = ["derive", "env"] }
 reqwest = { version = "0.13.4", features = ["json", "stream"] }
 tokio = { version = "1.53.1", features = ["full"] }
 serde = { version = "1.0.229", features = ["derive"] }
-serde_json = "1.0.151"
 anyhow = "1.0.104"
 
 [profile.release]

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # Minimales und gehärtetes Runtime-Image
-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime
 
 # CA-Zertifikate und minimale dynamische Laufzeitbibliotheken installieren
 RUN apt-get update && \

README.md

@@ -1,3 +1,6 @@
+[![Main Release & Publish](https://gitea.creative-dragonslayer.de/Linuxapps/MirrorPackage/actions/workflows/main.yaml/badge.svg?branch=main)](https://gitea.creative-dragonslayer.de/Linuxapps/MirrorPackage/actions?workflow=main.yaml)
+[![Testing Build, Publish & Preview Release](https://gitea.creative-dragonslayer.de/Linuxapps/MirrorPackage/actions/workflows/testing.yaml/badge.svg?branch=testing)](https://gitea.creative-dragonslayer.de/Linuxapps/MirrorPackage/actions?workflow=testing.yaml)
+
 # mirror-package
 
 Automatisiertes Werkzeug zum Extrahieren, Herunterladen und Spiegeln vorkompilierter Linux-Pakete aus GitHub-Releases in eine selbstgehostete Gitea- / Forgejo-Paket-Registry.
@@ -120,7 +123,7 @@ Der Container wurde nach höchsten Sicherheitsstandards aufgebaut:
 - **Read-Only Root-Dateisystem**: Voll funktionsfähig mit `--read-only` / `read_only: true`.
 - **Keine Capabilities**: Sämtliche Linux-Capabilities können sicher entzogen werden (`--cap-drop=ALL`).
 - **Keine Rechteausweitung**: Erzwingt `no-new-privileges:true`.
-- **Minimale Image-Größe**: Basiert auf Debian Bookworm Slim und enthält nur CA-Zertifikate und notwendige dynamische Bibliotheken (~40 MB).
+- **Minimale Image-Größe**: Basiert auf Debian Trixie Slim und enthält nur CA-Zertifikate und notwendige dynamische Bibliotheken (~40 MB).
 
 ### 4. Ausführung über Docker CLI
 

qodana.yaml

@@ -0,0 +1,50 @@
+#-------------------------------------------------------------------------------#
+#               Qodana analysis is configured by qodana.yaml file               #
+#             https://www.jetbrains.com/help/qodana/qodana-yaml.html            #
+#-------------------------------------------------------------------------------#
+
+#################################################################################
+#              WARNING: Do not store sensitive information in this file,        #
+#               as its contents will be included in the Qodana report.          #
+#################################################################################
+version: "1.0"
+
+#Specify inspection profile for code analysis
+profile:
+  name: qodana.starter
+
+#Enable inspections
+#include:
+#  - name: <SomeEnabledInspectionId>
+
+#Disable inspections
+#exclude:
+#  - name: <SomeDisabledInspectionId>
+#    paths:
+#      - <path/where/not/run/inspection>
+
+#Execute shell command before Qodana execution (Applied in CI/CD pipeline)
+#bootstrap: sh ./prepare-qodana.sh
+
+#Install IDE plugins before Qodana execution (Applied in CI/CD pipeline)
+#plugins:
+#  - id: <plugin.id> #(plugin id can be found at https://plugins.jetbrains.com)
+
+# Quality gate. Will fail the CI/CD pipeline if any condition is not met
+# severityThresholds - configures maximum thresholds for different problem severities
+# testCoverageThresholds - configures minimum code coverage on a whole project and newly added code
+# dependencyLicenses - fails the run on prohibited or unknown dependency licenses
+# Code Coverage is available in Ultimate and Ultimate Plus plans
+#failureConditions:
+#  severityThresholds:
+#    any: 15
+#    critical: 5
+#  testCoverageThresholds:
+#    fresh: 70
+#    total: 50
+#  dependencyLicenses:
+#    failOnProhibited: true
+#    failOnUnknown: false
+
+#Specify Qodana linter for analysis (Applied in CI/CD pipeline)
+linter: jetbrains/qodana-<linter>:2026.2

renovate.json

@@ -0,0 +1,87 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Berlin",
+  "schedule": ["before 6am on monday"],
+  "baseBranches": ["dev"],
+  "packageRules": [
+    {
+      "matchFileNames": [".gitea/workflows/**"],
+      "groupName": "Gitea Actions",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "matchManagers": ["cargo"],
+      "groupName": "Cargo Dependencies",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    },
+    {
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "Docker-Images",
+      "separateMajorMinor": false,
+      "separateMinorPatch": false
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRIVY_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "aquasecurity/trivy",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "OSV_SCANNER_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "google/osv-scanner",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "TRUFFLEHOG_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "trufflesecurity/trufflehog",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "CARGO_BINSTALL_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-bins/cargo-binstall",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "CARGO_DEB_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-deb",
+      "datasourceTemplate": "crate"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["^\\.gitea/workflows/.+\\.ya?ml$"],
+      "matchStrings": [
+        "CARGO_GENERATE_RPM_VERSION:\\s*\"(?<currentValue>[^\"]+)\""
+      ],
+      "depNameTemplate": "cargo-generate-rpm",
+      "datasourceTemplate": "crate"
+    }
+  ]
+}

scripts/get-build-number.py

@@ -9,9 +9,14 @@ import os
 import re
 import subprocess
 import sys
+import urllib.error
 import urllib.parse
 import urllib.request
 
