fix: switch to alpine base image and upgrade pip

Replace python:3.12-slim (Debian) with python:3.12-alpine to reduce
image size and eliminate 68 Debian-inherited CVEs. Upgrade pip to
resolve CVE-2025-8869. Build deps installed temporarily for native
extensions (cryptography) and removed after pip install.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,83 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  lint:
+    runs-on: linux
+    container:
+      image: python:3.12-alpine
+    steps:
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+      - name: Install ruff
+        run: pip install --no-cache-dir -q ruff
+      - name: Lint
+        run: ruff check src/ tests/
+
+  test:
+    runs-on: linux
+    needs: [lint]
+    container:
+      image: python:3.12-alpine
+    steps:
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+      - name: Install deps
+        run: |
+          pip install --no-cache-dir -q -r requirements.txt
+          pip install --no-cache-dir -q pytest pytest-asyncio
+      - name: Test
+        run: PYTHONPATH=src pytest tests/ -v
+
+  secrets:
+    runs-on: linux
+    container:
+      image: alpine:latest
+    steps:
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git curl
+          git clone --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+      - name: Install gitleaks
+        run: |
+          ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')
+          VER=$(curl -sI https://github.com/gitleaks/gitleaks/releases/latest | grep -i location | grep -oE 'v[0-9.]+' | tr -d v)
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_${ARCH}.tar.gz" \
+            | tar xz -C /usr/local/bin/ gitleaks
+      - name: Scan for secrets
+        run: gitleaks detect --source . -v
+
+  build:
+    runs-on: linux
+    needs: [test, secrets]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    container:
+      image: docker:latest
+    steps:
+      - name: Checkout
+        run: |
+          apk add --no-cache -q git
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
+      - name: Login to Harbor
+        run: echo "$HARBOR_PASS" | docker login -u "$HARBOR_USER" --password-stdin harbor.mymx.me
+        env:
+          HARBOR_USER: ${{ secrets.HARBOR_USER }}
+          HARBOR_PASS: ${{ secrets.HARBOR_PASS }}
+      - name: Build and push
+        run: |
+          TAG="harbor.mymx.me/library/bouncer:${GITHUB_SHA::8}"
+          LATEST="harbor.mymx.me/library/bouncer:latest"
+          docker build --push -t "$TAG" -t "$LATEST" -f Containerfile .

.gitleaks.toml

@@ -0,0 +1,3 @@
+[allowlist]
+description = "Test fixture false positives"
+paths = ["tests/test_captcha\\.py"]

Containerfile

@@ -1,19 +1,19 @@
-FROM python:3.12-slim
+FROM python:3.12-alpine
 
 WORKDIR /app
 
-RUN pip install --no-cache-dir \
-    "python-socks[asyncio]>=2.4" \
-    "aiosqlite>=0.19" \
-    "aiohttp>=3.9" \
-    "aiohttp-socks>=0.8" \
-    "cryptography>=41.0"
+COPY requirements.txt .
+RUN apk add --no-cache --virtual .build gcc musl-dev libffi-dev openssl-dev && \
+    pip install --no-cache-dir --upgrade pip && \
+    pip install --no-cache-dir -r requirements.txt && \
+    apk del .build
+
+COPY src/ /app/src/
 
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONPATH=/app/src
 
-VOLUME /app/src
 VOLUME /data
 
 ENTRYPOINT ["python", "-m", "bouncer"]

requirements.txt

@@ -0,0 +1,5 @@
+python-socks[asyncio]>=2.4
+aiosqlite>=0.19
+aiohttp>=3.9
+aiohttp-socks>=0.8
+cryptography>=41.0