Pin version for build, dsomm-yaml-generation and Caddy

[hgomez-wescale]

Proposal to pin versions in Dockerfile, this way build, data and Caddy will be clearly idenfied and stable over the time

[wurstbrot]

Hi @hgomez-wescale, I agree that this is an enhancement. But how will the automatic update happen if dsomm-data has a new version?
An option is dependabot or renovate. See also https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference?learn=dependency_version_updates&amp%3BlearnProduct=code-security#required-keys . After integration of dependabot with docker we can merge this pr. Do you want to do that or should I do that?

[hgomez-wescale]

I would suggest to disable nightly generation and have a triggering on DSOMM or DSOMM data releases using something like

release:
    types: [published]

  # 2. Déclencheur pour une release sur le projet B (un autre projet)
  repository_dispatch:
    types: [DevSecOps-MaturityModel-data-release]

In DevSecOps-MaturityModel-data you could use something like

- name: Notify Project DevSecOps-MaturityModel
  uses: peter-evans/repository-dispatch@v3
  with:
    token: ${{ secrets.PAT_POUR_PROJET_A }}
    repository: devsecopsmaturitymodel/DevSecOps-MaturityModel # Remplacez par le nom de votre projet A
    event-type: DevSecOps-MaturityModel-data-release # Trigger Name

I'm by the end of using DSOMM tooling, I should move to something else and I won't have time to works on this fix

[vbakke]

Thank you for your suggestion, @hgomez-wescale.

I presume your suggestion means that:

• a new release of DSOMM-data will trigger a rebuild and re-publish the DSOMM github project
• this should trigger a new docker release
  • meaning that the latest docker image will include the latest DSOMM relase and/or latest DSOMM-data release
  • updating to the latest docker image will ensure latest info from either DSOMM project

If we could include the version number in the generated.yaml, it would also be possible for the browser to check github for newer versions, alerting the user of an update. (Unless configured, not to.)

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. 📆 It will be closed automatically in two weeks if no further activity occurs.