+# Paket-Typen, unter denen dasselbe Release veroeffentlicht wird und die sich
+# daher eine gemeinsame Build-Nummer teilen muessen.
+PACKAGE_TYPES = ("debian", "rpm", "arch")
+
 
 def get_cargo_pkg_info():
     try:
@@ -83,20 +88,29 @@ def query_existing_build_numbers(name, version, gitea_url, repo, owner, token=No
         except Exception as e:
             sys.stderr.write(f"[Hinweis] Konnte Gitea Releases nicht abfragen: {e}\n")
 
-    # 2. Gitea Packages API (falls Token vorhanden)
-    if gitea_url and owner and token:
-        try:
-            url = f"{gitea_url.rstrip('/')}/api/v1/packages/{owner}?limit=50"
-            req = urllib.request.Request(url, headers=headers)
-            with urllib.request.urlopen(req, timeout=10) as resp:
-                packages = json.loads(resp.read().decode())
-                for pkg in packages:
+    # 2. Gitea Packages API (falls Token vorhanden): pro Paket-Typ gezielt nur die
+    #    neueste Version abfragen (ein Request, keine Pagination noetig). Das haelt
+    #    die Abfrage schnell unabhaengig von der Historie und ist unbeeinflusst von
+    #    Docker-Tags/anderen Paket-Typen, die unter demselben Owner haengen.
+    if gitea_url and owner and token and name:
+        for pkg_type in PACKAGE_TYPES:
+            try:
+                url = (
+                    f"{gitea_url.rstrip('/')}/api/v1/packages/{owner}/"
+                    f"{pkg_type}/{urllib.parse.quote(name, safe='')}/-/latest"
+                )
+                req = urllib.request.Request(url, headers=headers)
+                with urllib.request.urlopen(req, timeout=10) as resp:
+                    pkg = json.loads(resp.read().decode())
                     pkg_ver = pkg.get("version", "")
                     m = pattern.search(pkg_ver)
                     if m:
                         build_nums.add(int(m.group(1)))
-        except Exception as e:
-            sys.stderr.write(f"[Hinweis] Konnte Gitea Packages nicht abfragen: {e}\n")
+            except urllib.error.HTTPError as e:
+                if e.code != 404:
+                    sys.stderr.write(f"[Hinweis] Konnte neueste {pkg_type}-Paketversion nicht abfragen: {e}\n")
+            except Exception as e:
+                sys.stderr.write(f"[Hinweis] Konnte neueste {pkg_type}-Paketversion nicht abfragen: {e}\n")
 
