From 0ea8d3a10174ceae64da722c52cd6530349273b8 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 15:40:47 -0400
Subject: [PATCH 01/17] set permissions, use hashes of commits

---
 .github/workflows/greetings.yml   | 17 +++++++++++++----
 .github/workflows/label.yml       | 16 ++++++++++++----
 .github/workflows/secret-scan.yml |  9 +++++++--
 .github/workflows/tests.yml       | 18 +++++++++++++++---
 4 files changed, 47 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index ce02b994..7a27a17c 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -1,18 +1,27 @@
 name: Greetings
 
-on: [pull_request, issues]
+on: 
+  - pull_request
+  - issues
+
+permissions:
+  contents: read
 
 jobs:
   greeting:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
-    - uses: actions/first-interaction@v3
+    - name: Greet Contributor
+      uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d  # v3.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: >
+        issue_message: >
           Thanks for submitting an issue. Make sure you have checked for similar issues.
           Also, provide enough details for us to be able to replicate the problem.
-        pr-message: >
+        pr_message: >
           Thanks for submitting a PR. Make sure you have looked at the contribution guidelines.
           Also, look for quick check/tests operations that you can run locally for early verification of errors.
           Travis will be happier if it doesn't need to run too many times with problematic code.
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 3620c7e0..9e06b0a9 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -9,7 +9,14 @@ name: Pull Request Labeler
 on:
   # https://github.com/actions/labeler#recommended-permissions
   pull_request_target:
-    types: [opened, edited, synchronize, reopened]
+    types: 
+      - edited
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: read
 
 jobs:
   label:
@@ -17,15 +24,16 @@ jobs:
     if: github.actor != 'dependabot[bot]'
     permissions:
       # see: https://github.com/actions/labeler/issues/870
-      contents: read
       pull-requests: write
       issues: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - name: Check out Repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: "0"
-    - uses: actions/labeler@v7.0.0
+    - name: Label
+      uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
       with:
         sync-labels: false
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 85ca7284..5babe205 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -14,6 +14,9 @@ on:
   - pull_request
   - push
 
+permissions:
+  contents: read
+
 jobs:
   # ref: https://github.com/svdarren/secrets-workflow/blob/9633bc1195a1ca1d4d70415aa4eff6cf55d706de/.github/workflows/secrets.yml
   gitleak:
@@ -24,10 +27,12 @@ jobs:
     if: github.actor != 'dependabot[bot]'
 
     steps:
-      - uses: actions/checkout@v7
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: '0'
-      - uses: gitleaks/gitleaks-action@v3.0.0
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9667c3b8..4ef9ec8b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # see: https://github.com/fkirc/skip-duplicate-actions
   skip_duplicate:
@@ -114,12 +117,14 @@ jobs:
             echo "should_run=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@v7
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         with:
           fetch-depth: "0"
+
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         with:
           python-version: ${{ matrix.python-version }}
@@ -128,31 +133,38 @@ jobs:
       - name: Install Package Managers
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: make install-sys
+
       - name: Install Dependencies
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: make install-pkg install-req install-dev version
+
       - name: Display Packages
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: pip freeze
+
       - name: Setup Environment Variables
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         uses: c-py/action-dotenv-to-setenv@v5
         with:
           env-file: ./ci/magpie.env
+
       - name: Display Environment Variables
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         run: |
           hash -r
           env | sort
+
       - name: Create private key for network testing
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.test-case == 'test-local' }}
         run: ${{ matrix.test-option }} make create-private-key
       # run '-only' test variations since dependencies are preinstalled, skip some resolution time
+
       - name: Run Tests
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         run: ${{ matrix.test-option }} make stop ${{ matrix.test-case }}-only
+
       - name: Upload coverage report
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && success() && matrix.test-case == 'coverage' }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

From e05b432ec7e1df8c6f18f5e074a93ed169f2a06b Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:27:12 -0400
Subject: [PATCH 02/17] update Dockerfile metadata, use bump-my-version

