chore: clean git cache
This commit is contained in:
GitHub Actions
333
.github/workflows/PHASE1_IMPLEMENTATION.md
vendored
333
.github/workflows/PHASE1_IMPLEMENTATION.md
vendored
@@ -1,333 +0,0 @@
|
||||
# Phase 1 Docker Optimization Implementation
|
||||
|
||||
**Date:** February 4, 2026
|
||||
**Status:** ✅ **COMPLETE - Ready for Testing**
|
||||
**Spec Reference:** `docs/plans/current_spec.md` Section 4.1
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
Phase 1 of the "Build Once, Test Many" Docker optimization has been successfully implemented in `.github/workflows/docker-build.yml`. This phase enables PR and feature branch images to be pushed to the GHCR registry with immutable tags, allowing downstream workflows to consume the same image instead of building redundantly.
|
||||
|
||||
---
|
||||
|
||||
## Changes Implemented
|
||||
|
||||
### 1. ✅ PR Images Push to GHCR
|
||||
|
||||
**Requirement:** Push PR images to registry (currently only non-PR pushes to registry)
|
||||
|
||||
**Implementation:**
|
||||
- **Line 238:** `--push` flag always active in buildx command
|
||||
- **Conditional:** Works for all events (pull_request, push, workflow_dispatch)
|
||||
- **Benefit:** Downstream workflows (E2E, integration tests) can pull from registry
|
||||
|
||||
**Validation:**
|
||||
```yaml
|
||||
# Before (implicit in docker/build-push-action):
|
||||
push: ${{ github.event_name != 'pull_request' }} # ❌ PRs not pushed
|
||||
|
||||
# After (explicit in retry wrapper):
|
||||
--push # ✅ Always push to registry
|
||||
```
|
||||
|
||||
### 2. ✅ Immutable PR Tagging with SHA
|
||||
|
||||
**Requirement:** Generate immutable tags `pr-{number}-{short-sha}` for PRs
|
||||
|
||||
**Implementation:**
|
||||
- **Line 148:** Metadata action produces `pr-123-abc1234` format
|
||||
- **Format:** `type=raw,value=pr-${{ github.event.pull_request.number }}-{{sha}}`
|
||||
- **Short SHA:** Docker metadata action's `{{sha}}` template produces 7-character hash
|
||||
- **Immutability:** Each commit gets unique tag (prevents overwrites during race conditions)
|
||||
|
||||
**Example Tags:**
|
||||
```
|
||||
pr-123-abc1234 # PR #123, commit abc1234
|
||||
pr-123-def5678 # PR #123, commit def5678 (force push)
|
||||
```
|
||||
|
||||
### 3. ✅ Feature Branch Sanitized Tagging
|
||||
|
||||
**Requirement:** Feature branches get `{sanitized-name}-{short-sha}` tags
|
||||
|
||||
**Implementation:**
|
||||
- **Lines 133-165:** New step computes sanitized feature branch tags
|
||||
- **Algorithm (per spec Section 3.2):**
|
||||
1. Convert to lowercase
|
||||
2. Replace `/` with `-`
|
||||
3. Replace special characters with `-`
|
||||
4. Remove leading/trailing `-`
|
||||
5. Collapse consecutive `-` to single `-`
|
||||
6. Truncate to 121 chars (room for `-{sha}`)
|
||||
7. Append `-{short-sha}` for uniqueness
|
||||
|
||||
- **Line 147:** Metadata action uses computed tag
|
||||
- **Label:** `io.charon.feature.branch` label added for traceability
|
||||
|
||||
**Example Transforms:**
|
||||
```bash
|
||||
feature/Add_New-Feature → feature-add-new-feature-abc1234
|
||||
feature/dns/subdomain → feature-dns-subdomain-def5678
|
||||
feature/fix-#123 → feature-fix-123-ghi9012
|
||||
```
|
||||
|
||||
### 4. ✅ Retry Logic for Registry Pushes
|
||||
|
||||
**Requirement:** Add retry logic for registry push (3 attempts, 10s wait)
|
||||
|
||||
**Implementation:**
|
||||
- **Lines 194-254:** Entire build wrapped in `nick-fields/retry@v3`
|
||||
- **Configuration:**
|
||||
- `max_attempts: 3` - Retry up to 3 times
|
||||
- `retry_wait_seconds: 10` - Wait 10 seconds between attempts
|
||||
- `timeout_minutes: 25` - Prevent hung builds (increased from 20 to account for retries)
|
||||
- `retry_on: error` - Retry on any error (network, quota, etc.)
|
||||
- `warning_on_retry: true` - Log warnings for visibility
|
||||
|
||||
- **Converted Approach:**
|
||||
- Changed from `docker/build-push-action@v6` (no built-in retry)
|
||||
- To raw `docker buildx build` command wrapped in retry action
|
||||
- Maintains all original functionality (tags, labels, platforms, etc.)
|
||||
|
||||
**Benefits:**
|
||||
- Handles transient registry failures (network glitches, quota limits)
|
||||
- Prevents failed builds due to temporary GHCR issues
|
||||
- Provides better observability with retry warnings
|
||||
|
||||
### 5. ✅ PR Image Security Scanning
|
||||
|
||||
**Requirement:** Add PR image security scanning (currently skipped for PRs)
|
||||
|
||||
**Status:** Already implemented in `scan-pr-image` job (lines 534-615)
|
||||
|
||||
**Existing Features:**
|
||||
- **Blocks merge on vulnerabilities:** `exit-code: '1'` for CRITICAL/HIGH
|
||||
- **Image freshness validation:** Checks SHA label matches expected commit
|
||||
- **SARIF upload:** Results uploaded to Security tab for review
|
||||
- **Proper tagging:** Uses same `pr-{number}-{short-sha}` format
|
||||
|
||||
**No changes needed** - this requirement was already fulfilled!
|
||||
|
||||
### 6. ✅ Maintain Artifact Uploads
|
||||
|
||||
**Requirement:** Keep existing artifact upload as fallback
|
||||
|
||||
**Status:** Preserved in lines 256-291
|
||||
|
||||
**Functionality:**
|
||||
- Saves image as tar file for PR and feature branch builds
|
||||
- Acts as fallback if registry pull fails
|
||||
- Used by `supply-chain-pr.yml` and `security-pr.yml` (correct pattern)
|
||||
- 1-day retention matches workflow duration
|
||||
|
||||
**No changes needed** - backward compatibility maintained!
|
||||
|
||||
---
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Tag and Label Formatting
|
||||
|
||||
**Challenge:** Metadata action outputs newline-separated tags/labels, but buildx needs space-separated args
|
||||
|
||||
**Solution (Lines 214-226):**
|
||||
```bash
|
||||
# Build tag arguments from metadata output
|
||||
TAG_ARGS=""
|
||||
while IFS= read -r tag; do
|
||||
[[ -n "$tag" ]] && TAG_ARGS="${TAG_ARGS} --tag ${tag}"
|
||||
done <<< "${{ steps.meta.outputs.tags }}"
|
||||
|
||||
# Build label arguments from metadata output
|
||||
LABEL_ARGS=""
|
||||
while IFS= read -r label; do
|
||||
[[ -n "$tag" ]] && LABEL_ARGS="${LABEL_ARGS} --label ${label}"
|
||||
done <<< "${{ steps.meta.outputs.labels }}"
|
||||
```
|
||||
|
||||
### Digest Extraction
|
||||
|
||||
**Challenge:** Downstream jobs need image digest for security scanning and attestation
|
||||
|
||||
**Solution (Lines 247-254):**
|
||||
```bash
|
||||
# --iidfile writes image digest to file (format: sha256:xxxxx)
|
||||
# For multi-platform: manifest list digest
|
||||
# For single-platform: image digest
|
||||
DIGEST=$(cat /tmp/image-digest.txt)
|
||||
echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
|
||||
```
|
||||
|
||||
**Format:** Keeps full `sha256:xxxxx` format (required for `@` references)
|
||||
|
||||
### Conditional Image Loading
|
||||
|
||||
**Challenge:** PRs and feature pushes need local image for artifact creation
|
||||
|
||||
**Solution (Lines 228-232):**
|
||||
```bash
|
||||
# Determine if we should load locally
|
||||
LOAD_FLAG=""
|
||||
if [[ "${{ github.event_name }}" == "pull_request" ]] || [[ "${{ steps.skip.outputs.is_feature_push }}" == "true" ]]; then
|
||||
LOAD_FLAG="--load"
|
||||
fi
|
||||
```
|
||||
|
||||
**Behavior:**
|
||||
- **PR/Feature:** Build + push to registry + load locally → artifact saved
|
||||
- **Main/Dev:** Build + push to registry only (multi-platform, no local load)
|
||||
|
||||
---
|
||||
|
||||
## Testing Checklist
|
||||
|
||||
Before merging, verify the following scenarios:
|
||||
|
||||
### PR Workflow
|
||||
- [ ] Open new PR → Check image pushed to GHCR with tag `pr-{N}-{sha}`
|
||||
- [ ] Update PR (force push) → Check NEW tag created `pr-{N}-{new-sha}`
|
||||
- [ ] Security scan runs and passes/fails correctly
|
||||
- [ ] Artifact uploaded as `pr-image-{N}`
|
||||
- [ ] Image has correct labels (commit SHA, PR number, timestamp)
|
||||
|
||||
### Feature Branch Workflow
|
||||
- [ ] Push to `feature/my-feature` → Image tagged `feature-my-feature-{sha}`
|
||||
- [ ] Push to `feature/Sub/Feature` → Image tagged `feature-sub-feature-{sha}`
|
||||
- [ ] Push to `feature/fix-#123` → Image tagged `feature-fix-123-{sha}`
|
||||
- [ ] Special characters sanitized correctly
|
||||
- [ ] Artifact uploaded as `push-image`
|
||||
|
||||
### Main/Dev Branch Workflow
|
||||
- [ ] Push to main → Multi-platform image (amd64, arm64)
|
||||
- [ ] Tags include: `latest`, `sha-{sha}`, GHCR + Docker Hub
|
||||
- [ ] Security scan runs (SARIF uploaded)
|
||||
- [ ] SBOM generated and attested
|
||||
- [ ] Image signed with Cosign
|
||||
|
||||
### Retry Logic
|
||||
- [ ] Simulate registry failure → Build retries 3 times
|
||||
- [ ] Transient failure → Eventually succeeds
|
||||
- [ ] Persistent failure → Fails after 3 attempts
|
||||
- [ ] Retry warnings visible in logs
|
||||
|
||||
### Downstream Integration
|
||||
- [ ] `supply-chain-pr.yml` can download artifact (fallback works)
|
||||
- [ ] `security-pr.yml` can download artifact (fallback works)
|
||||
- [ ] Future integration workflows can pull from registry (Phase 3)
|
||||
|
||||
---
|
||||
|
||||
## Performance Impact
|
||||
|
||||
### Expected Build Time Changes
|
||||
|
||||
| Scenario | Before | After | Change | Reason |
|
||||
|----------|--------|-------|--------|--------|
|
||||
| **PR Build** | ~12 min | ~15 min | +3 min | Registry push + retry buffer |
|
||||
| **Feature Build** | ~12 min | ~15 min | +3 min | Registry push + sanitization |
|
||||
| **Main Build** | ~15 min | ~18 min | +3 min | Multi-platform + retry buffer |
|
||||
|
||||
**Note:** Single-build overhead is offset by 5x reduction in redundant builds (Phase 3)
|
||||
|
||||
### Registry Storage Impact
|
||||
|
||||
| Image Type | Count/Week | Size | Total | Cleanup |
|
||||
|------------|------------|------|-------|---------|
|
||||
| PR Images | ~50 | 1.2 GB | 60 GB | 24 hours |
|
||||
| Feature Images | ~10 | 1.2 GB | 12 GB | 7 days |
|
||||
|
||||
**Mitigation:** Phase 5 implements automated cleanup (containerprune.yml)
|
||||
|
||||
---
|
||||
|
||||
## Rollback Procedure
|
||||
|
||||
If critical issues are detected:
|
||||
|
||||
1. **Revert the workflow file:**
|
||||
```bash
|
||||
git revert <commit-sha>
|
||||
git push origin main
|
||||
```
|
||||
|
||||
2. **Verify workflows restored:**
|
||||
```bash
|
||||
gh workflow list --all
|
||||
```
|
||||
|
||||
3. **Clean up broken PR images (optional):**
|
||||
```bash
|
||||
gh api /orgs/wikid82/packages/container/charon/versions \
|
||||
--jq '.[] | select(.metadata.container.tags[] | startswith("pr-")) | .id' | \
|
||||
xargs -I {} gh api -X DELETE "/orgs/wikid82/packages/container/charon/versions/{}"
|
||||
```
|
||||
|
||||
4. **Communicate to team:**
|
||||
- Post in PRs: "CI rollback in progress, please hold merges"
|
||||
- Investigate root cause in isolated branch
|
||||
- Schedule post-mortem
|
||||
|
||||
**Estimated Rollback Time:** ~15 minutes
|
||||
|
||||
---
|
||||
|
||||
## Next Steps (Phase 2-6)
|
||||
|
||||
This Phase 1 implementation enables:
|
||||
|
||||
- **Phase 2 (Week 4):** Migrate supply-chain and security workflows to use registry images
|
||||
- **Phase 3 (Week 5):** Migrate integration workflows (crowdsec, cerberus, waf, rate-limit)
|
||||
- **Phase 4 (Week 6):** Migrate E2E tests to pull from registry
|
||||
- **Phase 5 (Week 7):** Enable automated cleanup of transient images
|
||||
- **Phase 6 (Week 8):** Final validation, documentation, and metrics collection
|
||||
|
||||
See `docs/plans/current_spec.md` Sections 6.3-6.6 for details.
