mirror of
https://github.com/4gray/iptvnator.git
synced 2026-10-08 17:06:15 -08:00
4gray
cfa602d5b1
Pipeline audit follow-up: reduce wasted runner time on PRs and tighten CI security, without reducing what actually gets validated. Runner-time waste: - Concurrency with PR-only cancel-in-progress on CI, E2E, and docker-build, so a new push cancels the previous commit's still-running checks. Non-PR runs use the unique run_id as the group, because GitHub keeps at most one pending run per group even with cancel-in-progress: false — a shared ref group could silently drop a queued master run. - paths-ignore for docs-only changes (Markdown, docs/, .plans/, .codex/, .claude/) on the Electron build matrix and the E2E suites; E2E also skips apps/website/**. The build workflow keeps apps/website/** because its Linux job builds the website to verify AppStream assets. Tag pushes are unaffected: GitHub does not evaluate paths filters for tags. - PRs lint affected projects only; master pushes keep the full run-many. Lint-global inputs (eslint.config.mjs, tools/eslint/**) now mark all 41 lint projects affected, including the run-commands targets database and packaging, so the max-lines baseline cannot be widened without lint. Hardening: - Explicit least-privilege permissions on CI, E2E, and build-and-make; the create-release job keeps its job-level contents: write. The repository default workflow token was switched to read-only. - New actionlint job (image pinned by digest, shellcheck at warning+), with the shared-anchor false positive suppressed in .github/actionlint.yaml. Fixed one real finding: unquoted $GITHUB_OUTPUT. - .github/dependabot.yml: weekly cadence, minor+patch grouped per ecosystem (npm, GitHub Actions, Docker), majors stay individual PRs. Docs updated: CLAUDE.md, docs/architecture/nx-workspace-boundaries.md, and docs/architecture/validation-map.md now describe affected-lint on PRs and the E2E path-filter exceptions.
124 lines
4.4 KiB
YAML
124 lines
4.4 KiB
YAML
name: docker-build
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/docker.yml'
|
|
- 'apps/web/**'
|
|
- 'apps/web-backend/**'
|
|
- 'docker/**'
|
|
- 'libs/**'
|
|
- 'package.json'
|
|
- 'pnpm-lock.yaml'
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
push:
|
|
description: 'Push the image to Docker Hub'
|
|
required: true
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Superseded PR pushes cancel their still-running image build. Master/tag/
|
|
# manual runs get a unique group (run_id): GitHub keeps at most one pending
|
|
# run per group even with cancel-in-progress: false, so a shared ref group
|
|
# could silently drop a queued publish between two rapid master pushes.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
build:
|
|
name: Build Docker image
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Prepare Docker metadata
|
|
id: docker-meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
version="$(node -p "require('./package.json').version")"
|
|
short_sha="${GITHUB_SHA::12}"
|
|
publish="false"
|
|
platforms="linux/amd64"
|
|
tags="4gray/iptvnator:pr-${{ github.event.pull_request.number || 'manual' }}"
|
|
|
|
if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == "refs/heads/master" ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:latest
|
|
4gray/iptvnator:${version}-pwa
|
|
4gray/iptvnator:${version}-pwa-${short_sha}
|
|
4gray/iptvnator:sha-${short_sha}
|
|
TAGS
|
|
)
|
|
elif [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF}" == refs/tags/v* ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tag_version="${GITHUB_REF_NAME#v}"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:${tag_version}
|
|
4gray/iptvnator:v${tag_version}
|
|
TAGS
|
|
)
|
|
if [[ "${tag_version}" != *-* ]]; then
|
|
tags="${tags}"$'\n'"4gray/iptvnator:stable"
|
|
fi
|
|
elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${{ inputs.push }}" == "true" ]]; then
|
|
publish="true"
|
|
platforms="linux/amd64,linux/arm64"
|
|
tags=$(cat <<TAGS
|
|
4gray/iptvnator:manual-${short_sha}
|
|
4gray/iptvnator:sha-${short_sha}
|
|
TAGS
|
|
)
|
|
fi
|
|
|
|
{
|
|
echo "publish=${publish}"
|
|
echo "platforms=${platforms}"
|
|
echo "tags<<EOF"
|
|
echo "${tags}"
|
|
echo "EOF"
|
|
} >> "${GITHUB_OUTPUT}"
|
|
|
|
- name: Login to Docker Hub
|
|
if: steps.docker-meta.outputs.publish == 'true'
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build Docker image
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
file: ./docker/Dockerfile
|
|
push: ${{ steps.docker-meta.outputs.publish == 'true' }}
|
|
tags: ${{ steps.docker-meta.outputs.tags }}
|
|
platforms: ${{ steps.docker-meta.outputs.platforms }}
|
|
build-args: |
|
|
BUILD_COMMIT=${{ github.event.pull_request.head.sha || github.sha }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max,ignore-error=true
|