---
 .bumpversion.toml    | 58 ++++++++++++++++++++++++++++++++++++++++++++
 Dockerfile           | 14 ++++++++---
 Dockerfile.adapter   | 13 +++++++---
 Makefile             |  4 +--
 requirements-dev.txt |  2 +-
 setup.cfg            | 33 -------------------------
 6 files changed, 82 insertions(+), 42 deletions(-)
 create mode 100644 .bumpversion.toml

diff --git a/.bumpversion.toml b/.bumpversion.toml
new file mode 100644
index 00000000..5b522870
--- /dev/null
+++ b/.bumpversion.toml
@@ -0,0 +1,58 @@
+[tool.bumpversion]
+current_version = "5.1.1"
+commit = true
+tag = true
+tag_name = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "README.rst"
+search = "{current_version}"
+replace = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Makefile"
+search = "APP_VERSION ?= {current_version}"
+replace = "APP_VERSION ?= {new_version}"
+
+[[tool.bumpversion.files]]
+filename = "magpie/__meta__.py"
+search = "__version__ = \"{current_version}\""
+replace = "__version__ = \"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "CHANGES.rst"
+search = """
+	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+	------------------------------------------------------------------------------------"""
+replace = """
+	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+	------------------------------------------------------------------------------------
+	
+	* Nothing new for the moment.
+	
+	.. _changes_{new_version}:
+	
+	`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
+	------------------------------------------------------------------------------------"""
diff --git a/Dockerfile b/Dockerfile
index 72e4bad1..7637b443 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,15 @@
 # version pin defined via '.github/dependabot.yml'
 FROM python:3.13-alpine3.23
-LABEL Description="Runs Magpie AuthN/AuthZ service for REST-API and UI interfaces."
-LABEL Maintainer="Francis Charette-Migneault <francis.charette-migneault@crim.ca>"
-LABEL Vendor="CRIM"
+ARG DEBIAN_FRONTEND=noninteractive
+ENV PIP_ROOT_USER_ACTION=ignore
+LABEL org.opencontainers.image.authors="Francis Charette-Migneault <francis.charette-migneault@crim.ca>"
+LABEL org.opencontainers.image.created="2026-07-30T20:37:38Z"
+LABEL org.opencontainers.image.description="Runs Magpie AuthN/AuthZ service for REST-API and UI interfaces."
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL org.opencontainers.image.source="https://github.com/Ouranosinc/Magpie"
+LABEL org.opencontainers.image.title="Magpie"
+LABEL org.opencontainers.image.vendor="CRIM and Ouranosinc"
+LABEL org.opencontainers.image.version="5.1.1"
 
 # the cron service depends on the $MAGPIE_DIR environment variable
 ENV MAGPIE_DIR=/opt/local/src/magpie
@@ -40,6 +47,7 @@ RUN apk upgrade --no-cache \
 COPY ./config/magpie.ini $MAGPIE_CONFIG_DIR/magpie.ini
 COPY ./env/*.env.example $MAGPIE_ENV_DIR/
 COPY ./magpie $MAGPIE_DIR/magpie/
+
 # equivalent of `make install` without conda env and pre-installed packages
 RUN pip install --no-dependencies -e $MAGPIE_DIR
 
diff --git a/Dockerfile.adapter b/Dockerfile.adapter
index c57faba9..39415e25 100644
--- a/Dockerfile.adapter
+++ b/Dockerfile.adapter
@@ -4,9 +4,16 @@
 #   using config 'twitcher.adapter = magpie.adapter.MagpieAdapter'
 #
 FROM birdhouse/twitcher:v0.11.1
-LABEL Description="Configures MagpieAdapter on top of Twitcher application."
-LABEL Maintainer="Francis Charette-Migneault <francis.charette-migneault@crim.ca>"
-LABEL Vendor="CRIM"
+ARG DEBIAN_FRONTEND=noninteractive
+ENV PIP_ROOT_USER_ACTION=ignore
+LABEL org.opencontainers.image.authors="Francis Charette-Migneault <francis.charette-migneault@crim.ca>"
+LABEL org.opencontainers.image.created="2026-07-30T20:37:38Z"
+LABEL org.opencontainers.image.description="Configures MagpieAdapter on top of Twitcher application."
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL org.opencontainers.image.source="https://github.com/Ouranosinc/Magpie"
+LABEL org.opencontainers.image.title="Twitcher with MagpieAdapter"
+LABEL org.opencontainers.image.vendor="CRIM and Ouranosinc"
+LABEL org.opencontainers.image.version="5.1.1"
 