|
||||
|
||||
---
|
||||
|
||||
## Documentation Updates
|
||||
|
||||
**Files Updated:**
|
||||
- `.github/workflows/docker-build.yml` - Core implementation
|
||||
- `.github/workflows/PHASE1_IMPLEMENTATION.md` - This document
|
||||
|
||||
**Still TODO:**
|
||||
- Update `docs/ci-cd.md` with new architecture overview (Phase 6)
|
||||
- Update `CONTRIBUTING.md` with workflow expectations (Phase 6)
|
||||
- Create troubleshooting guide for new patterns (Phase 6)
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
Phase 1 is **COMPLETE** when:
|
||||
|
||||
- [x] PR images pushed to GHCR with immutable tags
|
||||
- [x] Feature branch images have sanitized tags with SHA
|
||||
- [x] Retry logic implemented for registry operations
|
||||
- [x] Security scanning blocks vulnerable PR images
|
||||
- [x] Artifact uploads maintained for backward compatibility
|
||||
- [x] All existing functionality preserved
|
||||
- [ ] Testing checklist validated (next step)
|
||||
- [ ] No regressions in build time >20%
|
||||
- [ ] No regressions in test failure rate >3%
|
||||
|
||||
**Current Status:** Implementation complete, ready for testing in PR.
|
||||
|
||||
---
|
||||
|
||||
## References
|
||||
|
||||
- **Specification:** `docs/plans/current_spec.md`
|
||||
- **Supervisor Feedback:** Incorporated risk mitigations and phasing adjustments
|
||||
- **Docker Buildx Docs:** https://docs.docker.com/engine/reference/commandline/buildx_build/
|
||||
- **Metadata Action Docs:** https://github.com/docker/metadata-action
|
||||
- **Retry Action Docs:** https://github.com/nick-fields/retry
|
||||
|
||||
---
|
||||
|
||||
**Implemented by:** GitHub Copilot (DevOps Mode)
|
||||
**Date:** February 4, 2026
|
||||
**Estimated Effort:** 4 hours (actual) vs 1 week (planned - ahead of schedule!)
|
||||
34
.github/workflows/auto-add-to-project.yml
vendored
34
.github/workflows/auto-add-to-project.yml
vendored
@@ -1,34 +0,0 @@
|
||||
name: Auto-add issues and PRs to Project
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [opened, reopened]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
add-to-project:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Determine project URL presence
|
||||
id: project_check
|
||||
run: |
|
||||
if [ -n "${{ secrets.PROJECT_URL }}" ]; then
|
||||
echo "has_project=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "has_project=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Add issue or PR to project
|
||||
if: steps.project_check.outputs.has_project == 'true'
|
||||
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
|
||||
continue-on-error: true
|
||||
with:
|
||||
project-url: ${{ secrets.PROJECT_URL }}
|
||||
github-token: ${{ secrets.ADD_TO_PROJECT_PAT || secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Skip summary
|
||||
if: steps.project_check.outputs.has_project == 'false'
|
||||
run: echo "PROJECT_URL secret missing; skipping project assignment." >> "$GITHUB_STEP_SUMMARY"
|
||||
26
.github/workflows/auto-changelog.yml
vendored
26
.github/workflows/auto-changelog.yml
vendored
@@ -1,26 +0,0 @@
|
||||
name: Auto Changelog (Release Drafter)
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
branches: [ main ]
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
update-draft:
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
- name: Draft Release
|
||||
uses: release-drafter/release-drafter@6db134d15f3909ccc9eefd369f02bd1e9cffdf97 # v6
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
78
.github/workflows/auto-label-issues.yml
vendored
78
.github/workflows/auto-label-issues.yml
vendored
@@ -1,78 +0,0 @@
|
||||
name: Auto-label Issues
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [opened, edited]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.issue.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
auto-label:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
issues: write
|
||||
steps:
|
||||
- name: Auto-label based on title and body
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const issue = context.payload.issue;
|
||||
const title = issue.title.toLowerCase();
|
||||
const body = issue.body ? issue.body.toLowerCase() : '';
|
||||
const labels = [];
|
||||
|
||||
// Priority detection
|
||||
if (title.includes('[critical]') || body.includes('priority: critical')) {
|
||||
labels.push('critical');
|
||||
} else if (title.includes('[high]') || body.includes('priority: high')) {
|
||||
labels.push('high');
|
||||
} else if (title.includes('[medium]') || body.includes('priority: medium')) {
|
||||
labels.push('medium');
|
||||
} else if (title.includes('[low]') || body.includes('priority: low')) {
|
||||
labels.push('low');
|
||||
}
|
||||
|
||||
// Milestone detection
|
||||
if (title.includes('[alpha]') || body.includes('milestone: alpha')) {
|
||||
labels.push('alpha');
|
||||
} else if (title.includes('[beta]') || body.includes('milestone: beta')) {
|
||||
labels.push('beta');
|
||||
} else if (title.includes('[post-beta]') || body.includes('milestone: post-beta')) {
|
||||
labels.push('post-beta');
|
||||
}
|
||||
|
||||
// Category detection
|
||||
if (title.includes('architecture') || body.includes('architecture')) labels.push('architecture');
|
||||
if (title.includes('backend') || body.includes('backend')) labels.push('backend');
|
||||
if (title.includes('frontend') || body.includes('frontend')) labels.push('frontend');
|
||||
if (title.includes('security') || body.includes('security')) labels.push('security');
|
||||
if (title.includes('ssl') || title.includes('tls') || body.includes('certificate')) labels.push('ssl');
|
||||
if (title.includes('sso') || body.includes('single sign-on')) labels.push('sso');
|
||||
if (title.includes('waf') || body.includes('web application firewall')) labels.push('waf');
|
||||
if (title.includes('crowdsec') || body.includes('crowdsec')) labels.push('crowdsec');
|
||||
if (title.includes('caddy') || body.includes('caddy')) labels.push('caddy');
|
||||
if (title.includes('database') || body.includes('database')) labels.push('database');
|
||||
if (title.includes('ui') || title.includes('interface')) labels.push('ui');
|
||||
if (title.includes('docker') || title.includes('deployment')) labels.push('deployment');
|
||||
if (title.includes('monitoring') || title.includes('logging')) labels.push('monitoring');
|
||||
if (title.includes('documentation') || title.includes('docs')) labels.push('documentation');
|
||||
if (title.includes('test') || body.includes('testing')) labels.push('testing');
|
||||
if (title.includes('performance') || body.includes('optimization')) labels.push('performance');
|
||||
if (title.includes('plus') || body.includes('premium feature')) labels.push('plus');
|
||||
|
||||
// Feature detection
|
||||
if (title.includes('feature') || body.includes('feature request')) labels.push('feature');
|
||||
|
||||
// Only add labels if we detected any
|
||||
if (labels.length > 0) {
|
||||
await github.rest.issues.addLabels({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: issue.number,
|
||||
labels: labels
|
||||
});
|
||||
|
||||
console.log(`Added labels: ${labels.join(', ')}`);
|
||||
}
|
||||
107
.github/workflows/auto-versioning.yml
vendored
107
.github/workflows/auto-versioning.yml
vendored
@@ -1,107 +0,0 @@
|
||||
name: Auto Versioning and Release
|
||||
|
||||
# SEMANTIC VERSIONING RULES:
|
||||
# - PATCH (0.14.1 → 0.14.2): fix:, perf:, refactor:, docs:, style:, test:, build:, ci:
|
||||
# - MINOR (0.14.1 → 0.15.0): feat:, feat(...):
|
||||
# - MAJOR (0.14.1 → 1.0.0): MANUAL ONLY - Create git tag manually when ready for 1.0.0
|
||||
#
|
||||
# ⚠️ Major version bumps are intentionally disabled in automation to prevent accidents.
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
branches: [ main ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: false # Don't cancel in-progress releases
|
||||
|
||||
permissions:
|
||||
contents: write # Required for creating releases via API (removed unused pull-requests: write)
|
||||
|
||||
jobs:
|
||||
version:
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Calculate Semantic Version
|
||||
id: semver
|
||||
uses: paulhatch/semantic-version@f29500c9d60a99ed5168e39ee367e0976884c46e # v6.0.1
|
||||
with:
|
||||
# The prefix to use to create tags
|
||||
tag_prefix: "v"
|
||||
# Regex pattern for major version bump - DISABLED (manual only)
|
||||
# Use a pattern that will never match to prevent automated major bumps
|
||||
major_pattern: "/__MANUAL_MAJOR_BUMP_ONLY__/"
|
||||
# Regex pattern for minor version bump (new features)
|
||||
# Matches: "feat:" prefix in commit messages (Conventional Commits)
|
||||
minor_pattern: "/^feat(\\(.+\\))?:/"
|
||||
# Patch bumps: All other commits (fix:, chore:, etc.) are treated as patches by default
|
||||
# Pattern to determine formatting
|
||||
version_format: "${major}.${minor}.${patch}"
|
||||
# If no tags are found, this version is used
|
||||
version_from_branch: "0.0.0"
|
||||
# This helps it search through history to find the last tag
|
||||
search_commit_body: true
|
||||
# Important: This enables the output 'changed' which your other steps rely on
|
||||
enable_prerelease_mode: false
|
||||
|
||||
- name: Show version
|
||||
run: |
|
||||
echo "Next version: ${{ steps.semver.outputs.version }}"
|
||||
echo "Version changed: ${{ steps.semver.outputs.changed }}"
|
||||
|
||||
- name: Determine tag name
|
||||
id: determine_tag
|
||||
run: |
|
||||
# Normalize the version: remove any leading 'v' so we don't end up with 'vvX.Y.Z'
|
||||
RAW="${{ steps.semver.outputs.version }}"
|
||||
VERSION_NO_V="${RAW#v}"
|
||||
TAG="v${VERSION_NO_V}"
|
||||
echo "Determined tag: $TAG"
|
||||
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Check for existing GitHub Release
|
||||
id: check_release
|
||||
run: |
|
||||
TAG="${{ steps.determine_tag.outputs.tag }}"
|
||||
echo "Checking for release for tag: ${TAG}"
|
||||
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||
-H "Authorization: token ${GITHUB_TOKEN}" \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}") || true
|
||||
if [ "${STATUS}" = "200" ]; then
|
||||
echo "exists=true" >> "$GITHUB_OUTPUT"
|
||||
echo "ℹ️ Release already exists for tag: ${TAG}"
|
||||
else
|
||||
echo "exists=false" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ No existing release found for tag: ${TAG}"
|
||||
fi
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Create GitHub Release (creates tag via API)
|
||||
if: ${{ steps.semver.outputs.changed == 'true' && steps.check_release.outputs.exists == 'false' }}
|
||||
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
|
||||
with:
|
||||
tag_name: ${{ steps.determine_tag.outputs.tag }}
|
||||
name: Release ${{ steps.determine_tag.outputs.tag }}
|
||||
generate_release_notes: true
|
||||
make_latest: true
|
||||
draft: false
|
||||
prerelease: false
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Output release information
|
||||
if: ${{ steps.semver.outputs.changed == 'true' && steps.check_release.outputs.exists == 'false' }}
|
||||
run: |
|
||||
echo "✅ Successfully created release: ${{ steps.determine_tag.outputs.tag }}"
|
||||
echo "📦 Release URL: https://github.com/${{ github.repository }}/releases/tag/${{ steps.determine_tag.outputs.tag }}"
|
||||
75
.github/workflows/benchmark.yml
vendored
75
.github/workflows/benchmark.yml
vendored
@@ -1,75 +0,0 @@
|
||||
name: Go Benchmark
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.7'
|
||||
GOTOOLCHAIN: auto
|
||||
|
||||
# Minimal permissions at workflow level; write permissions granted at job level for push only
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
benchmark:
|
||||
name: Performance Regression Check
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
|
||||
# Grant write permissions for storing benchmark results (only used on push via step condition)
|
||||
# Note: GitHub Actions doesn't support dynamic expressions in permissions block
|
||||
permissions:
|
||||
contents: write
|
||||
deployments: write
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Run Benchmark
|
||||
working-directory: backend
|
||||
run: go test -bench=. -benchmem -run='^$' ./... | tee output.txt
|
||||
|
||||
- name: Store Benchmark Result
|
||||
# Only store results on pushes to main - PRs just run benchmarks without storage
|
||||
# This avoids gh-pages branch errors and permission issues on fork PRs
|
||||
if: github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'
|
||||
# Security: Pinned to full SHA for supply chain security
|
||||
uses: benchmark-action/github-action-benchmark@4e0b38bc48375986542b13c0d8976b7b80c60c00 # v1
|
||||
with:
|
||||
name: Go Benchmark
|
||||
tool: 'go'
|
||||
output-file-path: backend/output.txt
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
auto-push: true
|
||||
# Show alert with commit comment on detection of performance regression
|
||||
# Threshold increased to 175% to account for CI variability
|
||||
alert-threshold: '175%'
|
||||
comment-on-alert: true
|
||||
fail-on-alert: false
|
||||
# Enable Job Summary
|
||||
summary-always: true
|
||||
|
||||
- name: Run Perf Asserts
|
||||
working-directory: backend
|
||||
env:
|
||||
PERF_MAX_MS_GETSTATUS_P95: 500ms
|
||||
PERF_MAX_MS_GETSTATUS_P95_PARALLEL: 1500ms
|
||||
PERF_MAX_MS_LISTDECISIONS_P95: 2000ms
|
||||
run: |
|
||||
echo "## 🔍 Running performance assertions (TestPerf)" >> "$GITHUB_STEP_SUMMARY"
|
||||
go test -run TestPerf -v ./internal/api/handlers -count=1 | tee perf-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
66
.github/workflows/caddy-major-monitor.yml
vendored
66
.github/workflows/caddy-major-monitor.yml
vendored
@@ -1,66 +0,0 @@
|
||||
name: Monitor Caddy Major Release
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '17 7 * * 1' # Mondays at 07:17 UTC
|
||||
workflow_dispatch: {}
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
|
||||
jobs:
|
||||
check-caddy-major:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Check for Caddy v3 and open issue
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const upstream = { owner: 'caddyserver', repo: 'caddy' };
|
||||
const { data: releases } = await github.rest.repos.listReleases({
|
||||
...upstream,
|
||||
per_page: 50,
|
||||
});
|
||||
const latestV3 = releases.find(r => /^v3\./.test(r.tag_name));
|
||||
if (!latestV3) {
|
||||
core.info('No Caddy v3 release detected.');
|
||||
return;
|
||||
}
|
||||
|
||||
const issueTitle = `Track upgrade to Caddy v3 (${latestV3.tag_name})`;
|
||||
|
||||
const { data: existing } = await github.rest.issues.listForRepo({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
state: 'open',
|
||||
per_page: 100,
|
||||
});
|
||||
|
||||
if (existing.some(i => i.title === issueTitle)) {
|
||||
core.info('Issue already exists — nothing to do.');
|
||||
return;
|
||||
}
|
||||
|
||||
const body = [
|
||||
'Caddy v3 has been released upstream and detected by the scheduled monitor.',
|
||||
'',
|
||||
`Detected release: ${latestV3.tag_name} (${latestV3.html_url})`,
|
||||
'',
|
||||
'- Create a feature branch to evaluate the v3 migration.',
|
||||
'- Review breaking changes and update Docker base images/workflows.',
|
||||
'- Validate Trivy scans and update any policies as needed.',
|
||||
'',
|
||||
'Current policy: remain on latest 2.x until v3 is validated.'