     # 3. Lokales Target-Verzeichnis prüfen
     target_dirs = ["target/debian", "target/generate-rpm", "target/arch"]

scripts/report-security-issue.py

@@ -0,0 +1,308 @@
+#!/usr/bin/env python3
+"""Erstellt oder kommentiert ein Gitea-Issue mit den Ergebnissen der Security-Scans.
+
+Sucht ein offenes Issue mit dem Label ISSUE_LABEL (Standard: "security-scan").
+Existiert eines, wird der aktuelle Scan-Stand als neuer Kommentar angehängt
+(die Historie bleibt erhalten). Existiert keines (z.B. weil das letzte
+geschlossen wurde), wird ein neues Issue erstellt. Gibt es keine Funde mehr,
+wird ein offenes Issue nur kommentiert, nicht geschlossen.
+
+Titel und Label lassen sich per Umgebungsvariable ISSUE_TITLE / ISSUE_LABEL
+überschreiben, damit z.B. TruffleHog-Funde in ein eigenes Issue laufen statt
+in das gemeinsame Trivy/OSV-Issue.
+"""
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+LABEL_NAME = os.environ.get("ISSUE_LABEL", "security-scan")
+LABEL_COLOR = "#b60205"
+ISSUE_TITLE = os.environ.get("ISSUE_TITLE", "Security-Scan: Offene Schwachstellen")
+
+SEVERITY_ORDER = {
+    "VERIFIED": -1,
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "UNKNOWN": 4,
+    "UNVERIFIED": 6,
+}
+
+
+def api(method, path, token, gitea_url, data=None):
+    url = f"{gitea_url}/api/v1{path}"
+    body = json.dumps(data).encode() if data is not None else None
+    req = urllib.request.Request(url, data=body, method=method)
+    req.add_header("Authorization", f"token {token}")
+    req.add_header("Content-Type", "application/json")
+    try:
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            raw = resp.read()
+            return json.loads(raw) if raw else None
+    except urllib.error.HTTPError as e:
+        print(f"Gitea API Fehler ({method} {path}): {e.code} {e.read().decode()}", file=sys.stderr)
+        raise
+
+
+def make_finding(source, id, severity, package, installed="-", fixed="-", target="-"):
+    return {
+        "source": source,
+        "id": id,
+        "severity": severity,
+        "package": package,
+        "installed": installed,
+        "fixed": fixed,
+        "target": target,
+    }
+
+
+def cvss_score_to_severity(score):
+    try:
+        score = float(score)
+    except (TypeError, ValueError):
+        return "UNKNOWN"
+    if score >= 9.0:
+        return "CRITICAL"
+    if score >= 7.0:
+        return "HIGH"
+    if score >= 4.0:
+        return "MEDIUM"
+    if score > 0.0:
+        return "LOW"
+    return "UNKNOWN"
+
+
+def load_trivy(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("Results", []) or []:
+        target = result.get("Target", "?")
+        for vuln in result.get("Vulnerabilities", []) or []:
+            findings.append(make_finding(
+                "Trivy",
+                vuln.get("VulnerabilityID", "?"),
+                vuln.get("Severity", "UNKNOWN"),
+                vuln.get("PkgName", "?"),
+                installed=vuln.get("InstalledVersion", "?"),
+                fixed=vuln.get("FixedVersion") or "-",
+                target=target,
+            ))
+        for misc in result.get("Misconfigurations", []) or []:
+            findings.append(make_finding(
+                "Trivy (Misconfig)",
+                misc.get("ID", "?"),
+                misc.get("Severity", "UNKNOWN"),
+                misc.get("Title", "?"),
+                target=target,
+            ))
+        for secret in result.get("Secrets", []) or []:
+            findings.append(make_finding(
+                "Trivy (Secret)",
+                secret.get("RuleID", "?"),
+                secret.get("Severity", "UNKNOWN"),
+                secret.get("Title", "?"),
+                target=target,
+            ))
+    return findings
+
+
+def load_osv(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        data = json.load(f)
+    for result in data.get("results", []) or []:
+        source = (result.get("source") or {}).get("path", "?")
+        for pkg in result.get("packages", []) or []:
+            info = pkg.get("package", {})
+            pkg_name = f"{info.get('name', '?')} ({info.get('ecosystem', '?')})"
+            severity_by_id = {}
+            for group in pkg.get("groups", []) or []:
+                label = cvss_score_to_severity(group.get("max_severity"))
+                for vuln_id in group.get("ids", []) or []:
+                    severity_by_id[vuln_id] = label
+            for vuln in pkg.get("vulnerabilities", []) or []:
+                vuln_id = vuln.get("id", "?")
+                findings.append(make_finding(
+                    "OSV-Scanner",
+                    vuln_id,
+                    severity_by_id.get(vuln_id, "UNKNOWN"),
+                    pkg_name,
+                    installed=info.get("version", "?"),
+                    target=source,
+                ))
+    return findings
+
+
+def load_trufflehog(path):
+    findings = []
+    if not path or not os.path.isfile(path):
+        return findings
+    with open(path) as f:
+        for line in f:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                entry = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            git_meta = ((entry.get("SourceMetadata") or {}).get("Data") or {}).get("Git") or {}
+            findings.append(make_finding(
+                "TruffleHog",
+                entry.get("DetectorName", "?"),
+                "VERIFIED" if entry.get("Verified") else "UNVERIFIED",
+                git_meta.get("file", "?"),
+                target=git_meta.get("commit", "-"),
+            ))
+    return findings
+
+
+def sort_findings(findings):
+    return sorted(findings, key=lambda f: (SEVERITY_ORDER.get(f["severity"], 9), f["id"]))
+
+
+def print_summary(findings):
+    if not findings:
+        print("Keine Funde.")
+        return