 ENV MAGPIE_DIR=/opt/local/src/magpie
 COPY magpie/__init__.py magpie/__meta__.py $MAGPIE_DIR/magpie/
diff --git a/Makefile b/Makefile
index 167f6fce..64e319ab 100644
--- a/Makefile
+++ b/Makefile
@@ -346,8 +346,8 @@ endif
 bump:	## bump version using VERSION specified as user input (make VERSION=<X.Y.Z> bump)
 	@-echo "Updating package version ..."
 	@[ "${VERSION}" ] || ( echo ">> 'VERSION' is not set"; exit 1 )
-	@-bash -c '$(CONDA_CMD) test -f "$(CONDA_ENV_PATH)/bin/bump2version" || pip install $(PIP_XARGS) bump2version'
-	@-bash -c '$(CONDA_CMD) bump2version $(BUMP_XARGS) --new-version "${VERSION}" patch;'
+	@-bash -c '$(CONDA_CMD) test -f "$(CONDA_ENV_PATH)/bin/bump-my-version" || pip install $(PIP_XARGS) bump-my-version'
+	@-bash -c '$(CONDA_CMD) bump-my-version bump $(BUMP_XARGS) --new-version "${VERSION}" patch;'
 
 ## --- Installation targets --- ##
 
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 86746e7d..fd33d46c 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -2,7 +2,7 @@
 -r requirements-doc.txt
 autopep8>=1.5.4
 bandit==1.9.4
-bump2version==1.0.1
+bump-my-version==1.5.1
 codacy-coverage>=1.3.11
 coverage>=5.5
 doc8>=1.1.2
diff --git a/setup.cfg b/setup.cfg
index 118baef4..0497a882 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,36 +1,3 @@
-[bumpversion]
-current_version = 5.1.1
-commit = True
-tag = True
-tag_name = {new_version}
-
-[bumpversion:file:README.rst]
-search = {current_version}
-replace = {new_version}
-
-[bumpversion:file:Makefile]
-search = APP_VERSION ?= {current_version}
-replace = APP_VERSION ?= {new_version}
-
-[bumpversion:file:magpie/__meta__.py]
-search = __version__ = "{current_version}"
-replace = __version__ = "{new_version}"
-
-[bumpversion:file:CHANGES.rst]
-search = 
-	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
-	------------------------------------------------------------------------------------
-replace = 
-	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
-	------------------------------------------------------------------------------------
-	
-	* Nothing new for the moment.
-	
-	.. _changes_{new_version}:
-	
-	`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
-	------------------------------------------------------------------------------------
-
 [wheel]
 universal = 1
 

From 7f5714c42c7e68c243163149c2ab9cace93c748e Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:32:22 -0400
Subject: [PATCH 03/17] fix replacement, adjust handling of names

---
 .bumpversion.toml  | 20 ++++++++++----------
 magpie/__meta__.py |  4 ++--
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.bumpversion.toml b/.bumpversion.toml
index 5b522870..fa70769e 100644
--- a/.bumpversion.toml
+++ b/.bumpversion.toml
@@ -44,15 +44,15 @@ replace = "__version__ = \"{new_version}\""
 [[tool.bumpversion.files]]
 filename = "CHANGES.rst"
 search = """
-	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
-	------------------------------------------------------------------------------------"""
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------"""
 replace = """
-	`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
-	------------------------------------------------------------------------------------
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------
 	
-	* Nothing new for the moment.
-	
-	.. _changes_{new_version}:
-	
-	`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
-	------------------------------------------------------------------------------------"""
+* Nothing new for the moment.
+
+.. _changes_{new_version}:
+
+`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
+------------------------------------------------------------------------------------"""
diff --git a/magpie/__meta__.py b/magpie/__meta__.py
index 8369d0d9..51f6f36e 100644
--- a/magpie/__meta__.py
+++ b/magpie/__meta__.py
@@ -5,8 +5,8 @@
 __version__ = "5.1.1"
 __title__ = "Magpie"
 __package__ = "magpie"  # pylint: disable=W0622
-__author__ = "Francois-Xavier Derue, Francis Charette-Migneault"
-__maintainer__ = "Francis Charette-Migneault"
+__author__ = """Francois-Xavier Derue, Francis Charette-Migneault"""
+__maintainer__ = """Francis Charette-Migneault"""
 __email__ = "francis.charette-migneault@crim.ca"
 __url__ = "https://github.com/Ouranosinc/Magpie"
 __docker__ = "https://hub.docker.com/r/pavics/magpie"