|
||||
].join('\n');
|
||||
|
||||
await github.rest.issues.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: issueTitle,
|
||||
body,
|
||||
});
|
||||
106
.github/workflows/cerberus-integration.yml
vendored
106
.github/workflows/cerberus-integration.yml
vendored
@@ -1,106 +0,0 @@
|
||||
name: Cerberus Integration
|
||||
|
||||
# Phase 2-3: Build Once, Test Many - Use registry image instead of building
|
||||
# This workflow now waits for docker-build.yml to complete and pulls the built image
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag to test (e.g., pr-123-abc1234, latest)'
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
# Prevent race conditions when PR is updated mid-test
|
||||
# Cancels old test runs when new build completes with different SHA
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
cerberus-integration:
|
||||
name: Cerberus Security Stack Integration
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- name: Build Docker image (Local)
|
||||
run: |
|
||||
echo "Building image locally for integration tests..."
|
||||
docker build -t charon:local .
|
||||
echo "✅ Successfully built charon:local"
|
||||
|
||||
- name: Run Cerberus integration tests
|
||||
id: cerberus-test
|
||||
run: |
|
||||
chmod +x scripts/cerberus_integration.sh
|
||||
scripts/cerberus_integration.sh 2>&1 | tee cerberus-test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Dump Debug Info on Failure
|
||||
if: failure()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔍 Debug Information"
|
||||
echo ""
|
||||
|
||||
echo "### Container Status"
|
||||
echo '```'
|
||||
docker ps -a --filter "name=charon" --filter "name=cerberus" --filter "name=backend" 2>&1 || true
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Security Status API"
|
||||
echo '```json'
|
||||
curl -s http://localhost:8480/api/v1/security/status 2>/dev/null | head -100 || echo "Could not retrieve security status"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Caddy Admin Config"
|
||||
echo '```json'
|
||||
curl -s http://localhost:2319/config 2>/dev/null | head -200 || echo "Could not retrieve Caddy config"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Charon Container Logs (last 100 lines)"
|
||||
echo '```'
|
||||
docker logs charon-cerberus-test 2>&1 | tail -100 || echo "No container logs available"
|
||||
echo '```'
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cerberus Integration Summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔱 Cerberus Integration Test Results"
|
||||
if [ "${{ steps.cerberus-test.outcome }}" == "success" ]; then
|
||||
echo "✅ **All Cerberus tests passed**"
|
||||
echo ""
|
||||
echo "### Test Results:"
|
||||
echo '```'
|
||||
grep -E "✓|PASS|TC-[0-9]|=== ALL" cerberus-test-output.txt || echo "See logs for details"
|
||||
echo '```'
|
||||
echo ""
|
||||
echo "### Features Tested:"
|
||||
echo "- WAF (Coraza) payload inspection"
|
||||
echo "- Rate limiting enforcement"
|
||||
echo "- Security handler ordering"
|
||||
echo "- Legitimate traffic flow"
|
||||
else
|
||||
echo "❌ **Cerberus tests failed**"
|
||||
echo ""
|
||||
echo "### Failure Details:"
|
||||
echo '```'
|
||||
grep -E "✗|FAIL|Error|failed" cerberus-test-output.txt | head -30 || echo "See logs for details"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
docker rm -f charon-cerberus-test || true
|
||||
docker rm -f cerberus-backend || true
|
||||
docker volume rm charon_cerberus_test_data caddy_cerberus_test_data caddy_cerberus_test_config 2>/dev/null || true
|
||||
docker network rm containers_default || true
|
||||
103
.github/workflows/codecov-upload.yml
vendored
103
.github/workflows/codecov-upload.yml
vendored
@@ -1,103 +0,0 @@
|
||||
name: Upload Coverage to Codecov
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
- development
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
run_backend:
|
||||
description: 'Run backend coverage upload'
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
run_frontend:
|
||||
description: 'Run frontend coverage upload'
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.run_id }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.7'
|
||||
NODE_VERSION: '24.12.0'
|
||||
GOTOOLCHAIN: auto
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
backend-codecov:
|
||||
name: Backend Codecov Upload
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_backend != 'false' }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ github.sha }}
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Run Go tests with coverage
|
||||
working-directory: ${{ github.workspace }}
|
||||
env:
|
||||
CGO_ENABLED: 1
|
||||
run: |
|
||||
bash scripts/go-test-coverage.sh 2>&1 | tee backend/test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Upload backend coverage to Codecov
|
||||
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
files: ./backend/coverage.txt
|
||||
flags: backend
|
||||
fail_ci_if_error: true
|
||||
|
||||
frontend-codecov:
|
||||
name: Frontend Codecov Upload
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
if: ${{ github.event_name != 'workflow_dispatch' || inputs.run_frontend != 'false' }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ github.sha }}
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: frontend/package-lock.json
|
||||
|
||||
- name: Install dependencies
|
||||
working-directory: frontend
|
||||
run: npm ci
|
||||
|
||||
- name: Run frontend tests and coverage
|
||||
working-directory: ${{ github.workspace }}
|
||||
run: |
|
||||
bash scripts/frontend-test-coverage.sh 2>&1 | tee frontend/test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Upload frontend coverage to Codecov
|
||||
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
directory: ./frontend/coverage
|
||||
flags: frontend
|
||||
fail_ci_if_error: true
|
||||
127
.github/workflows/codeql.yml
vendored
127
.github/workflows/codeql.yml
vendored
@@ -1,127 +0,0 @@
|
||||
name: CodeQL - Analyze
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: '0 3 * * 1' # Mondays 03:00 UTC
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.7'
|
||||
GOTOOLCHAIN: auto
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
security-events: write
|
||||
actions: read
|
||||
pull-requests: read
|
||||
|
||||
jobs:
|
||||
analyze:
|
||||
name: CodeQL analysis (${{ matrix.language }})
|
||||
runs-on: ubuntu-latest
|
||||
# Skip forked PRs where CHARON_TOKEN lacks security-events permissions
|
||||
if: >-
|
||||
(github.event_name != 'workflow_run' || github.event.workflow_run.status != 'completed' || github.event.workflow_run.conclusion == 'success')
|
||||
permissions:
|
||||
contents: read
|
||||
security-events: write
|
||||
actions: read
|
||||
pull-requests: read
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
language: [ 'go', 'javascript-typescript' ]
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
# Use CodeQL config to exclude documented false positives
|
||||
# Go: Excludes go/request-forgery for url_testing.go (has 4-layer SSRF defense)
|
||||
# See: .github/codeql/codeql-config.yml for full justification
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
|
||||
- name: Setup Go
|
||||
if: matrix.language == 'go'
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4
|
||||
with:
|
||||
category: "/language:${{ matrix.language }}"
|
||||
|
||||
- name: Check CodeQL Results
|
||||
if: always()
|
||||
run: |
|
||||
# Find SARIF file (CodeQL action creates it in various locations)
|
||||
SARIF_FILE=$(find "${{ runner.temp }}" -name "*${{ matrix.language }}*.sarif" -type f 2>/dev/null | head -1)
|
||||
|
||||
{
|
||||
echo "## 🔒 CodeQL Security Analysis Results"
|
||||
echo ""
|
||||
echo "**Language:** ${{ matrix.language }}"
|
||||
echo "**Query Suite:** security-and-quality"
|
||||
echo ""
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
if [ -f "$SARIF_FILE" ]; then
|
||||
echo "Found SARIF file: $SARIF_FILE"
|
||||
ERROR_COUNT=$(jq '[.runs[].results[] | select(.level == "error")] | length' "$SARIF_FILE" 2>/dev/null || echo 0)
|
||||
WARNING_COUNT=$(jq '[.runs[].results[] | select(.level == "warning")] | length' "$SARIF_FILE" 2>/dev/null || echo 0)
|
||||
NOTE_COUNT=$(jq '[.runs[].results[] | select(.level == "note")] | length' "$SARIF_FILE" 2>/dev/null || echo 0)
|
||||
|
||||
{
|
||||
echo "**Findings:**"
|
||||
echo "- 🔴 Errors: $ERROR_COUNT"
|
||||
echo "- 🟡 Warnings: $WARNING_COUNT"
|
||||
echo "- 🔵 Notes: $NOTE_COUNT"
|
||||
echo ""
|
||||
|
||||
if [ "$ERROR_COUNT" -gt 0 ]; then
|
||||
echo "❌ **CRITICAL:** High-severity security issues found!"
|
||||
echo ""
|
||||
echo "### Top Issues:"
|
||||
echo '```'
|
||||
jq -r '.runs[].results[] | select(.level == "error") | "\(.ruleId): \(.message.text)"' "$SARIF_FILE" 2>/dev/null | head -5
|
||||
echo '```'
|
||||
else
|
||||
echo "✅ No high-severity issues found"
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
else
|
||||
echo "⚠️ SARIF file not found - check analysis logs" >> "$GITHUB_STEP_SUMMARY"
|
||||
fi
|
||||
|
||||
{
|
||||
echo ""
|
||||
echo "View full results in the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning)"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Fail on High-Severity Findings
|
||||
if: always()
|
||||
run: |
|
||||
SARIF_FILE=$(find "${{ runner.temp }}" -name "*${{ matrix.language }}*.sarif" -type f 2>/dev/null | head -1)
|
||||
|
||||
if [ -f "$SARIF_FILE" ]; then
|
||||
ERROR_COUNT=$(jq '[.runs[].results[] | select(.level == "error")] | length' "$SARIF_FILE" 2>/dev/null || echo 0)
|
||||
|
||||
if [ "$ERROR_COUNT" -gt 0 ]; then
|
||||
echo "::error::CodeQL found $ERROR_COUNT high-severity security issues. Fix before merging."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
110
.github/workflows/container-prune.yml
vendored
110
.github/workflows/container-prune.yml
vendored
@@ -1,110 +0,0 @@
|
||||
name: Container Registry Prune
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 3 * * 0' # Weekly: Sundays at 03:00 UTC
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
registries:
|
||||
description: 'Comma-separated registries to prune (ghcr,dockerhub)'
|
||||
required: false
|
||||
default: 'ghcr,dockerhub'
|
||||
keep_days:
|
||||
description: 'Number of days to retain images (unprotected)'
|
||||
required: false
|
||||
default: '30'
|
||||
dry_run:
|
||||
description: 'If true, only logs candidates and does not delete (default: false for active cleanup)'
|
||||
required: false
|
||||
default: 'false'
|
||||
keep_last_n:
|
||||
description: 'Keep last N newest images (global)'
|
||||
required: false
|
||||
default: '30'
|
||||
|
||||
permissions:
|
||||
packages: write
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
prune:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
OWNER: ${{ github.repository_owner }}
|
||||
IMAGE_NAME: charon
|
||||
REGISTRIES: ${{ github.event.inputs.registries || 'ghcr,dockerhub' }}
|
||||
KEEP_DAYS: ${{ github.event.inputs.keep_days || '30' }}
|
||||
KEEP_LAST_N: ${{ github.event.inputs.keep_last_n || '30' }}
|
||||
DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
|
||||
PROTECTED_REGEX: '["^v","^latest$","^main$","^develop$"]'
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Install tools
|
||||
run: |
|
||||
sudo apt-get update && sudo apt-get install -y jq curl
|
||||
|
||||
- name: Run container prune
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
run: |
|
||||
chmod +x scripts/prune-container-images.sh
|
||||
./scripts/prune-container-images.sh 2>&1 | tee prune-${{ github.run_id }}.log
|
||||
|
||||
- name: Summarize prune results (space reclaimed)
|
||||
if: ${{ always() }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
SUMMARY_FILE=prune-summary.env
|
||||
LOG_FILE=prune-${{ github.run_id }}.log
|
||||
|
||||
human() {
|
||||
local bytes=${1:-0}
|
||||
if [ -z "$bytes" ] || [ "$bytes" -eq 0 ]; then
|
||||
echo "0 B"
|
||||
return
|
||||
fi
|
||||
awk -v b="$bytes" 'function human(x){ split("B KiB MiB GiB TiB",u," "); i=0; while(x>1024){x/=1024;i++} printf "%0.2f %s", x, u[i+1]} END{human(b)}'
|
||||
}
|
||||
|
||||
if [ -f "$SUMMARY_FILE" ]; then
|
||||
TOTAL_CANDIDATES=$(grep -E '^TOTAL_CANDIDATES=' "$SUMMARY_FILE" | cut -d= -f2 || echo 0)
|
||||
TOTAL_CANDIDATES_BYTES=$(grep -E '^TOTAL_CANDIDATES_BYTES=' "$SUMMARY_FILE" | cut -d= -f2 || echo 0)
|
||||
TOTAL_DELETED=$(grep -E '^TOTAL_DELETED=' "$SUMMARY_FILE" | cut -d= -f2 || echo 0)
|
||||
TOTAL_DELETED_BYTES=$(grep -E '^TOTAL_DELETED_BYTES=' "$SUMMARY_FILE" | cut -d= -f2 || echo 0)
|
||||
|
||||
{
|
||||
echo "## Container prune summary"
|
||||
echo "- candidates: ${TOTAL_CANDIDATES} (≈ $(human "${TOTAL_CANDIDATES_BYTES}"))"
|
||||
echo "- deleted: ${TOTAL_DELETED} (≈ $(human "${TOTAL_DELETED_BYTES}"))"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
printf 'PRUNE_SUMMARY: candidates=%s candidates_bytes=%s deleted=%s deleted_bytes=%s\n' \
|
||||
"${TOTAL_CANDIDATES}" "${TOTAL_CANDIDATES_BYTES}" "${TOTAL_DELETED}" "${TOTAL_DELETED_BYTES}"
|
||||
echo "Deleted approximately: $(human "${TOTAL_DELETED_BYTES}")"
|
||||
echo "space_saved=$(human "${TOTAL_DELETED_BYTES}")" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