+    widths = {
+        key: max(len(key), *(len(str(f[key])) for f in findings))
+        for key in ("source", "id", "severity", "package", "installed", "fixed", "target")
+    }
+    header = ("source", "id", "severity", "package", "installed", "fixed", "target")
+    row_fmt = "  ".join(f"{{:{widths[k]}}}" for k in header)
+    print(row_fmt.format(*header))
+    print(row_fmt.format(*("-" * widths[k] for k in header)))
+    for f in findings:
+        print(row_fmt.format(*(str(f[k]) for k in header)))
+
+
+TRUFFLEHOG_GUIDANCE = """### Vorgehen bei gefundenen Secrets
+
+1. **Sofort rotieren/widerrufen**: Das betroffene Secret (Token, Passwort, Schlüssel) beim jeweiligen Dienst ungültig machen und durch ein neues ersetzen. Ein einmal committetes Secret gilt als kompromittiert, auch wenn es später aus der Historie entfernt wird.
+2. **Ursache beheben**: Neues Secret nur noch über Umgebungsvariablen/Secrets-Store einbinden, nicht erneut hart codieren.
+3. **Historie bereinigen (optional, manuell, erst nach Schritt 1)**: Mit `git filter-repo` oder BFG Repo-Cleaner den Commit-Inhalt entfernen, danach `git push --force` in Absprache mit allen Mitwirkenden – bestehende Clones/Forks werden dadurch ungültig.
+4. **Issue schließen**, sobald rotiert wurde. TruffleHog findet das alte Secret ggf. weiterhin in der Historie – nach der Rotation ist das unkritisch.
+
+> Der Wert des Secrets selbst wird hier bewusst nicht ausgegeben, auch nicht gekürzt – nur Detector, Datei und Commit. Fund lässt sich über "Ziel" (Commit-Hash) und "Paket" (Dateipfad) lokalisieren."""
+
+
+def escape_md_cell(value):
+    return str(value).replace("|", "\\|").replace("\r", " ").replace("\n", " ")
+
+
+def build_report(findings, run_url):
+    lines = [
+        "Automatisch erstellt vom Security-Scan-Workflow.",
+        f"Lauf: {run_url}" if run_url else "",
+        "",
+        "| Quelle | ID | Schweregrad | Paket | Installiert | Fix | Ziel |",
+        "|---|---|---|---|---|---|---|",
+    ]
+    for f in findings:
+        cells = (f["source"], f["id"], f["severity"], f["package"], f["installed"], f["fixed"], f["target"])
+        lines.append("| " + " | ".join(escape_md_cell(c) for c in cells) + " |")
+    if any(f["source"] == "TruffleHog" for f in findings):
+        lines.append("")
+        lines.append(TRUFFLEHOG_GUIDANCE)
+    return "\n".join(lines)
+
+
+def ensure_label(token, gitea_url, repo):
+    page = 1
+    while True:
+        labels = api("GET", f"/repos/{repo}/labels?limit=50&page={page}", token, gitea_url) or []
+        for label in labels:
+            if label.get("name") == LABEL_NAME:
+                return label["id"]
+        if len(labels) < 50:
+            break
+        page += 1
+    created = api("POST", f"/repos/{repo}/labels", token, gitea_url, {
+        "name": LABEL_NAME,
+        "color": LABEL_COLOR,
+        "description": "Automatisch verwaltet vom Security-Scan-Workflow",
+    })
+    return created["id"]
+
+
+def find_open_issue(token, gitea_url, repo):
+    issues = api(
+        "GET",
+        f"/repos/{repo}/issues?state=open&type=issues&labels={LABEL_NAME}",
+        token,
+        gitea_url,
+    ) or []
+    for issue in issues:
+        if issue.get("title") == ISSUE_TITLE:
+            return issue
+    return None
+
+
+def main():
+    trivy_path = sys.argv[1] if len(sys.argv) > 1 else None
+    osv_path = sys.argv[2] if len(sys.argv) > 2 else None
+    trufflehog_path = sys.argv[3] if len(sys.argv) > 3 else None
+
+    gitea_url = os.environ["GITEA_URL"].rstrip("/")
+    repo = os.environ["REPO"]
+    token = os.environ["TOKEN"]
+    run_url = os.environ.get("RUN_URL", "")
+    osv_exit = int(os.environ.get("OSV_EXIT", "0"))
+    trufflehog_exit = int(os.environ.get("TRUFFLEHOG_EXIT", "0"))
+
+    findings = sort_findings(load_trivy(trivy_path) + load_osv(osv_path) + load_trufflehog(trufflehog_path))
+    print_summary(findings)
+
+    open_issue = find_open_issue(token, gitea_url, repo)
+
+    if findings:
+        report = build_report(findings, run_url)
+        if open_issue:
+            print(f"Kommentiere bestehendes Issue #{open_issue['number']} mit {len(findings)} Fund(en).")
+            api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {"body": report})
+        else:
+            label_id = ensure_label(token, gitea_url, repo)
+            print(f"Erstelle neues Issue mit {len(findings)} Fund(en).")
+            api("POST", f"/repos/{repo}/issues", token, gitea_url, {
+                "title": ISSUE_TITLE,
+                "body": report,
+                "labels": [label_id],
+            })
+    elif open_issue:
+        print(f"Keine aktuellen Funde mehr. Kommentiere Issue #{open_issue['number']}.")
+        api("POST", f"/repos/{repo}/issues/{open_issue['number']}/comments", token, gitea_url, {
+            "body": f"Aktueller Scan hat keine offenen Schwachstellen mehr gefunden.\n\n{run_url}".strip(),
+        })
+    else:
+        print("Keine Funde und kein offenes Issue vorhanden.")
+
+    osv_ok_exits = {0, 1}
+    trufflehog_ok_exits = {0, 183}
+    if osv_exit not in osv_ok_exits:
+        print(f"WARNUNG: osv-scanner beendete sich mit unerwartetem Exit-Code {osv_exit} - Scan evtl. unvollständig.", file=sys.stderr)
+    if trufflehog_exit not in trufflehog_ok_exits:
+        print(f"WARNUNG: trufflehog beendete sich mit unerwartetem Exit-Code {trufflehog_exit} - Scan evtl. unvollständig.", file=sys.stderr)
+
+    has_trivy_findings = any(f["source"].startswith("Trivy") for f in findings)
+    if (
+        has_trivy_findings
+        or osv_exit == 1
+        or trufflehog_exit == 183
+        or osv_exit not in osv_ok_exits
+        or trufflehog_exit not in trufflehog_ok_exits
+    ):
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