From 76cff6ab6140fc8331a99f14678ae1e2fca35a6e Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:35:09 -0400
Subject: [PATCH 04/17] update RTD ubuntu version

---
 .readthedocs.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.readthedocs.yml b/.readthedocs.yml
index ee5f692c..a813b014 100644
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -1,11 +1,14 @@
 # configuration to setup readthedocs
 version: 2
+
 build:
-  os: ubuntu-22.04
+  os: ubuntu-26.04
   tools:
     python: "3.12"
+
 sphinx:
   configuration: docs/conf.py
+
 # note:
 #   disable PDF and EPUB which break during LaTeX
 #   generation because of `redoc.js` script not found
@@ -14,6 +17,7 @@ formats:
   - htmlzip
   #- pdf
   #- epub
+
 python:
   install:
     - requirements: requirements-sys.txt

From 19154edb0dcb2cfd9dcde1bb8ca278f7261302c8 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:57:43 -0400
Subject: [PATCH 05/17] add cooldowns

---
 .github/dependabot.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d21d5dcd..c0379be7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -29,6 +29,8 @@ updates:
     commit-message:
       prefix: "ci"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Python dependencies (pip)
   # Group patch/minor updates to reduce PR count; major updates get individual PRs
@@ -58,6 +60,8 @@ updates:
     commit-message:
       prefix: "pip"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Docker dependencies
   # No grouping for Docker dependencies - all updates need manual review
@@ -85,6 +89,8 @@ updates:
           - "version-update:semver-minor"
         versions:
           - ">= 3.14.0"  # limit to Python 3.13.x, but allow any extra OS version tag
+    cooldown:
+      default-days: 7
 
   # NPM dependencies
   - package-ecosystem: "npm"
@@ -106,3 +112,5 @@ updates:
     commit-message:
       prefix: "npm"
       include: "scope"
+    cooldown:
+      default-days: 7

From f5050b8899a530c6bbd00d87b8d5943d6eafce65 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:58:09 -0400
Subject: [PATCH 06/17] add docker-publish workflow

---
 .github/workflows/docker-publish.yml | 117 +++++++++++++++++++++++++++
 1 file changed, 117 insertions(+)
 create mode 100644 .github/workflows/docker-publish.yml

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 00000000..578f347c
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,117 @@
+name: Docker Hub Publishing
+
+on:
+  push:
+    branches:
+      - "master"
+    paths:
+      - ".bumpversion.toml"
+      - "Dockerfile"
+      - "Dockerfile.adapter"
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref == 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build-publish-magpie:
+    name: Build and publish (Magpie)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: pavics/magpie
+          labels: |
+            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
+            org.opencontainers.image.description=Runs Magpie AuthN/AuthZ service for REST-API and UI interfaces.
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.title=Magpie
+            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  build-publish-twitcher:
+    name: Build and publish (twitcher w/MagpieAdapter)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: pavics/twitcher
+          labels: |
+            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
+            org.opencontainers.image.description=Configures MagpieAdapter on top of Twitcher application.
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.title=Twitcher with MagpieAdapter
+            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}},prefix=magpie-
+            type=ref,event=tag,prefix=magpie-
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }},prefix=magpie-
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile.adapter
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}

From 616471beed50948f2569b2ffaa7b9d3a646d5f6c Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:49:18 -0400
Subject: [PATCH 07/17] add docker-testing.yml, specify master branch

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml |  4 +--
 .github/workflows/docker-testing.yml | 47 ++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/docker-testing.yml

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 578f347c..1437902b 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -3,7 +3,7 @@ name: Docker Hub Publishing
 on:
   push:
     branches:
-      - "master"
+      - master
     paths:
       - ".bumpversion.toml"
       - "Dockerfile"
@@ -14,7 +14,7 @@ on:
 concurrency:
   # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref == 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.ref == 'refs/heads/master' }}
 
 permissions:
   contents: read
diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
new file mode 100644
index 00000000..c35760b1
--- /dev/null
+++ b/.github/workflows/docker-testing.yml
@@ -0,0 +1,47 @@
+name: Docker-based Testing Suite
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+permissions:
+  contents: read
+
+env:
+  TEST_TAG: pavics/magpie:test
+
+jobs:
+  build:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image (no push)
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          context: .
+          load: true
+          push: false
+          tags: ${{ env.TEST_TAG }}