deleted_bytes=$(grep -oE '\( *approx +[0-9]+ bytes\)' "$LOG_FILE" | sed -E 's/.*approx +([0-9]+) bytes.*/\1/' | awk '{s+=$1} END {print s+0}' || true)
|
||||
deleted_count=$(grep -cE 'deleting |DRY RUN: would delete' "$LOG_FILE" || true)
|
||||
|
||||
{
|
||||
echo "## Container prune summary"
|
||||
echo "- deleted (approx): ${deleted_count} (≈ $(human "${deleted_bytes}"))"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
printf 'PRUNE_SUMMARY: deleted_approx=%s deleted_bytes=%s\n' "${deleted_count}" "${deleted_bytes}"
|
||||
echo "Deleted approximately: $(human "${deleted_bytes}")"
|
||||
echo "space_saved=$(human "${deleted_bytes}")" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Upload prune artifacts
|
||||
if: ${{ always() }}
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: prune-log-${{ github.run_id }}
|
||||
path: |
|
||||
prune-${{ github.run_id }}.log
|
||||
prune-summary.env
|
||||
82
.github/workflows/create-labels.yml
vendored
82
.github/workflows/create-labels.yml
vendored
@@ -1,82 +0,0 @@
|
||||
name: Create Project Labels
|
||||
|
||||
# This workflow only runs manually to set up labels
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
create-labels:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
issues: write
|
||||
steps:
|
||||
- name: Create all project labels
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const labels = [
|
||||
// Priority labels
|
||||
{ name: 'critical', color: 'B60205', description: 'Must have for the release, blocks other work' },
|
||||
{ name: 'high', color: 'D93F0B', description: 'Important feature, should be included' },
|
||||
{ name: 'medium', color: 'FBCA04', description: 'Nice to have, can be deferred' },
|
||||
{ name: 'low', color: '0E8A16', description: 'Future enhancement, not urgent' },
|
||||
|
||||
// Milestone labels
|
||||
{ name: 'alpha', color: '5319E7', description: 'Part of initial alpha release' },
|
||||
{ name: 'beta', color: '0052CC', description: 'Part of beta release' },
|
||||
{ name: 'post-beta', color: '006B75', description: 'Post-beta enhancement' },
|
||||
|
||||
// Category labels
|
||||
{ name: 'architecture', color: 'C5DEF5', description: 'System design and structure' },
|
||||
{ name: 'backend', color: '1D76DB', description: 'Server-side code' },
|
||||
{ name: 'frontend', color: '5EBEFF', description: 'UI/UX code' },
|
||||
{ name: 'feature', color: 'A2EEEF', description: 'New functionality' },
|
||||
{ name: 'security', color: 'EE0701', description: 'Security-related' },
|
||||
{ name: 'ssl', color: 'F9D0C4', description: 'SSL/TLS certificates' },
|
||||
{ name: 'sso', color: 'D4C5F9', description: 'Single Sign-On' },
|
||||
{ name: 'waf', color: 'B60205', description: 'Web Application Firewall' },
|
||||
{ name: 'crowdsec', color: 'FF6B6B', description: 'CrowdSec integration' },
|
||||
{ name: 'caddy', color: '1F6FEB', description: 'Caddy-specific' },
|
||||
{ name: 'database', color: '006B75', description: 'Database-related' },
|
||||
{ name: 'ui', color: '7057FF', description: 'User interface' },
|
||||
{ name: 'deployment', color: '0E8A16', description: 'Docker, installation' },
|
||||
{ name: 'monitoring', color: 'FEF2C0', description: 'Logging and statistics' },
|
||||
{ name: 'documentation', color: '0075CA', description: 'Docs and guides' },
|
||||
{ name: 'testing', color: 'BFD4F2', description: 'Test suite' },
|
||||
{ name: 'performance', color: 'EDEDED', description: 'Optimization' },
|
||||
{ name: 'community', color: 'D876E3', description: 'Community building' },
|
||||
{ name: 'plus', color: 'FFD700', description: 'Premium/"Plus" feature' },
|
||||
{ name: 'enterprise', color: '8B4513', description: 'Enterprise-grade feature' }
|
||||
];
|
||||
|
||||
for (const label of labels) {
|
||||
try {
|
||||
await github.rest.issues.createLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: label.name,
|
||||
color: label.color,
|
||||
description: label.description
|
||||
});
|
||||
console.log(`✓ Created label: ${label.name}`);
|
||||
} catch (error) {
|
||||
if (error.status === 422) {
|
||||
console.log(`⚠ Label already exists: ${label.name}`);
|
||||
// Update the label if it exists
|
||||
await github.rest.issues.updateLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: label.name,
|
||||
color: label.color,
|
||||
description: label.description
|
||||
});
|
||||
console.log(`✓ Updated label: ${label.name}`);
|
||||
} else {
|
||||
console.error(`✗ Error creating label ${label.name}:`, error.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
133
.github/workflows/crowdsec-integration.yml
vendored
133
.github/workflows/crowdsec-integration.yml
vendored
@@ -1,133 +0,0 @@
|
||||
name: CrowdSec Integration
|
||||
|
||||
# Phase 2-3: Build Once, Test Many - Use registry image instead of building
|
||||
# This workflow now waits for docker-build.yml to complete and pulls the built image
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag to test (e.g., pr-123-abc1234, latest)'
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
# Prevent race conditions when PR is updated mid-test
|
||||
# Cancels old test runs when new build completes with different SHA
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
crowdsec-integration:
|
||||
name: CrowdSec Bouncer Integration
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- name: Build Docker image (Local)
|
||||
run: |
|
||||
echo "Building image locally for integration tests..."
|
||||
docker build -t charon:local .
|
||||
echo "✅ Successfully built charon:local"
|
||||
|
||||
- name: Run CrowdSec integration tests
|
||||
id: crowdsec-test
|
||||
run: |
|
||||
chmod +x .github/skills/scripts/skill-runner.sh
|
||||
.github/skills/scripts/skill-runner.sh integration-test-crowdsec 2>&1 | tee crowdsec-test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Run CrowdSec Startup and LAPI Tests
|
||||
id: lapi-test
|
||||
run: |
|
||||
chmod +x .github/skills/scripts/skill-runner.sh
|
||||
.github/skills/scripts/skill-runner.sh integration-test-crowdsec-startup 2>&1 | tee lapi-test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Dump Debug Info on Failure
|
||||
if: failure()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔍 Debug Information"
|
||||
echo ""
|
||||
|
||||
echo "### Container Status"
|
||||
echo '```'
|
||||
docker ps -a --filter "name=charon" --filter "name=crowdsec" 2>&1 || true
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
# Check which test container exists and dump its logs
|
||||
if docker ps -a --filter "name=charon-crowdsec-startup-test" --format "{{.Names}}" | grep -q "charon-crowdsec-startup-test"; then
|
||||
echo "### Charon Startup Test Container Logs (last 100 lines)"
|
||||
echo '```'
|
||||
docker logs charon-crowdsec-startup-test 2>&1 | tail -100 || echo "No container logs available"
|
||||
echo '```'
|
||||
elif docker ps -a --filter "name=charon-debug" --format "{{.Names}}" | grep -q "charon-debug"; then
|
||||
echo "### Charon Container Logs (last 100 lines)"
|
||||
echo '```'
|
||||
docker logs charon-debug 2>&1 | tail -100 || echo "No container logs available"
|
||||
echo '```'
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Check for CrowdSec specific logs if LAPI test ran
|
||||
if [ -f "lapi-test-output.txt" ]; then
|
||||
echo "### CrowdSec LAPI Test Failures"
|
||||
echo '```'
|
||||
grep -E "✗ FAIL|✗ CRITICAL|CROWDSEC.*BROKEN" lapi-test-output.txt 2>&1 || echo "No critical failures found in LAPI test"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: CrowdSec Integration Summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🛡️ CrowdSec Integration Test Results"
|
||||
|
||||
# CrowdSec Preset Integration Tests
|
||||
if [ "${{ steps.crowdsec-test.outcome }}" == "success" ]; then
|
||||
echo "✅ **CrowdSec Hub Presets: Passed**"
|
||||
echo ""
|
||||
echo "### Preset Test Results:"
|
||||
echo '```'
|
||||
grep -E "^✓|^===|^Pull|^Apply" crowdsec-test-output.txt || echo "See logs for details"
|
||||
echo '```'
|
||||
else
|
||||
echo "❌ **CrowdSec Hub Presets: Failed**"
|
||||
echo ""
|
||||
echo "### Preset Failure Details:"
|
||||
echo '```'
|
||||
grep -E "^✗|Unexpected|Error|failed|FAIL" crowdsec-test-output.txt | head -20 || echo "See logs for details"
|
||||
echo '```'
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
# CrowdSec Startup and LAPI Tests
|
||||
if [ "${{ steps.lapi-test.outcome }}" == "success" ]; then
|
||||
echo "✅ **CrowdSec Startup & LAPI: Passed**"
|
||||
echo ""
|
||||
echo "### LAPI Test Results:"
|
||||
echo '```'
|
||||
grep -E "^\[TEST\]|✓ PASS|Check [0-9]|CrowdSec LAPI" lapi-test-output.txt || echo "See logs for details"
|
||||
echo '```'
|
||||
else
|
||||
echo "❌ **CrowdSec Startup & LAPI: Failed**"
|
||||
echo ""
|
||||
echo "### LAPI Failure Details:"
|
||||
echo '```'
|
||||
grep -E "✗ FAIL|✗ CRITICAL|Error|failed" lapi-test-output.txt | head -20 || echo "See logs for details"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
docker rm -f charon-debug || true
|
||||
docker rm -f charon-crowdsec-startup-test || true
|
||||
docker rm -f crowdsec || true
|
||||
docker network rm containers_default || true
|
||||
822
.github/workflows/docker-build.yml
vendored
822
.github/workflows/docker-build.yml
vendored
@@ -1,822 +0,0 @@
|
||||
name: Docker Build, Publish & Test
|
||||
|
||||
# This workflow replaced .github/workflows/docker-publish.yml (deleted in commit f640524b on Dec 21, 2025)
|
||||
# Enhancements over the previous workflow:
|
||||
# - SBOM generation and attestation for supply chain security
|
||||
# - CVE-2025-68156 verification for Caddy security patches
|
||||
# - Enhanced PR handling with dedicated scanning
|
||||
# - Improved workflow orchestration with supply-chain-verify.yml
|
||||
#
|
||||
# PHASE 1 OPTIMIZATION (February 2026):
|
||||
# - PR images now pushed to GHCR registry (enables downstream workflow consumption)
|
||||
# - Immutable PR tagging: pr-{number}-{short-sha} (prevents race conditions)
|
||||
# - Feature branch tagging: {sanitized-branch-name}-{short-sha} (enables unique testing)
|
||||
# - Tag sanitization per spec Section 3.2 (handles special chars, slashes, etc.)
|
||||
# - Mandatory security scanning for PR images (blocks on CRITICAL/HIGH vulnerabilities)
|
||||
# - Retry logic for registry pushes (3 attempts, 10s wait - handles transient failures)
|
||||
# - Enhanced metadata labels for image freshness validation
|
||||
# - Artifact upload retained as fallback during migration period
|
||||
# - Reduced build timeout from 30min to 25min for faster feedback (with retry buffer)
|
||||
#
|
||||
# See: docs/plans/current_spec.md (Section 4.1 - docker-build.yml changes)
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
- development
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
GHCR_REGISTRY: ghcr.io
|
||||
DOCKERHUB_REGISTRY: docker.io
|
||||
IMAGE_NAME: wikid82/charon
|
||||
TRIGGER_EVENT: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.event || github.event_name }}
|
||||
TRIGGER_HEAD_BRANCH: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref_name }}
|
||||
TRIGGER_HEAD_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
|
||||
TRIGGER_REF: ${{ github.event_name == 'workflow_run' && format('refs/heads/{0}', github.event.workflow_run.head_branch) || github.ref }}
|
||||
TRIGGER_HEAD_REF: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.head_ref }}
|
||||
TRIGGER_PR_NUMBER: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number || github.event.pull_request.number }}
|
||||
TRIGGER_ACTOR: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.actor.login || github.actor }}
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
if: ${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.name == 'Docker Lint' && github.event.workflow_run.path == '.github/workflows/docker-lint.yml') }}
|
||||
env:
|
||||
HAS_DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN != '' }}
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20 # Phase 1: Reduced timeout for faster feedback
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
security-events: write
|
||||
id-token: write # Required for SBOM attestation
|
||||
attestations: write # Required for SBOM attestation
|
||||
|
||||
outputs:
|
||||
skip_build: ${{ steps.skip.outputs.skip_build }}
|
||||
digest: ${{ steps.build-and-push.outputs.digest }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
ref: ${{ env.TRIGGER_HEAD_SHA }}
|
||||
- name: Normalize image name
|
||||
run: |
|
||||
IMAGE_NAME=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
|
||||
echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
|
||||
- name: Determine skip condition
|
||||
id: skip
|
||||
env:
|
||||
ACTOR: ${{ env.TRIGGER_ACTOR }}
|
||||
EVENT: ${{ env.TRIGGER_EVENT }}
|
||||
REF: ${{ env.TRIGGER_REF }}
|
||||
HEAD_REF: ${{ env.TRIGGER_HEAD_REF }}
|
||||
PR_NUMBER: ${{ env.TRIGGER_PR_NUMBER }}
|
||||
REPO: ${{ github.repository }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
should_skip=false
|
||||
pr_title=""
|
||||
head_msg=$(git log -1 --pretty=%s)
|
||||
if [ "$EVENT" = "pull_request" ] && [ -n "$PR_NUMBER" ]; then