src/config.rs

@@ -1,3 +1,4 @@
+use crate::utils::{clean_repo_input, sanitize_string};
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 
@@ -21,7 +22,7 @@ pub struct RepoConfig {
 impl RepoConfig {
     pub fn new(name: impl Into<String>, include_prereleases: bool) -> Self {
         Self {
-            name: name.into(),
+            name: AppConfig::normalize_repo_name(&name.into()),
             include_prereleases,
             last_synced_tag: None,
         }
@@ -49,21 +50,17 @@ pub struct AppConfig {
 }
 
 impl AppConfig {
-    /// Normalisiert die Repository-Eingabe, indem führende/nachgestellte Schrägstriche und GitHub-URL-Präfixe entfernt werden.
+    /// Normalisiert die Repository-Eingabe, indem führende/nachgestellte Schrägstriche,
+    /// Query-Parameter, Fragmente und GitHub-URL-Präfixe entfernt werden.
     pub fn normalize_repo_name(input: &str) -> String {
-        let trimmed = input.trim();
-        let cleaned = trimmed
-            .trim_start_matches("https://github.com/")
-            .trim_start_matches("http://github.com/")
-            .trim_start_matches("github.com/")
-            .trim_end_matches(".git")
-            .trim_matches('/');
-        cleaned.to_string()
+        clean_repo_input(input).to_string()
     }
 
     /// Fügt ein Repository zur Konfiguration hinzu oder aktualisiert ein bestehendes.
-    pub fn add_or_update_repo(&mut self, repo: RepoConfig) {
-        if let Some(existing) = self.repositories.iter_mut().find(|r| r.name.eq_ignore_ascii_case(&repo.name)) {
+    pub fn add_or_update_repo(&mut self, mut repo: RepoConfig) {
+        repo.name = Self::normalize_repo_name(&repo.name);
+        if let Some(existing) = self.repositories.iter_mut().find(|r| Self::normalize_repo_name(&r.name).eq_ignore_ascii_case(&repo.name)) {
+            existing.name = repo.name;
             existing.include_prereleases = repo.include_prereleases;
         } else {
             self.repositories.push(repo);
@@ -74,20 +71,20 @@ impl AppConfig {
     pub fn remove_repo(&mut self, repo_name: &str) -> bool {
         let normalized = Self::normalize_repo_name(repo_name);
         let before_len = self.repositories.len();
-        self.repositories.retain(|r| !r.name.eq_ignore_ascii_case(&normalized));
+        self.repositories.retain(|r| !Self::normalize_repo_name(&r.name).eq_ignore_ascii_case(&normalized));
         self.repositories.len() < before_len
     }
 
     /// Sucht ein Repository anhand des Namens.
     pub fn find_repo(&self, repo_name: &str) -> Option<&RepoConfig> {
         let normalized = Self::normalize_repo_name(repo_name);
-        self.repositories.iter().find(|r| r.name.eq_ignore_ascii_case(&normalized))
+        self.repositories.iter().find(|r| Self::normalize_repo_name(&r.name).eq_ignore_ascii_case(&normalized))
     }
 
     /// Aktualisiert den zuletzt synchronisierten Tag für ein bestimmtes Repository.
     pub fn update_last_synced_tag(&mut self, repo_name: &str, tag: String) {
         let normalized = Self::normalize_repo_name(repo_name);
-        if let Some(repo) = self.repositories.iter_mut().find(|r| r.name.eq_ignore_ascii_case(&normalized)) {
+        if let Some(repo) = self.repositories.iter_mut().find(|r| Self::normalize_repo_name(&r.name).eq_ignore_ascii_case(&normalized)) {
             repo.last_synced_tag = Some(tag);
         }
     }
@@ -108,7 +105,38 @@ pub fn get_config_file_path() -> PathBuf {
 
 /// Lädt die Anwendungskonfiguration. Verwendet Standardwerte, falls keine Datei vorhanden ist.
 pub fn load_config() -> AppConfig {
-    config_ctdra::load_config::<AppConfig>()
+    let mut config = config_ctdra::load_config::<AppConfig>();
+
+    for repo in &mut config.repositories {
+        repo.name = AppConfig::normalize_repo_name(&repo.name);
+    }
+
+    if let Ok(val) = std::env::var("GITEA_URL") {
+        let val = sanitize_string(&val);
+        if !val.is_empty() {
+            config.gitea_url = Some(val);
+        }
+    }
+    if let Ok(val) = std::env::var("GITEA_TOKEN") {
+        let val = sanitize_string(&val);
+        if !val.is_empty() {
+            config.gitea_token = Some(val);
+        }
+    }
+    if let Ok(val) = std::env::var("REGISTRY_OWNER") {
+        let val = sanitize_string(&val);
+        if !val.is_empty() {
+            config.registry_owner = Some(val);
+        }
+    }
+    if let Ok(val) = std::env::var("GITHUB_TOKEN") {
+        let val = sanitize_string(&val);
+        if !val.is_empty() {
+            config.github_token = Some(val);
+        }
+    }
+
+    config
 }
 
 /// Speichert die Anwendungskonfiguration auf der Festplatte.

src/github.rs

@@ -1,4 +1,4 @@
-use anyhow::{bail, Context, Result};
+use anyhow::{Context, Result, bail};
 use serde::{Deserialize, Serialize};
 
 /// Unterstützte Linux-Paketverteilungstypen.
@@ -87,6 +87,7 @@ pub struct GitHubClient {
 impl GitHubClient {
     /// Erstellt einen neuen GitHub-API-Client mit optionalem Authentifizierungstoken.
     pub fn new(token: Option<String>) -> Result<Self> {
+        let token = token.filter(|t| !t.trim().is_empty());
         let mut headers = reqwest::header::HeaderMap::new();
         headers.insert(
             reqwest::header::USER_AGENT,
@@ -105,6 +106,12 @@ impl GitHubClient {
         Ok(Self { client, token })
     }
 