From ae94e97c34fe8c89899bce78b28cb28a8b20f55e Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:54:56 -0400
Subject: [PATCH 08/17] add label inspection step

---
 .github/workflows/docker-testing.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index c35760b1..368126d9 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -45,3 +45,7 @@ jobs:
           load: true
           push: false
           tags: ${{ env.TEST_TAG }}
+
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.TEST_TAG }}

From 8a956702aadd5d903175ade2994f946434886cc6 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:12:46 -0400
Subject: [PATCH 09/17] better image name handling and metadata for testing

---
 .github/workflows/docker-publish.yml | 32 ++++++++++++----------------
 .github/workflows/docker-testing.yml | 18 +++++++++-------
 2 files changed, 24 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 1437902b..54f7b408 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -23,6 +23,8 @@ jobs:
   build-publish-magpie:
     name: Build and publish (Magpie)
     runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: "pavics/magpie"
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -30,22 +32,11 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       - name: Gather Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
-          images: pavics/magpie
-          labels: |
-            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
-            org.opencontainers.image.description=Runs Magpie AuthN/AuthZ service for REST-API and UI interfaces.
-            org.opencontainers.image.licenses=Apache-2.0
-            org.opencontainers.image.title=Magpie
-            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          images: ${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
             type=ref,event=tag
@@ -68,9 +59,15 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
 
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:latest
+
   build-publish-twitcher:
     name: Build and publish (twitcher w/MagpieAdapter)
     runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: "pavics/twitcher"
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -78,16 +75,11 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
       - name: Gather Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
-          images: pavics/twitcher
+          images: ${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
             org.opencontainers.image.description=Configures MagpieAdapter on top of Twitcher application.
@@ -115,3 +107,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:magpie-latest
diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index 368126d9..bbbb7694 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -14,13 +14,12 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  TEST_TAG: pavics/magpie:test
-
 jobs:
   build:
     name: Build Docker image
     runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: pavics/magpie
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -28,10 +27,13 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
-      - name: Checkout Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
-          persist-credentials: false
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=test
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -44,8 +46,8 @@ jobs:
           context: .
           load: true
           push: false
-          tags: ${{ env.TEST_TAG }}
+          tags: ${{ env.IMAGE_NAME }}:test
 
       - name: Inspect labels
         run: |
-          docker inspect --format='{{json .Config.Labels}}' ${{ env.TEST_TAG }}
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:test

From df6a94344267c3216622493832b1cd3db25889d6 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:16:41 -0400
Subject: [PATCH 10/17] re-add checkout

---
 .github/workflows/docker-publish.yml | 10 ++++++++++
 .github/workflows/docker-testing.yml |  5 +++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 54f7b408..456029ac 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -32,6 +32,11 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Gather Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
@@ -75,6 +80,11 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Gather Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index bbbb7694..7f71b715 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -27,6 +27,11 @@ jobs:
           disable-sudo: true
           egress-policy: audit
 
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Gather Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0

From c529b34c051fb916e05f23b38e3bb8bdb506a0ee Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:19:52 -0400
Subject: [PATCH 11/17] supply labels

---
 .github/workflows/docker-testing.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index 7f71b715..0445925d 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -49,9 +49,10 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           context: .
+          labels: ${{ steps.meta.outputs.labels }}
           load: true
           push: false
-          tags: ${{ env.IMAGE_NAME }}:test
+          tags: ${{ steps.meta.outputs.tags }}
 
       - name: Inspect labels
         run: |

From abf0f0cc43307c71f3c2e324b75ff0bd04229075 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:29:20 -0400
Subject: [PATCH 12/17] add revision

---
 .github/workflows/docker-testing.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index 0445925d..b048784c 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -46,6 +46,8 @@ jobs:
       - name: Build Docker image (no push)
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
+          build-args: |
+            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           context: .