|
||||
pr_title=$(curl -sS \
|
||||
-H "Authorization: Bearer ${GH_TOKEN}" \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
"https://api.github.com/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.title // empty')
|
||||
fi
|
||||
if [ "$ACTOR" = "renovate[bot]" ]; then should_skip=true; fi
|
||||
if echo "$head_msg" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
|
||||
if echo "$head_msg" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
|
||||
if echo "$pr_title" | grep -Ei '^chore\(deps' >/dev/null 2>&1; then should_skip=true; fi
|
||||
if echo "$pr_title" | grep -Ei '^chore:' >/dev/null 2>&1; then should_skip=true; fi
|
||||
# Always build on feature branches to ensure artifacts for testing
|
||||
# For PRs: use HEAD_REF (actual source branch)
|
||||
# For pushes: use REF (refs/heads/branch-name)
|
||||
is_feature_push=false
|
||||
if [[ "$EVENT" != "pull_request" && "$REF" == refs/heads/feature/* ]]; then
|
||||
should_skip=false
|
||||
is_feature_push=true
|
||||
echo "Force building on feature branch (push)"
|
||||
elif [[ "$HEAD_REF" == feature/* ]]; then
|
||||
should_skip=false
|
||||
echo "Force building on feature branch (PR)"
|
||||
fi
|
||||
|
||||
echo "skip_build=$should_skip" >> "$GITHUB_OUTPUT"
|
||||
echo "is_feature_push=$is_feature_push" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Set up QEMU
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
||||
- name: Set up Docker Buildx
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
- name: Resolve Alpine base image digest
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
id: caddy
|
||||
run: |
|
||||
docker pull alpine:3.23.3
|
||||
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' alpine:3.23.3)
|
||||
echo "image=$DIGEST" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ${{ env.GHCR_REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
if: steps.skip.outputs.skip_build != 'true' && env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: docker.io
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Compute branch tags
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
id: branch-tags
|
||||
run: |
|
||||
if [[ "$TRIGGER_EVENT" == "pull_request" ]]; then
|
||||
BRANCH_NAME="${TRIGGER_HEAD_REF}"
|
||||
else
|
||||
BRANCH_NAME="${TRIGGER_REF#refs/heads/}"
|
||||
fi
|
||||
SHORT_SHA="$(echo "${{ env.TRIGGER_HEAD_SHA }}" | cut -c1-7)"
|
||||
|
||||
sanitize_tag() {
|
||||
local raw="$1"
|
||||
local max_len="$2"
|
||||
|
||||
local sanitized
|
||||
sanitized=$(echo "$raw" | tr '[:upper:]' '[:lower:]')
|
||||
sanitized=${sanitized//[^a-z0-9-]/-}
|
||||
while [[ "$sanitized" == *"--"* ]]; do
|
||||
sanitized=${sanitized//--/-}
|
||||
done
|
||||
sanitized=${sanitized##[^a-z0-9]*}
|
||||
sanitized=${sanitized%%[^a-z0-9-]*}
|
||||
|
||||
if [ -z "$sanitized" ]; then
|
||||
sanitized="branch"
|
||||
fi
|
||||
|
||||
sanitized=$(echo "$sanitized" | cut -c1-"$max_len")
|
||||
sanitized=${sanitized##[^a-z0-9]*}
|
||||
if [ -z "$sanitized" ]; then
|
||||
sanitized="branch"
|
||||
fi
|
||||
|
||||
echo "$sanitized"
|
||||
}
|
||||
|
||||
SANITIZED_BRANCH=$(sanitize_tag "${BRANCH_NAME}" 128)
|
||||
BASE_BRANCH=$(sanitize_tag "${BRANCH_NAME}" 120)
|
||||
BRANCH_SHA_TAG="${BASE_BRANCH}-${SHORT_SHA}"
|
||||
|
||||
if [[ "$TRIGGER_EVENT" == "pull_request" ]]; then
|
||||
if [[ "$BRANCH_NAME" == feature/* ]]; then
|
||||
echo "pr_feature_branch_sha_tag=${BRANCH_SHA_TAG}" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
else
|
||||
echo "branch_sha_tag=${BRANCH_SHA_TAG}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
if [[ "$TRIGGER_REF" == refs/heads/feature/* ]]; then
|
||||
echo "feature_branch_tag=${SANITIZED_BRANCH}" >> "$GITHUB_OUTPUT"
|
||||
echo "feature_branch_sha_tag=${BRANCH_SHA_TAG}" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
fi
|
||||
|
||||
- name: Generate Docker metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
|
||||
with:
|
||||
images: |
|
||||
${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=semver,pattern={{major}}.{{minor}}
|
||||
type=semver,pattern={{major}}
|
||||
type=raw,value=latest,enable=${{ env.TRIGGER_REF == 'refs/heads/main' }}
|
||||
type=raw,value=dev,enable=${{ env.TRIGGER_REF == 'refs/heads/development' }}
|
||||
type=raw,value=nightly,enable=${{ env.TRIGGER_REF == 'refs/heads/nightly' }}
|
||||
type=raw,value=${{ steps.branch-tags.outputs.pr_feature_branch_sha_tag }},enable=${{ env.TRIGGER_EVENT == 'pull_request' && steps.branch-tags.outputs.pr_feature_branch_sha_tag != '' }}
|
||||
type=raw,value=${{ steps.branch-tags.outputs.feature_branch_tag }},enable=${{ env.TRIGGER_EVENT != 'pull_request' && startsWith(env.TRIGGER_REF, 'refs/heads/feature/') && steps.branch-tags.outputs.feature_branch_tag != '' }}
|
||||
type=raw,value=${{ steps.branch-tags.outputs.branch_sha_tag }},enable=${{ env.TRIGGER_EVENT != 'pull_request' && steps.branch-tags.outputs.branch_sha_tag != '' }}
|
||||
type=raw,value=pr-${{ env.TRIGGER_PR_NUMBER }}-{{sha}},enable=${{ env.TRIGGER_EVENT == 'pull_request' }},prefix=,suffix=
|
||||
type=sha,format=short,prefix=,suffix=,enable=${{ env.TRIGGER_EVENT != 'pull_request' && (env.TRIGGER_REF == 'refs/heads/main' || env.TRIGGER_REF == 'refs/heads/development' || env.TRIGGER_REF == 'refs/heads/nightly') }}
|
||||
flavor: |
|
||||
latest=false
|
||||
labels: |
|
||||
org.opencontainers.image.revision=${{ env.TRIGGER_HEAD_SHA }}
|
||||
io.charon.pr.number=${{ env.TRIGGER_PR_NUMBER }}
|
||||
io.charon.build.timestamp=${{ github.event.repository.updated_at }}
|
||||
io.charon.feature.branch=${{ steps.branch-tags.outputs.feature_branch_tag }}
|
||||
# Phase 1 Optimization: Build once, test many
|
||||
# - For PRs: Multi-platform (amd64, arm64) + immutable tags (pr-{number}-{short-sha})
|
||||
# - For feature branches: Multi-platform (amd64, arm64) + sanitized tags ({branch}-{short-sha})
|
||||
# - For main/dev: Multi-platform (amd64, arm64) for production
|
||||
# - Always push to registry (enables downstream workflow consumption)
|
||||
# - Retry logic handles transient registry failures (3 attempts, 10s wait)
|
||||
# See: docs/plans/current_spec.md Section 4.1
|
||||
- name: Build and push Docker image (with retry)
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
id: build-and-push
|
||||
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
|
||||
with:
|
||||
timeout_minutes: 25
|
||||
max_attempts: 3
|
||||
retry_wait_seconds: 10
|
||||
retry_on: error
|
||||
warning_on_retry: true
|
||||
command: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "🔨 Building Docker image with retry logic..."
|
||||
PLATFORMS="linux/amd64,linux/arm64"
|
||||
echo "Platform: ${PLATFORMS}"
|
||||
|
||||
# Build tag arguments array from metadata output (properly quoted)
|
||||
TAG_ARGS_ARRAY=()
|
||||
while IFS= read -r tag; do
|
||||
[[ -n "$tag" ]] && TAG_ARGS_ARRAY+=("--tag" "$tag")
|
||||
done <<< "${{ steps.meta.outputs.tags }}"
|
||||
|
||||
# Build label arguments array from metadata output (properly quoted)
|
||||
LABEL_ARGS_ARRAY=()
|
||||
while IFS= read -r label; do
|
||||
[[ -n "$label" ]] && LABEL_ARGS_ARRAY+=("--label" "$label")
|
||||
done <<< "${{ steps.meta.outputs.labels }}"
|
||||
|
||||
# Build the complete command as an array (handles spaces in label values correctly)
|
||||
BUILD_CMD=(
|
||||
docker buildx build
|
||||
--platform "${PLATFORMS}"
|
||||
--push
|
||||
"${TAG_ARGS_ARRAY[@]}"
|
||||
"${LABEL_ARGS_ARRAY[@]}"
|
||||
--no-cache
|
||||
--pull
|
||||
--build-arg "VERSION=${{ steps.meta.outputs.version }}"
|
||||
--build-arg "BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}"
|
||||
--build-arg "VCS_REF=${{ env.TRIGGER_HEAD_SHA }}"
|
||||
--build-arg "CADDY_IMAGE=${{ steps.caddy.outputs.image }}"
|
||||
--iidfile /tmp/image-digest.txt
|
||||
.
|
||||
)
|
||||
|
||||
# Execute build
|
||||
echo "Executing: ${BUILD_CMD[*]}"
|
||||
"${BUILD_CMD[@]}"
|
||||
|
||||
# Extract digest for downstream jobs (format: sha256:xxxxx)
|
||||
DIGEST=$(cat /tmp/image-digest.txt)
|
||||
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Build complete. Digest: ${DIGEST}"
|
||||
|
||||
# For PRs only, pull the image back locally for artifact creation
|
||||
# Feature branches now build multi-platform and cannot be loaded locally
|
||||
# This enables backward compatibility with workflows that use artifacts
|
||||
if [[ "${{ env.TRIGGER_EVENT }}" == "pull_request" ]]; then
|
||||
echo "📥 Pulling image back for artifact creation..."
|
||||
FIRST_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
|
||||
docker pull "${FIRST_TAG}"
|
||||
echo "✅ Image pulled: ${FIRST_TAG}"
|
||||
fi
|
||||
|
||||
# Critical Fix: Use exact tag from metadata instead of manual reconstruction
|
||||
# WHY: docker/build-push-action with load:true applies the exact tags from
|
||||
# docker/metadata-action. Manual reconstruction can cause mismatches due to:
|
||||
# - Case sensitivity variations (owner name normalization)
|
||||
# - Tag format differences in Buildx internal behavior
|
||||
# - Registry prefix inconsistencies
|
||||
#
|
||||
# SOLUTION: Extract the first tag from metadata output (which is the PR tag)
|
||||
# and use it directly with docker save. This guarantees we reference the
|
||||
# exact image that was loaded into the local Docker daemon.
|
||||
#
|
||||
# VALIDATION: Added defensive checks to fail fast with diagnostics if:
|
||||
# 1. No tag found in metadata output
|
||||
# 2. Image doesn't exist locally after build
|
||||
# 3. Artifact creation fails
|
||||
- name: Save Docker Image as Artifact
|
||||
if: success() && steps.skip.outputs.skip_build != 'true' && env.TRIGGER_EVENT == 'pull_request'
|
||||
run: |
|
||||
# Extract the first tag from metadata action (PR tag)
|
||||
IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n 1)
|
||||
|
||||
if [[ -z "${IMAGE_TAG}" ]]; then
|
||||
echo "❌ ERROR: No image tag found in metadata output"
|
||||
echo "Metadata tags output:"
|
||||
echo "${{ steps.meta.outputs.tags }}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🔍 Detected image tag: ${IMAGE_TAG}"
|
||||
|
||||
# Verify the image exists locally
|
||||
if ! docker image inspect "${IMAGE_TAG}" >/dev/null 2>&1; then
|
||||
echo "❌ ERROR: Image ${IMAGE_TAG} not found locally"
|
||||
echo "📋 Available images:"
|
||||
docker images
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Save the image using the exact tag from metadata
|
||||
echo "💾 Saving image: ${IMAGE_TAG}"
|
||||
docker save "${IMAGE_TAG}" -o /tmp/charon-pr-image.tar
|
||||
|
||||
# Verify the artifact was created
|
||||
echo "✅ Artifact created:"
|
||||
ls -lh /tmp/charon-pr-image.tar
|
||||
|
||||
- name: Upload Image Artifact
|
||||
if: success() && steps.skip.outputs.skip_build != 'true' && env.TRIGGER_EVENT == 'pull_request'
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
||||
with:
|
||||
name: ${{ env.TRIGGER_EVENT == 'pull_request' && format('pr-image-{0}', env.TRIGGER_PR_NUMBER) || 'push-image' }}
|
||||
path: /tmp/charon-pr-image.tar
|
||||
retention-days: 1 # Only needed for workflow duration
|
||||
|
||||
- name: Verify Caddy Security Patches (CVE-2025-68156)
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
timeout-minutes: 2
|
||||
continue-on-error: true
|
||||
run: |
|
||||
echo "🔍 Verifying Caddy binary contains patched expr-lang/expr@v1.17.7..."
|
||||
echo ""
|
||||
|
||||
# Determine the image reference based on event type
|
||||
if [ "${{ env.TRIGGER_EVENT }}" = "pull_request" ]; then
|
||||
PR_NUM="${{ env.TRIGGER_PR_NUMBER }}"
|
||||
if [ -z "${PR_NUM}" ]; then
|
||||
echo "❌ ERROR: Pull request number is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${PR_NUM}"
|
||||
echo "Using PR image: $IMAGE_REF"
|
||||
else
|
||||
if [ -z "${{ steps.build-and-push.outputs.digest }}" ]; then
|
||||
echo "❌ ERROR: Build digest is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}"
|
||||
echo "Using digest: $IMAGE_REF"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "==> Caddy version:"
|
||||
timeout 30s docker run --rm --pull=never "$IMAGE_REF" caddy version || echo "⚠️ Caddy version check timed out or failed"
|
||||
|
||||
echo ""
|
||||
echo "==> Extracting Caddy binary for inspection..."
|
||||
CONTAINER_ID=$(docker create --pull=never "$IMAGE_REF")
|
||||
docker cp "${CONTAINER_ID}:/usr/bin/caddy" ./caddy_binary
|
||||
docker rm "$CONTAINER_ID"
|
||||
|
||||
# Determine the image reference based on event type
|
||||
if [ "${{ env.TRIGGER_EVENT }}" = "pull_request" ]; then
|
||||
PR_NUM="${{ env.TRIGGER_PR_NUMBER }}"
|
||||
if [ -z "${PR_NUM}" ]; then
|
||||
echo "❌ ERROR: Pull request number is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${PR_NUM}"
|
||||
echo "Using PR image: $IMAGE_REF"
|
||||
else
|
||||
if [ -z "${{ steps.build-and-push.outputs.digest }}" ]; then
|
||||
echo "❌ ERROR: Build digest is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}"
|
||||
echo "Using digest: $IMAGE_REF"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "==> Checking if Go toolchain is available locally..."
|
||||
if command -v go >/dev/null 2>&1; then
|
||||
echo "✅ Go found locally, inspecting binary dependencies..."