+    /// Gibt das optionale Authentifizierungstoken zurück (falls gesetzt).
+    pub fn token(&self) -> Option<&str> {
+        self.token.as_deref()
+    }
+
+
     /// Ruft Releases für ein angegebenes Repository ab (Format "owner/repo").
     ///
     /// Wenn `history` false ist, werden nur die neuesten Releases abgerufen.
@@ -239,13 +246,7 @@ impl GitHubClient {
 
 /// Hilfsfunktion zum Parsen von "owner/repo" aus einer Repository-Zeichenkette.
 pub fn parse_repo_owner_name(repo: &str) -> Result<(&str, &str)> {
-    let cleaned = repo
-        .trim()
-        .trim_start_matches("https://github.com/")
-        .trim_start_matches("http://github.com/")
-        .trim_start_matches("github.com/")
-        .trim_end_matches(".git")
-        .trim_matches('/');
+    let cleaned = crate::utils::clean_repo_input(repo);
 
     let parts: Vec<&str> = cleaned.split('/').collect();
     if parts.len() != 2 || parts[0].is_empty() || parts[1].is_empty() {

src/lib.rs

@@ -6,3 +6,4 @@ pub mod config;
 pub mod gitea;
 pub mod github;
 pub mod pipeline;
+pub mod utils;

src/utils.rs

@@ -0,0 +1,64 @@
+
+/// Sanitizes a string by removing surrounding quotes (single or double).
+///
+/// # Arguments
+///
+/// * `input` - The string to sanitize.
+///
+/// # Returns
+///
+/// The sanitized string with surrounding quotes removed.
+pub fn sanitize_string(input: &str) -> String {
+    let trimmed = input.trim();
+    if let Some(stripped) = trimmed.strip_prefix('"').and_then(|s| s.strip_suffix('"')) {
+        stripped.to_string()
+    } else if let Some(stripped) = trimmed.strip_prefix('\'').and_then(|s| s.strip_suffix('\'')) {
+        stripped.to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+/// Sanitizes environment variables by removing surrounding quotes.
+///
+/// # Arguments
+///
+/// * `env_vars` - A reference to a mutable map of environment variables.
+pub fn sanitize_env_vars(env_vars: &mut std::collections::HashMap<String, String>) {
+    for (_key, value) in env_vars.iter_mut() {
+        *value = sanitize_string(value);
+    }
+}
+
+/// Bereinigt eine Repository-Eingabe (URL oder Kurzform), indem Query-Parameter, Fragmente,
+/// URL-Schemata/Hosts (`github.com`, `www.github.com`, `git@github.com:`), `.git`-Endungen
+/// und umgebende Schrägstriche entfernt werden.
+pub fn clean_repo_input(input: &str) -> &str {
+    let mut trimmed = input.trim();
+    if (trimmed.starts_with('"') && trimmed.ends_with('"'))
+        || (trimmed.starts_with('\'') && trimmed.ends_with('\''))
+    {
+        if trimmed.len() >= 2 {
+            trimmed = trimmed[1..trimmed.len() - 1].trim();
+        }
+    }
+
+    let without_query_or_fragment = match trimmed.find(|c| c == '?' || c == '#') {
+        Some(idx) => &trimmed[..idx],
+        None => trimmed,
+    };
+
+    let mut cleaned = without_query_or_fragment
+        .trim_start_matches("git@github.com:")
+        .trim_start_matches("https://")
+        .trim_start_matches("http://")
+        .trim_start_matches("www.github.com/")
+        .trim_start_matches("github.com/")
+        .trim_matches('/');
+
+    if let Some(stripped) = cleaned.strip_suffix(".git") {
+        cleaned = stripped.trim_matches('/');
+    }
+
+    cleaned
+}

