ci: add on-release workflow to trigger docs-release, update bug-report-template and update security-policy (#3881)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -31,6 +31,8 @@ body:
       label: Version
       description: What version of Homarr are you running?
       options:
+        # The below comment is used to insert a new version with on-release.yml
+        #NEXT_VERSION#
         - 1.33.0
         - 1.32.0
         - 1.31.0

.github/workflows/on-release.yml

@@ -0,0 +1,82 @@
+permissions: {}
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  trigger-docs-release:
+    name: Trigger Documentation Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain token
+        id: obtainToken
+        uses: tibdex/github-app-token@v2
+        with:
+          private_key: ${{ secrets.HOMARR_DOCS_RELEASE_APP_PRIVATE_KEY }}
+          app_id: ${{ vars.HOMARR_DOCS_RELEASE_APP_ID }}
+          installation_retrieval_mode: repository
+          installation_retrieval_payload: homarr-labs/documentation
+      - name: Trigger documentation release
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+          SOURCE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          curl -X POST \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            https://api.github.com/repos/homarr-labs/documentation/dispatches \
+            -d @- <<EOF
+          {
+            "event_type": "trigger-release",
+            "client_payload": {
+              "tag": "${SOURCE_TAG}"
+            }
+          }
+          EOF
+  update-bug-report-template:
+    name: Update Bug Report Template
+    runs-on: ubuntu-latest
+    steps:
+      - name: Obtain token
+        id: obtainToken
+        uses: tibdex/github-app-token@v2
+        with:
+          private_key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          app_id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          token: ${{ steps.obtainToken.outputs.token }}
+      - name: Setup
+        uses: ./tooling/github/setup
+      - run: pnpm run scripts:update-bug-report-template
+        env:
+          NEXT_VERSION: ${{ github.event.release.tag_name }}
+      - name: Commit changes
+        run: |
+          git config --global user.email "175486441+homarr-releases[bot]@users.noreply.github.com"
+          git config --global user.name "Releases Homarr"
+          git add .
+          git commit -m "chore: update bug report template"
+
+      - name: Create Pull Request
+        id: create-pull-request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ steps.obtainToken.outputs.token }}
+          branch: update-bug-report-template
+          base: dev
+          title: "chore: update bug report template"
+          delete-branch: true
+          body: |
+            This PR automatically updates the bug report template of Homarr in the .github/ISSUE_TEMPLATE/bug_report.yml
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install -y gh
+
+      - name: Enable auto-merge
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
+        run: |
+          gh pr merge ${{steps.create-pull-request.outputs.pull-request-number}} --auto --squash

SECURITY.md

@@ -1,18 +1,18 @@
 # Security Policy
+
 This policy is relevant if you found potential vulnerabilities in an audit.
 We consider something as a vulnerability if it...
+
 1. puts users or user data at risk
 2. enables third parties to gain control or access (e.g. [RATs](https://en.wikipedia.org/wiki/Remote_desktop_software#RAT), [privilege escalation](https://en.wikipedia.org/wiki/Privilege_escalation), ...)
 3. abuses the system in an unintended way (e.g. crypto mining, proxy, ...)
 
 ## Supported Versions
 
-| Version | Supported          |
+We only fix security issues in the [latest stable version](https://github.com/homarr-labs/homarr/releases/latest). Meaning security issues in prior versions will not be fixed and users have to upgrade to the latest version to receive them.
-| ------- | ------------------ |
-| >1.0.0  | :white_check_mark: |
-| <1.0.0  | :x:                |
 
 ## Reporting a Vulnerability
+
 We use [GitHub's system for reporting vulnerabilities](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-advisories/working-with-repository-security-advisories/creating-a-repository-security-advisory).
 Click [**here to report an advisory**](https://github.com/homarr-labs/homarr/security/advisories/new). Our team will get notified and will get back to you within 1-6 business days.
 

package.json

@@ -22,13 +22,14 @@
     "lint:ws": "pnpm dlx sherif@latest",
     "package:new": "turbo gen init",
     "release": "semantic-release",
+    "scripts:update-bug-report-template": "tsx ./scripts/update-bug-report-template.mts",
+    "scripts:update-readme-integrations": "tsx ./scripts/update-integration-list.mts",
     "start": "concurrently \"pnpm with-env node apps/tasks/tasks.cjs\" \"pnpm with-env node apps/websocket/wssServer.cjs\" \"pnpm -F nextjs start\"",
     "test": "cross-env NODE_ENV=development CI=true vitest run --exclude e2e --coverage.enabled ",
     "test:e2e": "cross-env NODE_ENV=development CI=true vitest e2e",
     "test:ui": "cross-env NODE_ENV=development CI=true vitest --exclude e2e --ui --coverage.enabled",
     "typecheck": "turbo typecheck",
-    "with-env": "dotenv -e .env --",
+    "with-env": "dotenv -e .env --"
-    "scripts:update-readme-integrations": "tsx ./scripts/update-integration-list.mts"
   },
   "prettier": "@homarr/prettier-config",
   "devDependencies": {

scripts/update-bug-report-template.mts

@@ -0,0 +1,14 @@
+import { readFile, writeFile } from "fs/promises";
+
+const replaceTemplate = "#NEXT_VERSION#";
+const fileName = ".github/ISSUE_TEMPLATE/bug_report.yml";
+const env = {
+  NEXT_VERSION: process.env.NEXT_VERSION as string,
+};
+
+const content = await readFile(fileName, "utf8");
+const updatedContent = content.replace(
+  replaceTemplate,
+  `${replaceTemplate}\n        - ${env.NEXT_VERSION.replace("v", "")}`,
+);
+await writeFile(fileName, updatedContent, "utf8");