|
||||
go version -m ./caddy_binary > caddy_deps.txt
|
||||
|
||||
echo ""
|
||||
echo "==> Searching for expr-lang/expr dependency:"
|
||||
if grep -i "expr-lang/expr" caddy_deps.txt; then
|
||||
EXPR_VERSION=$(grep "expr-lang/expr" caddy_deps.txt | awk '{print $3}')
|
||||
echo ""
|
||||
echo "✅ Found expr-lang/expr: $EXPR_VERSION"
|
||||
|
||||
# Check if version is v1.17.7 or higher (vulnerable version is v1.16.9)
|
||||
if echo "$EXPR_VERSION" | grep -E "^v1\.(1[7-9]|[2-9][0-9])\.[0-9]+$" >/dev/null; then
|
||||
echo "✅ PASS: expr-lang version $EXPR_VERSION is patched (>= v1.17.7)"
|
||||
else
|
||||
echo "⚠️ WARNING: expr-lang version $EXPR_VERSION may be vulnerable (< v1.17.7)"
|
||||
echo "Expected: v1.17.7 or higher to mitigate CVE-2025-68156"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "⚠️ expr-lang/expr not found in binary dependencies"
|
||||
echo "This could mean:"
|
||||
echo " 1. The dependency was stripped/optimized out"
|
||||
echo " 2. Caddy was built without the expression evaluator"
|
||||
echo " 3. Binary inspection failed"
|
||||
echo ""
|
||||
echo "Displaying all dependencies for review:"
|
||||
cat caddy_deps.txt
|
||||
fi
|
||||
else
|
||||
echo "⚠️ Go toolchain not available in CI environment"
|
||||
echo "Cannot inspect binary modules - skipping dependency verification"
|
||||
echo "Note: Runtime image does not require Go as Caddy is a standalone binary"
|
||||
fi
|
||||
|
||||
# Cleanup
|
||||
rm -f ./caddy_binary caddy_deps.txt
|
||||
|
||||
echo ""
|
||||
echo "==> Verification complete"
|
||||
|
||||
- name: Verify CrowdSec Security Patches (CVE-2025-68156)
|
||||
if: success()
|
||||
continue-on-error: true
|
||||
run: |
|
||||
echo "🔍 Verifying CrowdSec binaries contain patched expr-lang/expr@v1.17.7..."
|
||||
echo ""
|
||||
|
||||
# Determine the image reference based on event type
|
||||
if [ "${{ env.TRIGGER_EVENT }}" = "pull_request" ]; then
|
||||
PR_NUM="${{ env.TRIGGER_PR_NUMBER }}"
|
||||
if [ -z "${PR_NUM}" ]; then
|
||||
echo "❌ ERROR: Pull request number is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${PR_NUM}"
|
||||
echo "Using PR image: $IMAGE_REF"
|
||||
else
|
||||
if [ -z "${{ steps.build-and-push.outputs.digest }}" ]; then
|
||||
echo "❌ ERROR: Build digest is empty"
|
||||
exit 1
|
||||
fi
|
||||
IMAGE_REF="${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}"
|
||||
echo "Using digest: $IMAGE_REF"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "==> CrowdSec cscli version:"
|
||||
timeout 30s docker run --rm --pull=never "$IMAGE_REF" cscli version || echo "⚠️ CrowdSec version check timed out or failed (may not be installed for this architecture)"
|
||||
|
||||
echo ""
|
||||
echo "==> Extracting cscli binary for inspection..."
|
||||
CONTAINER_ID=$(docker create --pull=never "$IMAGE_REF")
|
||||
docker cp "${CONTAINER_ID}:/usr/local/bin/cscli" ./cscli_binary 2>/dev/null || {
|
||||
echo "⚠️ cscli binary not found - CrowdSec may not be available for this architecture"
|
||||
docker rm "$CONTAINER_ID"
|
||||
exit 0
|
||||
}
|
||||
docker rm "$CONTAINER_ID"
|
||||
|
||||
echo ""
|
||||
echo "==> Checking if Go toolchain is available locally..."
|
||||
if command -v go >/dev/null 2>&1; then
|
||||
echo "✅ Go found locally, inspecting binary dependencies..."
|
||||
go version -m ./cscli_binary > cscli_deps.txt
|
||||
|
||||
echo ""
|
||||
echo "==> Searching for expr-lang/expr dependency:"
|
||||
if grep -i "expr-lang/expr" cscli_deps.txt; then
|
||||
EXPR_VERSION=$(grep "expr-lang/expr" cscli_deps.txt | awk '{print $3}')
|
||||
echo ""
|
||||
echo "✅ Found expr-lang/expr: $EXPR_VERSION"
|
||||
|
||||
# Check if version is v1.17.7 or higher (vulnerable version is v1.17.2)
|
||||
if echo "$EXPR_VERSION" | grep -E "^v1\.(1[7-9]|[2-9][0-9])\.[7-9][0-9]*$|^v1\.17\.([7-9]|[1-9][0-9]+)$" >/dev/null; then
|
||||
echo "✅ PASS: expr-lang version $EXPR_VERSION is patched (>= v1.17.7)"
|
||||
else
|
||||
echo "❌ FAIL: expr-lang version $EXPR_VERSION is vulnerable (< v1.17.7)"
|
||||
echo "⚠️ WARNING: expr-lang version $EXPR_VERSION may be vulnerable (< v1.17.7)"
|
||||
echo "Expected: v1.17.7 or higher to mitigate CVE-2025-68156"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "⚠️ expr-lang/expr not found in binary dependencies"
|
||||
echo "This could mean:"
|
||||
echo " 1. The dependency was stripped/optimized out"
|
||||
echo " 2. CrowdSec was built without the expression evaluator"
|
||||
echo " 3. Binary inspection failed"
|
||||
echo ""
|
||||
echo "Displaying all dependencies for review:"
|
||||
cat cscli_deps.txt
|
||||
fi
|
||||
else
|
||||
echo "⚠️ Go toolchain not available in CI environment"
|
||||
echo "Cannot inspect binary modules - skipping dependency verification"
|
||||
echo "Note: Runtime image does not require Go as CrowdSec is a standalone binary"
|
||||
fi
|
||||
|
||||
# Cleanup
|
||||
rm -f ./cscli_binary cscli_deps.txt
|
||||
|
||||
echo ""
|
||||
echo "==> CrowdSec verification complete"
|
||||
|
||||
- name: Run Trivy scan (table output)
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
format: 'table'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '0'
|
||||
continue-on-error: true
|
||||
|
||||
- name: Run Trivy vulnerability scanner (SARIF)
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
id: trivy
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
format: 'sarif'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
continue-on-error: true
|
||||
|
||||
- name: Check Trivy SARIF exists
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
id: trivy-check
|
||||
run: |
|
||||
if [ -f trivy-results.sarif ]; then
|
||||
echo "exists=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "exists=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Upload Trivy results
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.trivy-check.outputs.exists == 'true'
|
||||
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# Generate SBOM (Software Bill of Materials) for supply chain security
|
||||
# Only for production builds (main/development) - feature branches use downstream supply-chain-pr.yml
|
||||
- name: Generate SBOM
|
||||
uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
with:
|
||||
image: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
format: cyclonedx-json
|
||||
output-file: sbom.cyclonedx.json
|
||||
|
||||
# Create verifiable attestation for the SBOM
|
||||
- name: Attest SBOM
|
||||
uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3.0.0
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
with:
|
||||
subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
subject-digest: ${{ steps.build-and-push.outputs.digest }}
|
||||
sbom-path: sbom.cyclonedx.json
|
||||
push-to-registry: true
|
||||
|
||||
# Install Cosign for keyless signing
|
||||
- name: Install Cosign
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
|
||||
|
||||
# Sign GHCR image with keyless signing (Sigstore/Fulcio)
|
||||
- name: Sign GHCR Image
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true'
|
||||
run: |
|
||||
echo "Signing GHCR image with keyless signing..."
|
||||
cosign sign --yes ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
echo "✅ GHCR image signed successfully"
|
||||
|
||||
# Sign Docker Hub image with keyless signing (Sigstore/Fulcio)
|
||||
- name: Sign Docker Hub Image
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true' && env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
run: |
|
||||
echo "Signing Docker Hub image with keyless signing..."
|
||||
cosign sign --yes ${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
echo "✅ Docker Hub image signed successfully"
|
||||
|
||||
# Attach SBOM to Docker Hub image
|
||||
- name: Attach SBOM to Docker Hub
|
||||
if: env.TRIGGER_EVENT != 'pull_request' && steps.skip.outputs.skip_build != 'true' && steps.skip.outputs.is_feature_push != 'true' && env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
run: |
|
||||
echo "Attaching SBOM to Docker Hub image..."
|
||||
cosign attach sbom --sbom sbom.cyclonedx.json ${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
|
||||
echo "✅ SBOM attached to Docker Hub image"
|
||||
|
||||
- name: Create summary
|
||||
if: steps.skip.outputs.skip_build != 'true'
|
||||
run: |
|
||||
{
|
||||
echo "## 🎉 Docker Image Built Successfully!"
|
||||
echo ""
|
||||
echo "### 📦 Image Details"
|
||||
echo "- **GHCR**: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}"
|
||||
echo "- **Docker Hub**: ${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}"
|
||||
echo "- **Tags**: "
|
||||
echo '```'
|
||||
echo "${{ steps.meta.outputs.tags }}"
|
||||
echo '```'
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
scan-pr-image:
|
||||
name: Security Scan PR Image
|
||||
needs: build-and-push
|
||||
if: needs.build-and-push.outputs.skip_build != 'true' && needs.build-and-push.result == 'success' && github.event_name == 'pull_request'
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
security-events: write
|
||||
steps:
|
||||
- name: Normalize image name
|
||||
run: |
|
||||
IMAGE_NAME=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')
|
||||
echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Determine PR image tag
|
||||
id: pr-image
|
||||
run: |
|
||||
SHORT_SHA="$(echo "${{ env.TRIGGER_HEAD_SHA }}" | cut -c1-7)"
|
||||
PR_TAG="pr-${{ env.TRIGGER_PR_NUMBER }}-${SHORT_SHA}"
|
||||
echo "tag=${PR_TAG}" >> "$GITHUB_OUTPUT"
|
||||
echo "image_ref=${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${PR_TAG}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ${{ env.GHCR_REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Validate image freshness
|
||||
run: |
|
||||
echo "🔍 Validating image freshness for PR #${{ env.TRIGGER_PR_NUMBER }}..."
|
||||
echo "Expected SHA: ${{ env.TRIGGER_HEAD_SHA }}"
|
||||
echo "Image: ${{ steps.pr-image.outputs.image_ref }}"
|
||||
|
||||
# Pull image to inspect
|
||||
docker pull "${{ steps.pr-image.outputs.image_ref }}"
|
||||
|
||||
# Extract commit SHA from image label
|
||||
LABEL_SHA=$(docker inspect "${{ steps.pr-image.outputs.image_ref }}" \
|
||||
--format '{{index .Config.Labels "org.opencontainers.image.revision"}}')
|
||||
|
||||
echo "Image label SHA: ${LABEL_SHA}"
|
||||
|
||||
if [[ "${LABEL_SHA}" != "${{ env.TRIGGER_HEAD_SHA }}" ]]; then
|
||||
echo "⚠️ WARNING: Image SHA mismatch!"
|
||||
echo " Expected: ${{ env.TRIGGER_HEAD_SHA }}"
|
||||
echo " Got: ${LABEL_SHA}"
|
||||
echo "Image may be stale. Resuming for triage (Bypassing failure)."
|
||||
# exit 1
|
||||
fi
|
||||
|
||||
echo "✅ Image freshness validated"
|
||||
|
||||
- name: Run Trivy scan on PR image (table output)
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ steps.pr-image.outputs.image_ref }}
|
||||
format: 'table'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '0'
|
||||
|
||||
- name: Run Trivy scan on PR image (SARIF - blocking)
|
||||
id: trivy-scan
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ steps.pr-image.outputs.image_ref }}
|
||||
format: 'sarif'
|
||||
output: 'trivy-pr-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1' # Intended to block, but continued on error for now
|
||||
continue-on-error: true
|
||||
|
||||
- name: Upload Trivy scan results
|
||||
if: always()
|
||||
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
|
||||
with:
|
||||
sarif_file: 'trivy-pr-results.sarif'
|
||||
category: 'docker-pr-image'
|
||||
|
||||
- name: Create scan summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔒 PR Image Security Scan"
|
||||
echo ""
|
||||
echo "- **Image**: ${{ steps.pr-image.outputs.image_ref }}"
|
||||
echo "- **PR**: #${{ env.TRIGGER_PR_NUMBER }}"
|
||||
echo "- **Commit**: ${{ env.TRIGGER_HEAD_SHA }}"
|
||||
echo "- **Scan Status**: ${{ steps.trivy-scan.outcome == 'success' && '✅ No critical vulnerabilities' || '❌ Vulnerabilities detected' }}"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
test-image:
|
||||
name: Test Docker Image
|
||||
needs: build-and-push
|
||||
runs-on: ubuntu-latest
|
||||
if: needs.build-and-push.outputs.skip_build != 'true' && needs.build-and-push.result == 'success' && (github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch')
|
||||
env:
|
||||
# Required for security teardown in integration tests
|
||||
CHARON_EMERGENCY_TOKEN: ${{ secrets.CHARON_EMERGENCY_TOKEN }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Normalize image name
|
||||
run: |
|
||||
raw="${{ github.repository_owner }}/${{ github.event.repository.name }}"
|
||||
IMAGE_NAME=$(echo "$raw" | tr '[:upper:]' '[:lower:]')
|
||||
echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"
|
||||
- name: Determine image tag
|
||||
id: tag
|
||||
run: |
|
||||
TRIGGER_REF="${{ env.TRIGGER_REF }}"
|
||||
case "$TRIGGER_REF" in
|
||||
refs/heads/main)
|
||||
echo "tag=latest" >> "$GITHUB_OUTPUT"
|
||||
;;
|
||||
refs/heads/development)
|
||||
echo "tag=dev" >> "$GITHUB_OUTPUT"
|
||||
;;
|
||||
refs/tags/v*)
|
||||
echo "tag=${TRIGGER_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
|
||||
;;
|
||||
*)
|
||||
echo "tag=sha-$(echo "${{ env.TRIGGER_HEAD_SHA }}" | cut -c1-7)" >> "$GITHUB_OUTPUT"
|
||||
;;
|
||||
esac
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Pull Docker image
|
||||
run: docker pull "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}"
|
||||
- name: Create Docker Network
|
||||
run: docker network create charon-test-net
|
||||
|
||||
- name: Run Upstream Service (whoami)
|
||||
run: |
|
||||
docker run -d \
|
||||
--name whoami \
|
||||
--network charon-test-net \
|
||||
traefik/whoami:latest@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab
|
||||
|
||||
- name: Run Charon Container
|
||||
timeout-minutes: 3
|
||||
run: |
|
||||
docker run -d \
|
||||
--name test-container \
|
||||
--network charon-test-net \
|
||||
-p 8080:8080 \
|
||||
-p 80:80 \
|
||||
"${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}"
|
||||
|
||||
# Wait for container to be healthy (max 3 minutes)
|
||||
echo "Waiting for container to start..."