tests/config_tests.rs

@@ -1,53 +1,163 @@
-use mirror_package::config::{AppConfig, RepoConfig};
+use mirror_package::config::{AppConfig, RepoConfig, load_config};
+use mirror_package::utils::{clean_repo_input, sanitize_env_vars, sanitize_string};
+use std::collections::HashMap;
+
+#[test]
+fn test_sanitize_env_vars() {
+    let mut env_vars = HashMap::new();
+    env_vars.insert("GITEA_URL".to_string(), "\"https://gitea.example.com\"".to_string());
+    env_vars.insert("GITEA_TOKEN".to_string(), "\"token123\"".to_string());
+    env_vars.insert("REGISTRY_OWNER".to_string(), "\"owner\"".to_string());
+    env_vars.insert("GITHUB_TOKEN".to_string(), "\"github_token123\"".to_string());
+
+    sanitize_env_vars(&mut env_vars);
+
+    assert_eq!(env_vars.get("GITEA_URL").unwrap(), "https://gitea.example.com");
+    assert_eq!(env_vars.get("GITEA_TOKEN").unwrap(), "token123");
+    assert_eq!(env_vars.get("REGISTRY_OWNER").unwrap(), "owner");
+    assert_eq!(env_vars.get("GITHUB_TOKEN").unwrap(), "github_token123");
+}
+
+#[test]
+fn test_load_config_with_env_vars() {
+    // This test relies on environment variables being set externally.
+    // To avoid `unsafe` blocks, we skip setting them programmatically.
+    // In a real test environment, set these variables before running the test:
+    // GITEA_URL="https://gitea.example.com"
+    // GITEA_TOKEN="token123"
+    // REGISTRY_OWNER="owner"
+    // GITHUB_TOKEN="github_token123"
+    let config = load_config();
+
+    // Only assert if the environment variables are set
+    if std::env::var("GITEA_URL").is_ok() {
+        assert_eq!(config.gitea_url, Some("https://gitea.example.com".to_string()));
+        assert_eq!(config.gitea_token, Some("token123".to_string()));
+        assert_eq!(config.registry_owner, Some("owner".to_string()));
+        assert_eq!(config.github_token, Some("github_token123".to_string()));
+    }
+}
+
+#[test]
+fn test_sanitize_string() {
+    assert_eq!(sanitize_string("\"https://gitea.example.com\""), "https://gitea.example.com");
+    assert_eq!(sanitize_string("'https://gitea.example.com'"), "https://gitea.example.com");
+    assert_eq!(sanitize_string("\"token123\""), "token123");
+    assert_eq!(sanitize_string("'token123'"), "token123");
+    assert_eq!(sanitize_string("\"owner\""), "owner");
+    assert_eq!(sanitize_string("'owner'"), "owner");
+    assert_eq!(sanitize_string("\"github_token123\""), "github_token123");
+    assert_eq!(sanitize_string("'github_token123'"), "github_token123");
+    assert_eq!(sanitize_string("no_quotes"), "no_quotes");
+    assert_eq!(sanitize_string("\"single_quote\""), "single_quote");
+    assert_eq!(sanitize_string("'single_quote'"), "single_quote");
+    assert_eq!(sanitize_string("\"escaped_quote\""), "escaped_quote");
+    // Edge cases: single character inputs
+    assert_eq!(sanitize_string("\""), "\"");
+    assert_eq!(sanitize_string("'"), "'");
+    assert_eq!(sanitize_string("a"), "a");
+    // Edge cases: empty quotes and empty strings
+    assert_eq!(sanitize_string("\"\""), "");
+    assert_eq!(sanitize_string("''"), "");
+    assert_eq!(sanitize_string(""), "");
+    assert_eq!(sanitize_string("   "), "");
+    assert_eq!(sanitize_string("  'hello'  "), "hello");
+    assert_eq!(sanitize_string("  \"world\"  "), "world");
+}
+
+#[test]
+fn test_clean_repo_input() {
+    assert_eq!(clean_repo_input("owner/repo"), "owner/repo");
+    assert_eq!(clean_repo_input("https://github.com/owner/repo"), "owner/repo");
+    assert_eq!(clean_repo_input("http://github.com/owner/repo"), "owner/repo");
+    assert_eq!(clean_repo_input("github.com/owner/repo"), "owner/repo");
+    assert_eq!(clean_repo_input("https://github.com/owner/repo.git"), "owner/repo");
+    assert_eq!(clean_repo_input("https://github.com/owner/repo/"), "owner/repo");
+    assert_eq!(
+        clean_repo_input("https://github.com/raspberrypi/rpi-imager?tab=readme-ov-file"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("https://github.com/raspberrypi/rpi-imager/?tab=readme-ov-file"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("https://github.com/raspberrypi/rpi-imager.git?tab=readme-ov-file"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("https://github.com/raspberrypi/rpi-imager#readme"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("https://github.com/raspberrypi/rpi-imager?tab=readme-ov-file#install"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("raspberrypi/rpi-imager?tab=readme-ov-file"),
+        "raspberrypi/rpi-imager"
+    );
+    assert_eq!(
+        clean_repo_input("\"https://github.com/raspberrypi/rpi-imager?tab=readme-ov-file\""),
+        "raspberrypi/rpi-imager"
+    );
+}
 
 #[test]
 fn test_normalize_repo_name() {
+    let input = "https://github.com/owner/repo.git";
+    let normalized = AppConfig::normalize_repo_name(input);
+    assert_eq!(normalized, "owner/repo");
+
+    let input_with_query = "https://github.com/raspberrypi/rpi-imager?tab=readme-ov-file";
     assert_eq!(
-        AppConfig::normalize_repo_name("raspberrypi/rpi-imager"),
+        AppConfig::normalize_repo_name(input_with_query),
         "raspberrypi/rpi-imager"
     );
-    assert_eq!(
-        AppConfig::normalize_repo_name("https://github.com/raspberrypi/rpi-imager"),
-        "raspberrypi/rpi-imager"
-    );
-    assert_eq!(
-        AppConfig::normalize_repo_name("https://github.com/raspberrypi/rpi-imager.git"),
-        "raspberrypi/rpi-imager"
-    );
-    assert_eq!(
-        AppConfig::normalize_repo_name("Heroic-Games-Launcher/HeroicGamesLauncher/"),
-        "Heroic-Games-Launcher/HeroicGamesLauncher"
-    );
 }
 
