.github/workflows/build-rpm-arm64.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -83,10 +81,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm64.deb
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.rpm
-          *.deb

.github/workflows/build-rpm-armhf.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -116,10 +114,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.arm.deb
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.rpm
-          *.deb

.github/workflows/build-rpm-x86-64.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -84,10 +82,3 @@ jobs:
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}.x86_64.deb
 
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.rpm
-          *.deb

.github/workflows/build-watcom.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -95,9 +93,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-lite.zip
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.zip

.github/workflows/build-win32.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -110,9 +108,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x86.zip
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.zip

.github/workflows/build-win64.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -111,9 +109,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-x64.zip
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.zip

.github/workflows/build-winarm64.yml

@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: write
-  id-token: write
-  attestations: write
 
 jobs:
   ci:
@@ -110,9 +108,3 @@ jobs:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.event.release.tag_name }}
       run: gh release upload "$TAG" 3proxy-${{ env.RELEASE }}-arm64.zip
-    - name: Attest build provenance
-      if: github.event_name == 'release'
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: |
-          *.zip

.github/workflows/docker-ghcr.yml

@@ -0,0 +1,99 @@
+name: Build Docker images (GHCR)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    name: Build and push Docker images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Determine tags
+        id: tags
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        run: |
+          if [[ "$RELEASE_TAG" != "" ]]; then
+            RELEASE="${RELEASE_TAG#v}"
+            echo "minimal=${IMAGE}:${RELEASE}.minimal,${IMAGE}:minimal" >> "$GITHUB_OUTPUT"
+            echo "busybox=${IMAGE}:${RELEASE}.busybox,${IMAGE}:busybox" >> "$GITHUB_OUTPUT"
+            echo "full=${IMAGE}:${RELEASE},${IMAGE}:latest" >> "$GITHUB_OUTPUT"
+          else
+            DATETIME=$(date +%d%m%y%H%M%S)
+            BRANCH=$(echo "${GITHUB_REF#refs/heads/}" | tr "/" "-")
+            echo "minimal=${IMAGE}:${DATETIME}-${BRANCH}.minimal,${IMAGE}:${BRANCH}.minimal" >> "$GITHUB_OUTPUT"
+            echo "busybox=${IMAGE}:${DATETIME}-${BRANCH}.busybox,${IMAGE}:${BRANCH}.busybox" >> "$GITHUB_OUTPUT"
+            echo "full=${IMAGE}:${DATETIME}-${BRANCH},${IMAGE}:${BRANCH}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push minimal
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.minimal
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.minimal }}
+
+      - name: Build and push busybox
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.busybox
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.busybox }}
+
+      - name: Build and push full
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile.full
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.full }}
+
+      - name: Sign images
+        if: github.event_name != 'pull_request'
+        env:
+          TAGS_MINIMAL: ${{ steps.tags.outputs.minimal }}
+          TAGS_BUSYBOX: ${{ steps.tags.outputs.busybox }}
+          TAGS_FULL: ${{ steps.tags.outputs.full }}
+        run: |
+          IFS=',' read -ra TAGS <<< "$TAGS_MINIMAL,$TAGS_BUSYBOX,$TAGS_FULL"
+          for tag in "${TAGS[@]}"; do
+            cosign sign --yes "$tag"
+          done
+

.github/workflows/docker.yml

@@ -1,4 +1,4 @@
-name: Build Docker images
+name: Build Docker images (Docker Hub)
 
 on:
   release:
@@ -7,182 +7,89 @@ on:
 
 permissions:
   contents: read
-  packages: write
   id-token: write
-  attestations: write
 
 env:
-  DOCKERHUB_IMAGE: docker.io/3proxy/3proxy
+  REGISTRY: docker.io
-  GHCR_IMAGE: ghcr.io/3proxy/3proxy
+  IMAGE_NAME: 3proxy/3proxy
 
 jobs:
   build:
-    name: ${{ matrix.image }} ${{ matrix.platform }}
+    name: Build and push Docker images
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        image: [full, busybox, minimal]
-        platform: [linux/amd64, linux/arm64, linux/arm/v7]
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-          - platform: linux/arm/v7
-            runner: ubuntu-24.04-arm
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Platform name
+      - name: Determine tags
-        id: platform
+        id: tags
-        run: echo "pair=$(echo '${{ matrix.platform }}' | tr / -)" >> "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          if [[ "$RELEASE_TAG" != "" ]]; then
+            RELEASE="${RELEASE_TAG#v}"
+            echo "minimal=${REGISTRY}/${IMAGE_NAME}:${RELEASE}.minimal,${REGISTRY}/${IMAGE_NAME}:minimal" >> "$GITHUB_OUTPUT"
+            echo "busybox=${REGISTRY}/${IMAGE_NAME}:${RELEASE}.busybox,${REGISTRY}/${IMAGE_NAME}:busybox" >> "$GITHUB_OUTPUT"
+            echo "full=${REGISTRY}/${IMAGE_NAME}:${RELEASE},${REGISTRY}/${IMAGE_NAME}:latest" >> "$GITHUB_OUTPUT"
+          else
+            DATETIME=$(date +%d%m%y%H%M%S)
+            BRANCH=$(echo "${GITHUB_REF#refs/heads/}" | tr "/" "-")
+            echo "minimal=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH}.minimal,${REGISTRY}/${IMAGE_NAME}:${BRANCH}.minimal" >> "$GITHUB_OUTPUT"
+            echo "busybox=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH}.busybox,${REGISTRY}/${IMAGE_NAME}:${BRANCH}.busybox" >> "$GITHUB_OUTPUT"
+            echo "full=${REGISTRY}/${IMAGE_NAME}:${DATETIME}-${BRANCH},${REGISTRY}/${IMAGE_NAME}:${BRANCH}" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Set up QEMU
-        if: matrix.platform == 'linux/arm/v7'
         uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: Dockerfile.${{ matrix.image }}
-          platforms: ${{ matrix.platform }}
-          provenance: false
-          sbom: false
-          outputs: type=image,name=${{ env.GHCR_IMAGE }},push-by-digest=true,name-canonical=true,push=true
-
-      - name: Export digest
-        env:
-          DIGEST: ${{ steps.build.outputs.digest }}
-        run: |
-          mkdir -p /tmp/digests
-          touch "/tmp/digests/${DIGEST#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v7
-        with:
-          name: digests-${{ matrix.image }}-${{ steps.platform.outputs.pair }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  publish:
-    name: Publish ${{ matrix.image }}
-    runs-on: ubuntu-latest
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: full
-            suffix: ''
-            floating: latest
-          - image: busybox
-            suffix: .busybox
-            floating: busybox
-          - image: minimal
-            suffix: .minimal
-            floating: minimal
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v7
-        with:
-          path: /tmp/digests
-          pattern: digests-${{ matrix.image }}-*
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
-        with:
-          cosign-release: v2.4.3
 