From 675914aa7f7da0e527519883b69de7bc8612f3ac Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:41:09 -0400
Subject: [PATCH 13/17] use sha of originating commit

---
 .github/workflows/docker-testing.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index b048784c..00a177ea 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -37,6 +37,8 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE_NAME }}
+          labels:
+            org.opencontainers.image.revision=${{ github.event.pull_request.head.sha }}
           tags: |
             type=raw,value=test
 
@@ -46,8 +48,6 @@ jobs:
       - name: Build Docker image (no push)
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          build-args: |
-            REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           context: .

From 92b68c4ab812e02440b2178a56f5323cf6404879 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 27 Aug 2026 11:47:19 -0400
Subject: [PATCH 14/17] remove hooks

---
 hooks/README.md |  2 --
 hooks/post_push | 10 ----------
 2 files changed, 12 deletions(-)
 delete mode 100644 hooks/README.md
 delete mode 100644 hooks/post_push

diff --git a/hooks/README.md b/hooks/README.md
deleted file mode 100644
index 623b9048..00000000
--- a/hooks/README.md
+++ /dev/null
@@ -1,2 +0,0 @@
-These files are for additional dockerhub auto-build hook procedures.
-see: https://docs.docker.com/docker-hub/builds/advanced/
diff --git a/hooks/post_push b/hooks/post_push
deleted file mode 100644
index 3a4aa8c4..00000000
--- a/hooks/post_push
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-
-echo "=> Information of Magpie Adapter image for Twitcher (docker tag: $DOCKER_TAG)"
-make APP_VERSION=${DOCKER_TAG} docker-info
-
-echo "=> Building Magpie Adapter image for Twitcher (docker tag: $DOCKER_TAG)"
-make APP_VERSION=${DOCKER_TAG} docker-build-adapter
-
-echo "=> Pushing Magpie Adapter image for Twitcher (docker tag: $DOCKER_TAG)"
-make APP_VERSION=${DOCKER_TAG} docker-push-adapter

From 888f55c9b888f8687fa6d8a138ac49aa9e5de3c0 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:04:49 -0400
Subject: [PATCH 15/17] remopve docker-testing workflow

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .github/workflows/docker-testing.yml | 61 ----------------------------
 1 file changed, 61 deletions(-)
 delete mode 100644 .github/workflows/docker-testing.yml

diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
deleted file mode 100644
index 00a177ea..00000000
--- a/.github/workflows/docker-testing.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Docker-based Testing Suite
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-
-concurrency:
-  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build Docker image
-    runs-on: ubuntu-latest
-    env:
-      IMAGE_NAME: pavics/magpie
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          disable-sudo: true
-          egress-policy: audit
-
-      - name: Check out Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Gather Docker metadata
-        id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          labels:
-            org.opencontainers.image.revision=${{ github.event.pull_request.head.sha }}
-          tags: |
-            type=raw,value=test
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Build Docker image (no push)
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          context: .
-          labels: ${{ steps.meta.outputs.labels }}
-          load: true
-          push: false
-          tags: ${{ steps.meta.outputs.tags }}
-
-      - name: Inspect labels
-        run: |
-          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:test

From b9a5eb3c3270dc097205e3d3d5122051b464682b Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:34:44 -0400
Subject: [PATCH 16/17] pin authlib

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 requirements-dev.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/requirements-dev.txt b/requirements-dev.txt
index fd33d46c..df087711 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,5 +1,7 @@
 -r requirements-sys.txt
 -r requirements-doc.txt
+# pin authlib to patch broken safety dependency chain
+authlib<1.8.0
 autopep8>=1.5.4
 bandit==1.9.4
 bump-my-version==1.5.1

From ffe9780f19833e95b94eb7dcfbb25f4820c75d1e Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:36:41 -0400
Subject: [PATCH 17/17] remove unneccessary labels

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 456029ac..3bf874c9 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -90,12 +90,6 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.IMAGE_NAME }}
-          labels: |
-            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
-            org.opencontainers.image.description=Configures MagpieAdapter on top of Twitcher application.
-            org.opencontainers.image.licenses=Apache-2.0
-            org.opencontainers.image.title=Twitcher with MagpieAdapter
-            org.opencontainers.image.vendor=CRIM and Ouranosinc
           tags: |
             type=raw,value=latest,enable={{is_default_branch}},prefix=magpie-
             type=ref,event=tag,prefix=magpie-