 #[test]
-fn test_repo_management() {
+fn test_add_or_update_repo() {
     let mut config = AppConfig::default();
-    config.add_or_update_repo(RepoConfig::new("owner/repo1", true));
-    config.add_or_update_repo(RepoConfig::new("owner/repo2", false));
-
-    assert_eq!(config.repositories.len(), 2);
-    assert!(config.find_repo("owner/repo1").is_some());
-    assert!(config.find_repo("https://github.com/owner/repo1").is_some());
-
-    assert!(config.remove_repo("owner/repo1"));
+    let repo = RepoConfig::new("https://github.com/owner/repo?tab=readme-ov-file", true);
+    config.add_or_update_repo(repo.clone());
     assert_eq!(config.repositories.len(), 1);
-    assert!(config.find_repo("owner/repo1").is_none());
+    assert_eq!(config.repositories[0].name, "owner/repo");
+    assert_eq!(config.repositories[0].include_prereleases, true);
+
+    // Updating existing repo with a URL with query param
+    let repo_updated = RepoConfig::new("https://github.com/owner/repo#readme", false);
+    config.add_or_update_repo(repo_updated);
+    assert_eq!(config.repositories.len(), 1);
+    assert_eq!(config.repositories[0].name, "owner/repo");
+    assert_eq!(config.repositories[0].include_prereleases, false);
 }
 
 #[test]
-fn test_serialization_roundtrip() {
-    let mut config = AppConfig {
-        gitea_url: Some("https://gitea.example.com".to_string()),
-        gitea_token: Some("secret_token".to_string()),
-        registry_owner: Some("my-org".to_string()),
-        github_token: Some("gh_pat".to_string()),
-        repositories: Vec::new(),
-    };
-    config.add_or_update_repo(RepoConfig::new("raspberrypi/rpi-imager", true));
-
-    let json_str = serde_json::to_string(&config).unwrap();
-    let deserialized: AppConfig = serde_json::from_str(&json_str).unwrap();
-
-    assert_eq!(config, deserialized);
+fn test_remove_repo() {
+    let mut config = AppConfig::default();
+    let repo = RepoConfig::new("owner/repo", true);
+    config.add_or_update_repo(repo.clone());
+    assert!(config.remove_repo("https://github.com/owner/repo?tab=readme-ov-file"));
+    assert!(config.repositories.is_empty());
 }
+
+#[test]
+fn test_find_repo() {
+    let mut config = AppConfig::default();
+    let repo = RepoConfig::new("owner/repo", true);
+    config.add_or_update_repo(repo.clone());
+    assert_eq!(
+        config.find_repo("https://github.com/owner/repo?tab=readme-ov-file"),
+        Some(&RepoConfig::new("owner/repo", true))
+    );
+}
+
+#[test]
+fn test_update_last_synced_tag() {
+    let mut config = AppConfig::default();
+    let repo = RepoConfig::new("owner/repo", true);
+    config.add_or_update_repo(repo.clone());
+    config.update_last_synced_tag("owner/repo", "v1.0.0".to_string());
+    assert_eq!(config.find_repo("owner/repo").unwrap().last_synced_tag, Some("v1.0.0".to_string()));
+}

tests/github_tests.rs

@@ -1,4 +1,4 @@
-use mirror_package::github::{parse_repo_owner_name, PackageType};
+use mirror_package::github::{PackageType, parse_repo_owner_name};
 
 #[test]
 fn test_package_classification() {
@@ -64,7 +64,39 @@ fn test_parse_repo_owner_name() {
         parse_repo_owner_name("https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher.git").unwrap(),
         ("Heroic-Games-Launcher", "HeroicGamesLauncher")
     );
+    assert_eq!(
+        parse_repo_owner_name("https://github.com/raspberrypi/rpi-imager?tab=readme-ov-file").unwrap(),
+        ("raspberrypi", "rpi-imager")
+    );
+    assert_eq!(
+        parse_repo_owner_name("https://github.com/raspberrypi/rpi-imager/?tab=readme-ov-file#install").unwrap(),
+        ("raspberrypi", "rpi-imager")
+    );
+    assert_eq!(
+        parse_repo_owner_name("raspberrypi/rpi-imager?tab=readme-ov-file").unwrap(),
+        ("raspberrypi", "rpi-imager")
+    );
 
     assert!(parse_repo_owner_name("invalid_repo").is_err());
     assert!(parse_repo_owner_name("invalid/repo/extra").is_err());
 }
+
+#[tokio::test]
+async fn test_github_client_empty_token() {
+    use mirror_package::github::GitHubClient;
+
+    // Test that a client with an empty or whitespace token sanitizes it to None
+    let client = GitHubClient::new(Some("".to_string())).expect("Failed to create client with empty token");
+    assert_eq!(client.token(), None);
+
+    let client_whitespace = GitHubClient::new(Some("   ".to_string())).expect("Failed to create client with whitespace token");
+    assert_eq!(client_whitespace.token(), None);
+
+    // Test with a valid token
+    let client_with_token = GitHubClient::new(Some("valid_token".to_string())).expect("Failed to create client with valid token");
+    assert_eq!(client_with_token.token(), Some("valid_token"));
+
+    // Test with no token
+    let client_no_token = GitHubClient::new(None).expect("Failed to create client with no token");
+    assert_eq!(client_no_token.token(), None);
+}