       - name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Login to GHCR
+      - name: Build and push minimal
-        uses: docker/login-action@v4
+        uses: docker/build-push-action@v7
         with:
-          registry: ghcr.io
+          context: .
-          username: ${{ github.actor }}
+          file: Dockerfile.minimal
-          password: ${{ secrets.GITHUB_TOKEN }}
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.minimal }}
 
-      - name: Determine tags
+      - name: Build and push busybox
-        id: tags
+        uses: docker/build-push-action@v7
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-          SUFFIX: ${{ matrix.suffix }}
-          FLOATING: ${{ matrix.floating }}
-        run: |
-          if [[ "$RELEASE_TAG" != "" ]]; then
-            RELEASE="${RELEASE_TAG#v}"
-            echo "versioned=${RELEASE}${SUFFIX}" >> "$GITHUB_OUTPUT"
-            echo "moving=${FLOATING}" >> "$GITHUB_OUTPUT"
-          else
-            DATETIME=$(date +%d%m%y%H%M%S)
-            BRANCH=$(echo "${GITHUB_REF#refs/heads/}" | tr "/" "-")
-            echo "versioned=${DATETIME}-${BRANCH}${SUFFIX}" >> "$GITHUB_OUTPUT"
-            echo "moving=${BRANCH}${SUFFIX}" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create manifest list and push
-        working-directory: /tmp/digests
-        env:
-          VERSIONED: ${{ steps.tags.outputs.versioned }}
-          MOVING: ${{ steps.tags.outputs.moving }}
-        run: |
-          docker buildx imagetools create \
-            -t "${DOCKERHUB_IMAGE}:${VERSIONED}" \
-            -t "${DOCKERHUB_IMAGE}:${MOVING}" \
-            -t "${GHCR_IMAGE}:${VERSIONED}" \
-            -t "${GHCR_IMAGE}:${MOVING}" \
-            $(printf "${GHCR_IMAGE}@sha256:%s " *)
-
-      - name: Get pushed digest
-        id: digest
-        env:
-          VERSIONED: ${{ steps.tags.outputs.versioned }}
-        run: |
-          DIGEST=$(docker buildx imagetools inspect "${DOCKERHUB_IMAGE}:${VERSIONED}" \
-            --format '{{json .Manifest}}' | jq -r .digest)
-          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
-
-      - name: Attest Docker Hub image
-        uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.DOCKERHUB_IMAGE }}
+          context: .
-          subject-digest: ${{ steps.digest.outputs.digest }}
+          file: Dockerfile.busybox
-          push-to-registry: false
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.busybox }}
 
-      - name: Attest GHCR image
+      - name: Build and push full
-        uses: actions/attest-build-provenance@v2
+        uses: docker/build-push-action@v7
         with:
-          subject-name: ${{ env.GHCR_IMAGE }}
+          context: .
-          subject-digest: ${{ steps.digest.outputs.digest }}
+          file: Dockerfile.full
-          push-to-registry: false
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,ppc64le
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.tags.outputs.full }}
 
       - name: Sign images
+        if: github.event_name != 'pull_request'
         env:
-          DIGEST: ${{ steps.digest.outputs.digest }}
+          TAGS_MINIMAL: ${{ steps.tags.outputs.minimal }}
+          TAGS_BUSYBOX: ${{ steps.tags.outputs.busybox }}
+          TAGS_FULL: ${{ steps.tags.outputs.full }}
         run: |
-          cosign sign --yes "${DOCKERHUB_IMAGE}@${DIGEST}"
+          IFS=',' read -ra TAGS <<< "$TAGS_MINIMAL,$TAGS_BUSYBOX,$TAGS_FULL"
-          cosign sign --yes "${GHCR_IMAGE}@${DIGEST}"
+          for tag in "${TAGS[@]}"; do
-
+            cosign sign --yes "$tag"
+          done

README.md

@@ -6,9 +6,8 @@
 
 ### Branches
 
-- **Master** (stable) branch - 3proxy 1.0
+- **Master** (stable) branch - 3proxy 0.9
-- **0.9** (LTS) branch - 3proxy 0.9.9
+- **Devel** branch - 3proxy 10 (don't use it)
-- **Devel** branch - 3proxy 2.0-devel (don't use it)
 
 ### Binaries (deb / rpm / Windows zip)