|
||||
timeout 180s bash -c 'until docker exec test-container curl -sf http://localhost:8080/api/v1/health 2>/dev/null | grep -q "status"; do echo "Waiting..."; sleep 2; done' || {
|
||||
echo "❌ Container failed to become healthy"
|
||||
docker logs test-container
|
||||
exit 1
|
||||
}
|
||||
echo "✅ Container is healthy"
|
||||
- name: Run Integration Test
|
||||
timeout-minutes: 5
|
||||
run: .github/skills/scripts/skill-runner.sh integration-test-all
|
||||
|
||||
- name: Check container logs
|
||||
if: always()
|
||||
run: docker logs test-container
|
||||
|
||||
- name: Stop container
|
||||
if: always()
|
||||
run: |
|
||||
docker stop test-container whoami || true
|
||||
docker rm test-container whoami || true
|
||||
docker network rm charon-test-net || true
|
||||
|
||||
- name: Create test summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🧪 Docker Image Test Results"
|
||||
echo ""
|
||||
echo "- **Image**: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.tag }}"
|
||||
echo "- **Integration Test**: ${{ job.status == 'success' && '✅ Passed' || '❌ Failed' }}"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
24
.github/workflows/docker-lint.yml
vendored
24
.github/workflows/docker-lint.yml
vendored
@@ -1,24 +0,0 @@
|
||||
name: Docker Lint
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
hadolint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Run Hadolint
|
||||
uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
|
||||
with:
|
||||
dockerfile: Dockerfile
|
||||
config: .hadolint.yaml
|
||||
failure-threshold: warning
|
||||
378
.github/workflows/docs-to-issues.yml
vendored
378
.github/workflows/docs-to-issues.yml
vendored
@@ -1,378 +0,0 @@
|
||||
name: Convert Docs to Issues
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
|
||||
# Allow manual trigger
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
dry_run:
|
||||
description: 'Dry run (no issues created)'
|
||||
required: false
|
||||
default: false
|
||||
type: boolean
|
||||
file_path:
|
||||
description: 'Specific file to process (optional)'
|
||||
required: false
|
||||
type: string
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
NODE_VERSION: '24.12.0'
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
|
||||
jobs:
|
||||
convert-docs:
|
||||
name: Convert Markdown to Issues
|
||||
runs-on: ubuntu-latest
|
||||
if: github.actor != 'github-actions[bot]' && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success')
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 2
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm install gray-matter
|
||||
|
||||
- name: Detect changed files
|
||||
id: changes
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
env:
|
||||
COMMIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const commitSha = process.env.COMMIT_SHA || context.sha;
|
||||
|
||||
// Manual file specification
|
||||
const manualFile = '${{ github.event.inputs.file_path }}';
|
||||
if (manualFile) {
|
||||
if (fs.existsSync(manualFile)) {
|
||||
core.setOutput('files', JSON.stringify([manualFile]));
|
||||
return;
|
||||
} else {
|
||||
core.setFailed(`File not found: ${manualFile}`);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Get changed files from commit
|
||||
const { data: commit } = await github.rest.repos.getCommit({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
ref: commitSha
|
||||
});
|
||||
|
||||
const changedFiles = (commit.files || [])
|
||||
.filter(f => f.filename.startsWith('docs/issues/'))
|
||||
.filter(f => !f.filename.startsWith('docs/issues/created/'))
|
||||
.filter(f => !f.filename.includes('_TEMPLATE'))
|
||||
.filter(f => !f.filename.includes('README'))
|
||||
.filter(f => f.filename.endsWith('.md'))
|
||||
.filter(f => f.status !== 'removed')
|
||||
.map(f => f.filename);
|
||||
|
||||
console.log('Changed issue files:', changedFiles);
|
||||
core.setOutput('files', JSON.stringify(changedFiles));
|
||||
|
||||
- name: Process issue files
|
||||
id: process
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
env:
|
||||
DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const matter = require('gray-matter');
|
||||
|
||||
const files = JSON.parse('${{ steps.changes.outputs.files }}');
|
||||
const isDryRun = process.env.DRY_RUN === 'true';
|
||||
const createdIssues = [];
|
||||
const errors = [];
|
||||
|
||||
if (files.length === 0) {
|
||||
console.log('No issue files to process');
|
||||
core.setOutput('created_count', 0);
|
||||
core.setOutput('created_issues', '[]');
|
||||
core.setOutput('errors', '[]');
|
||||
return;
|
||||
}
|
||||
|
||||
// Label color map
|
||||
const labelColors = {
|
||||
testing: 'BFD4F2',
|
||||
feature: 'A2EEEF',
|
||||
enhancement: '84B6EB',
|
||||
bug: 'D73A4A',
|
||||
documentation: '0075CA',
|
||||
backend: '1D76DB',
|
||||
frontend: '5EBEFF',
|
||||
security: 'EE0701',
|
||||
ui: '7057FF',
|
||||
caddy: '1F6FEB',
|
||||
'needs-triage': 'FBCA04',
|
||||
acl: 'C5DEF5',
|
||||
regression: 'D93F0B',
|
||||
'manual-testing': 'BFD4F2',
|
||||
'bulk-acl': '006B75',
|
||||
'error-handling': 'D93F0B',
|
||||
'ui-ux': '7057FF',
|
||||
integration: '0E8A16',
|
||||
performance: 'EDEDED',
|
||||
'cross-browser': '5319E7',
|
||||
plus: 'FFD700',
|
||||
beta: '0052CC',
|
||||
alpha: '5319E7',
|
||||
high: 'D93F0B',
|
||||
medium: 'FBCA04',
|
||||
low: '0E8A16',
|
||||
critical: 'B60205',
|
||||
architecture: '006B75',
|
||||
database: '006B75',
|
||||
'post-beta': '006B75'
|
||||
};
|
||||
|
||||
// Helper: Ensure label exists
|
||||
async function ensureLabel(name) {
|
||||
try {
|
||||
await github.rest.issues.getLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: name
|
||||
});
|
||||
} catch (e) {
|
||||
if (e.status === 404) {
|
||||
await github.rest.issues.createLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: name,
|
||||
color: labelColors[name.toLowerCase()] || '666666'
|
||||
});
|
||||
console.log(`Created label: ${name}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Helper: Parse markdown file
|
||||
function parseIssueFile(filePath) {
|
||||
const content = fs.readFileSync(filePath, 'utf8');
|
||||
const { data: frontmatter, content: body } = matter(content);
|
||||
|
||||
// Extract title: frontmatter > first H1 > filename
|
||||
let title = frontmatter.title;
|
||||
if (!title) {
|
||||
const h1Match = body.match(/^#\s+(.+)$/m);
|
||||
title = h1Match ? h1Match[1] : path.basename(filePath, '.md').replace(/-/g, ' ');
|
||||
}
|
||||
|
||||
// Build labels array
|
||||
const labels = [...(frontmatter.labels || [])];
|
||||
if (frontmatter.priority) labels.push(frontmatter.priority);
|
||||
if (frontmatter.type) labels.push(frontmatter.type);
|
||||
|
||||
return {
|
||||
title,
|
||||
body: body.trim(),
|
||||
labels: [...new Set(labels)],
|
||||
assignees: frontmatter.assignees || [],
|
||||
milestone: frontmatter.milestone,
|
||||
parent_issue: frontmatter.parent_issue,
|
||||
create_sub_issues: frontmatter.create_sub_issues || false
|
||||
};
|
||||
}
|
||||
|
||||
// Helper: Extract sub-issues from H2 sections
|
||||
function extractSubIssues(body, parentLabels) {
|
||||
const sections = [];
|
||||
const lines = body.split('\n');
|
||||
let currentSection = null;
|
||||
let currentBody = [];
|
||||
|
||||
for (const line of lines) {
|
||||
const h2Match = line.match(/^##\s+(?:Sub-Issue\s*#?\d*:?\s*)?(.+)$/);
|
||||
if (h2Match) {
|
||||
if (currentSection) {
|
||||
sections.push({
|
||||
title: currentSection,
|
||||
body: currentBody.join('\n').trim(),
|
||||
labels: [...parentLabels]
|
||||
});
|
||||
}
|
||||
currentSection = h2Match[1].trim();
|
||||
currentBody = [];
|
||||
} else if (currentSection) {
|
||||
currentBody.push(line);
|
||||
}
|
||||
}
|
||||
|
||||
if (currentSection) {
|
||||
sections.push({
|
||||
title: currentSection,
|
||||
body: currentBody.join('\n').trim(),
|
||||
labels: [...parentLabels]
|
||||
});
|
||||
}
|
||||
|
||||
return sections;
|
||||
}
|
||||
|
||||
// Process each file
|
||||
for (const filePath of files) {
|
||||
console.log(`\nProcessing: ${filePath}`);
|
||||
|
||||
try {
|
||||
const parsed = parseIssueFile(filePath);
|
||||
console.log(` Title: ${parsed.title}`);
|
||||
console.log(` Labels: ${parsed.labels.join(', ')}`);
|
||||
|
||||
if (isDryRun) {
|
||||
console.log(' [DRY RUN] Would create issue');
|
||||
createdIssues.push({ file: filePath, title: parsed.title, dryRun: true });
|
||||
continue;
|
||||
}
|
||||
|
||||
// Ensure labels exist
|
||||
for (const label of parsed.labels) {
|
||||
await ensureLabel(label);
|
||||
}
|
||||
|
||||
// Create the main issue
|
||||
const issueBody = parsed.body +
|
||||
`\n\n---\n*Auto-created from [${path.basename(filePath)}](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${context.sha}/${filePath})*`;
|
||||
|
||||
const issueResponse = await github.rest.issues.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: parsed.title,
|
||||
body: issueBody,
|
||||
labels: parsed.labels,
|
||||
assignees: parsed.assignees
|
||||
});
|
||||
|
||||
const issueNumber = issueResponse.data.number;
|
||||
console.log(` Created issue #${issueNumber}`);
|
||||
|
||||
// Handle sub-issues
|
||||
if (parsed.create_sub_issues) {
|
||||
const subIssues = extractSubIssues(parsed.body, parsed.labels);
|
||||
for (const sub of subIssues) {
|
||||
for (const label of sub.labels) {
|
||||
await ensureLabel(label);
|
||||
}
|
||||
const subResponse = await github.rest.issues.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: `[${parsed.title}] ${sub.title}`,
|
||||
body: sub.body + `\n\n---\n*Sub-issue of #${issueNumber}*`,
|
||||
labels: sub.labels,
|
||||
assignees: parsed.assignees
|
||||
});
|
||||
console.log(` Created sub-issue #${subResponse.data.number}: ${sub.title}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Link to parent issue if specified
|
||||
if (parsed.parent_issue) {
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: parsed.parent_issue,
|
||||
body: `Sub-issue created: #${issueNumber}`
|
||||
});
|
||||
}
|
||||
|
||||
createdIssues.push({
|
||||
file: filePath,
|
||||
title: parsed.title,
|
||||
issueNumber
|
||||
});
|
||||
|
||||
} catch (error) {
|
||||
console.error(` Error processing ${filePath}: ${error.message}`);
|
||||
errors.push({ file: filePath, error: error.message });
|
||||
}
|
||||
}
|
||||
|
||||
core.setOutput('created_count', createdIssues.length);
|
||||
core.setOutput('created_issues', JSON.stringify(createdIssues));
|
||||
core.setOutput('errors', JSON.stringify(errors));
|
||||
|
||||
if (errors.length > 0) {
|
||||
core.warning(`${errors.length} file(s) had errors`);
|
||||
}
|
||||
|
||||
- name: Move processed files
|
||||
if: steps.process.outputs.created_count != '0' && github.event.inputs.dry_run != 'true'
|
||||
run: |
|
||||
mkdir -p docs/issues/created
|
||||
CREATED_ISSUES='${{ steps.process.outputs.created_issues }}'
|
||||
echo "$CREATED_ISSUES" | jq -r '.[].file' | while IFS= read -r file; do
|
||||
if [ -f "$file" ] && [ -n "$file" ]; then
|
||||
filename=$(basename "$file")
|
||||
timestamp=$(date +%Y%m%d)
|
||||
mv "$file" "docs/issues/created/${timestamp}-${filename}"
|
||||
echo "Moved: $file -> docs/issues/created/${timestamp}-${filename}"
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Commit moved files
|
||||
if: steps.process.outputs.created_count != '0' && github.event.inputs.dry_run != 'true'
|
||||
run: |
|
||||
git config --local user.email "github-actions[bot]@users.noreply.github.com"
|
||||
git config --local user.name "github-actions[bot]"
|
||||
git add docs/issues/
|
||||
# Removed [skip ci] to allow CI checks to run on PRs
|
||||
# Infinite loop protection: path filter excludes docs/issues/created/** AND github.actor guard prevents bot loops
|
||||
git diff --staged --quiet || git commit -m "chore: move processed issue files to created/"
|
||||
git push
|
||||
|
||||
- name: Summary
|
||||
if: always()
|
||||
run: |
|
||||
CREATED='${{ steps.process.outputs.created_issues }}'
|
||||
ERRORS='${{ steps.process.outputs.errors }}'
|
||||
DRY_RUN='${{ github.event.inputs.dry_run }}'
|
||||
|
||||
{
|
||||
echo "## Docs to Issues Summary"
|
||||
echo ""
|
||||
|
||||
if [ "$DRY_RUN" = "true" ]; then
|
||||
echo "🔍 **Dry Run Mode** - No issues were actually created"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
echo "### Created Issues"
|
||||
if [ -n "$CREATED" ] && [ "$CREATED" != "[]" ] && [ "$CREATED" != "null" ]; then
|
||||
echo "$CREATED" | jq -r '.[] | "- \(.title) (#\(.issueNumber // "dry-run"))"' || echo "_Parse error_"
|
||||
else
|
||||
echo "_No issues created_"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "### Errors"
|
||||
if [ -n "$ERRORS" ] && [ "$ERRORS" != "[]" ] && [ "$ERRORS" != "null" ]; then
|
||||
echo "$ERRORS" | jq -r '.[] | "- ❌ \(.file): \(.error)"' || echo "_Parse error_"
|
||||
else
|
||||
echo "_No errors_"
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
393
.github/workflows/docs.yml
vendored
393
.github/workflows/docs.yml
vendored
@@ -1,393 +0,0 @@
|
||||
name: Deploy Documentation to GitHub Pages
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
workflow_dispatch: # Allow manual trigger
|
||||
|
||||
# Sets permissions to allow deployment to GitHub Pages
|
||||
permissions:
|
||||
contents: read
|
||||
pages: write
|
||||
id-token: write
|
||||
|
||||
# Allow only one concurrent deployment
|
||||
concurrency:
|
||||
group: "pages-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}"
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
NODE_VERSION: '24.12.0'
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build Documentation
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
|
||||
env:
|
||||
REPO_NAME: ${{ github.event.repository.name }}
|
||||
|
||||
steps:
|
||||
# Step 1: Get the code
|
||||
- name: 📥 Checkout code
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
# Step 2: Set up Node.js (for building any JS-based doc tools)
|
||||
- name: 🔧 Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
|
||||
# Step 3: Create a beautiful docs site structure
|
||||
- name: 📝 Build documentation site
|
||||
run: |
|
||||
# Create output directory
|
||||
mkdir -p _site
|
||||
|
||||
# Copy all markdown files
|
||||
cp README.md _site/
|
||||
cp -r docs _site/
|
||||
|
||||
# Create a simple HTML index that looks nice
|
||||
cat > _site/index.html << 'EOF'
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Charon - Documentation</title>
|
||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css">
|
||||
<style>
|
||||
:root {
|
||||
--primary: #1d4ed8;
|
||||
--primary-hover: #1e40af;
|
||||
}
|
||||
body {
|
||||
background-color: #0f172a;
|
||||
color: #e2e8f0;
|
||||
}
|
||||
header {
|
||||
background: linear-gradient(135deg, #1e3a8a 0%, #1d4ed8 100%);
|
||||
padding: 3rem 0;
|
||||
text-align: center;
|
||||
margin-bottom: 2rem;
|
||||
}
|
||||
header h1 {
|
||||
color: white;
|
||||
font-size: 2.5rem;
|
||||
margin-bottom: 0.5rem;
|
||||
}
|
||||
header p {
|
||||
color: #e0e7ff;
|
||||
font-size: 1.25rem;
|
||||
}
|
||||
.container {
|
||||
max-width: 1200px;
|
||||
margin: 0 auto;
|
||||
padding: 2rem;
|
||||
}
|
||||
.card {
|
||||
background: #1e293b;
|
||||
border: 1px solid #334155;
|
||||
border-radius: 12px;
|
||||
padding: 1.5rem;
|
||||
margin-bottom: 1.5rem;
|
||||
transition: transform 0.2s, box-shadow 0.2s;
|
||||
}
|
||||
.card:hover {
|
||||
transform: translateY(-4px);
|
||||
box-shadow: 0 8px 16px rgba(0, 0, 0, 0.3);
|
||||
}
|
||||
.card h3 {
|
||||
color: #60a5fa;
|
||||
margin-top: 0;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
}
|
||||
.card p {
|
||||
color: #cbd5e1;
|
||||
margin-bottom: 1rem;
|
||||
}
|
||||
.card a {
|
||||
color: #60a5fa;
|
||||
text-decoration: none;
|
||||
font-weight: 600;
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
}
|
||||
.card a:hover {
|
||||
color: #93c5fd;
|
||||
}
|
||||
.badge {
|
||||
display: inline-block;
|
||||
padding: 0.25rem 0.75rem;
|
||||
border-radius: 9999px;
|
||||
font-size: 0.875rem;
|
||||
font-weight: 600;
|
||||
margin-left: 0.5rem;
|
||||
}
|
||||
.badge-beginner {
|
||||
background: #10b981;
|
||||
color: white;
|
||||
}
|
||||
.badge-advanced {
|
||||
background: #f59e0b;
|
||||
color: white;
|
||||
}
|
||||
.grid {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
|
||||
gap: 1.5rem;
|
||||
}
|
||||
footer {
|
||||
text-align: center;
|
||||
padding: 3rem 0;
|
||||
color: #64748b;
|
||||
border-top: 1px solid #334155;
|
||||
margin-top: 4rem;
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<header>
|
||||
<h1>🚀 Charon</h1>
|
||||
<p>Make your websites easy to reach - No coding required!</p>
|
||||
</header>
|
||||
|
||||
<div class="container">
|
||||
<section>
|
||||
<h2>👋 Welcome!</h2>
|
||||
<p style="font-size: 1.1rem; color: #cbd5e1;">
|
||||
This documentation will help you get started with Charon.
|
||||
Whether you're a complete beginner or an experienced developer, we've got you covered!
|
||||
</p>
|
||||
</section>
|
||||
|
||||
<h2 style="margin-top: 3rem;">📚 Getting Started</h2>
|
||||
<div class="grid">
|
||||
<div class="card">
|
||||
<h3>🏠 Getting Started Guide <span class="badge badge-beginner">Start Here</span></h3>
|
||||
<p>Your first setup in just 5 minutes! We'll walk you through everything step by step.</p>
|
||||
<a href="docs/getting-started.html">Read the Guide →</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3>📖 README <span class="badge badge-beginner">Essential</span></h3>
|
||||
<p>Learn what the app does, how to install it, and see examples of what you can build.</p>
|
||||
<a href="README.html">Read More →</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3>📥 Import Guide</h3>
|
||||
<p>Already using Caddy? Learn how to bring your existing configuration into the app.</p>
|
||||
<a href="docs/import-guide.html">Import Your Configs →</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h2 style="margin-top: 3rem;">🔧 Developer Documentation</h2>
|
||||
<div class="grid">
|
||||
<div class="card">
|
||||
<h3>🔌 API Reference <span class="badge badge-advanced">Advanced</span></h3>
|
||||
<p>Complete REST API documentation with examples in JavaScript and Python.</p>
|
||||
<a href="docs/api.html">View API Docs →</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3>💾 Database Schema <span class="badge badge-advanced">Advanced</span></h3>
|
||||
<p>Understand how data is stored, relationships, and backup strategies.</p>
|
||||
<a href="docs/database-schema.html">View Schema →</a>
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h3>✨ Contributing Guide</h3>
|
||||
<p>Want to help make this better? Learn how to contribute code, docs, or ideas.</p>
|
||||
<a href="CONTRIBUTING.html">Start Contributing →</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h2 style="margin-top: 3rem;">📋 All Documentation</h2>
|
||||
<div class="card">
|
||||
<h3>📚 Documentation Index</h3>
|
||||
<p>Browse all available documentation organized by topic and skill level.</p>
|
||||
<a href="docs/index.html">View Full Index →</a>
|
||||
</div>
|
||||
|
||||
<h2 style="margin-top: 3rem;">🆘 Need Help?</h2>
|
||||
<div class="card" style="background: #1e3a8a; border-color: #1e40af;">
|
||||
<h3 style="color: #dbeafe;">Get Support</h3>
|
||||
<p style="color: #bfdbfe;">
|
||||
Stuck? Have questions? We're here to help!
|
||||
</p>
|
||||
<div style="display: flex; gap: 1rem; flex-wrap: wrap; margin-top: 1rem;">
|
||||
<a href="https://github.com/Wikid82/charon/discussions"
|
||||
style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
|
||||
💬 Ask a Question
|
||||
</a>
|
||||
<a href="https://github.com/Wikid82/charon/issues"
|
||||
style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
|
||||
🐛 Report a Bug
|
||||
</a>
|
||||
<a href="https://github.com/Wikid82/charon"
|
||||
style="background: white; color: #1e40af; padding: 0.5rem 1rem; border-radius: 6px; text-decoration: none;">
|
||||
⭐ View on GitHub
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<footer>
|
||||
<p>Built with ❤️ by <a href="https://github.com/Wikid82" style="color: #60a5fa;">@Wikid82</a></p>
|
||||
<p>Made for humans, not just techies!</p>
|
||||
</footer>
|
||||
</body>
|
||||
</html>
|
||||
EOF
|
||||
|
||||
# Convert markdown files to HTML using a simple converter
|
||||
npm install -g marked
|
||||
|
||||
# Convert each markdown file
|
||||
for file in _site/docs/*.md; do
|
||||
if [ -f "$file" ]; then
|
||||
filename=$(basename "$file" .md)
|
||||
marked "$file" -o "_site/docs/${filename}.html" --gfm
|
||||
fi
|
||||
done
|
||||
|
||||
# Convert README and CONTRIBUTING
|
||||
marked _site/README.md -o _site/README.html --gfm
|
||||
if [ -f "CONTRIBUTING.md" ]; then
|
||||
cp CONTRIBUTING.md _site/
|
||||
marked _site/CONTRIBUTING.md -o _site/CONTRIBUTING.html --gfm
|
||||
fi
|
||||
|
||||
# Add simple styling to all HTML files
|
||||
for html_file in _site/*.html _site/docs/*.html; do
|
||||
if [ -f "$html_file" ] && [ "$html_file" != "_site/index.html" ]; then
|
||||
# Add a header with navigation to each page
|
||||
temp_file="${html_file}.tmp"
|
||||
cat > "$temp_file" << 'HEADER'
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Charon - Documentation</title>
|
||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css">
|
||||
<style>
|
||||
body { background-color: #0f172a; color: #e2e8f0; }
|
||||
nav { background: #1e293b; padding: 1rem; margin-bottom: 2rem; }
|
||||
nav a { color: #60a5fa; margin-right: 1rem; text-decoration: none; }
|
||||
nav a:hover { color: #93c5fd; }
|
||||
main { max-width: 900px; margin: 0 auto; padding: 2rem; }
|
||||
a { color: #60a5fa; }
|
||||
code { background: #1e293b; color: #fbbf24; padding: 0.2rem 0.4rem; border-radius: 4px; }
|
||||
pre { background: #1e293b; padding: 1rem; border-radius: 8px; overflow-x: auto; }
|
||||
pre code { background: none; padding: 0; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<nav>
|
||||
<a href="/charon/">🏠 Home</a>
|
||||
<a href="/charon/docs/index.html">📚 Docs</a>
|
||||
<a href="/charon/docs/getting-started.html">🚀 Get Started</a>
|
||||
<a href="https://github.com/Wikid82/charon">⭐ GitHub</a>
|
||||
</nav>
|
||||
<main>
|
||||
HEADER
|
||||
|
||||
# Append original content
|
||||
cat "$html_file" >> "$temp_file"
|
||||
|
||||
# Add footer
|
||||
cat >> "$temp_file" << 'FOOTER'
|
||||
</main>
|
||||
<footer style="text-align: center; padding: 2rem; color: #64748b;">
|
||||
<p>Charon - Built with ❤️ for the community</p>
|
||||
</footer>
|
||||
</body>
|
||||
</html>
|
||||
FOOTER
|
||||
|
||||
mv "$temp_file" "$html_file"
|
||||
fi
|
||||
done
|
||||
|
||||
# --- 🚀 ROBUST DYNAMIC PATH FIX ---
|
||||
echo "🔧 Calculating paths..."
|
||||
|
||||
# 1. Determine BASE_PATH
|
||||
if [[ "${REPO_NAME}" == *".github.io" ]]; then
|
||||
echo " - Mode: Root domain (e.g. user.github.io)"
|
||||
BASE_PATH="/"
|
||||
else
|
||||
echo " - Mode: Sub-path (e.g. user.github.io/repo)"
|
||||
BASE_PATH="/${REPO_NAME}/"
|
||||
fi
|
||||
|
||||
# 2. Define standard repo variables
|
||||
FULL_REPO="${{ github.repository }}"
|
||||
REPO_URL="https://github.com/${FULL_REPO}"
|
||||
|
||||
echo " - Repo: ${FULL_REPO}"
|
||||
echo " - URL: ${REPO_URL}"
|
||||
echo " - Base: ${BASE_PATH}"
|
||||
|
||||
# 3. Fix paths in all HTML files
|
||||
find _site -name "*.html" -exec sed -i \
|
||||
-e "s|/charon/|${BASE_PATH}|g" \
|
||||
-e "s|https://github.com/Wikid82/charon|${REPO_URL}|g" \
|
||||
-e "s|Wikid82/charon|${FULL_REPO}|g" \
|
||||
{} +
|
||||
|
||||
echo "✅ Paths fixed successfully!"
|
||||
|
||||
echo "✅ Documentation site built successfully!"
|
||||
|
||||
# Step 4: Upload the built site
|
||||
- name: 📤 Upload artifact
|
||||
uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
|
||||
with:
|
||||
path: '_site'
|
||||
|
||||
deploy:
|
||||
name: Deploy to GitHub Pages
|
||||
if: >-
|
||||
(github.event_name == 'workflow_run' && github.event.workflow_run.head_branch == 'main') ||
|
||||
(github.event_name != 'workflow_run' && github.ref == 'refs/heads/main')
|
||||
environment:
|
||||
name: github-pages
|
||||
url: ${{ steps.deployment.outputs.page_url }}
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 5
|
||||
needs: build
|
||||
|
||||
steps:
|
||||
# Deploy to GitHub Pages
|
||||
- name: 🚀 Deploy to GitHub Pages
|
||||
id: deployment
|
||||
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
|
||||
|
||||
# Create a summary
|
||||
- name: 📋 Create deployment summary
|
||||
run: |
|
||||
{
|
||||
echo "## 🎉 Documentation Deployed!"
|
||||
echo ""
|
||||
echo "Your documentation is now live at:"
|
||||
echo "🔗 ${{ steps.deployment.outputs.page_url }}"
|
||||
echo ""
|
||||
echo "### 📚 What's Included"
|
||||
echo "- Getting Started Guide"
|
||||
echo "- Complete README"
|
||||
echo "- API Documentation"
|
||||
echo "- Database Schema"
|
||||
echo "- Import Guide"
|
||||
echo "- Contributing Guidelines"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
41
.github/workflows/dry-run-history-rewrite.yml
vendored
41
.github/workflows/dry-run-history-rewrite.yml
vendored
@@ -1,41 +0,0 @@
|
||||
name: History Rewrite Dry-Run
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
schedule:
|
||||
- cron: '0 2 * * *' # daily at 02:00 UTC
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
preview-history:
|
||||
name: Dry-run preview for history rewrite
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Debug git info
|
||||
run: |
|
||||
git --version
|
||||
git rev-parse --is-shallow-repository || true
|
||||
git status --porcelain
|
||||
|
||||
- name: Make CI script executable
|
||||
run: chmod +x scripts/ci/dry_run_history_rewrite.sh
|
||||
|
||||
- name: Run dry-run history check
|
||||
run: |
|
||||
scripts/ci/dry_run_history_rewrite.sh --paths 'backend/codeql-db,codeql-db,codeql-db-js,codeql-db-go' --strip-size 50
|
||||
1441
.github/workflows/e2e-tests-split.yml
vendored
1441
.github/workflows/e2e-tests-split.yml
vendored
File diff suppressed because it is too large
Load Diff
1170
.github/workflows/e2e-tests-split.yml.backup
vendored
1170
.github/workflows/e2e-tests-split.yml.backup
vendored
File diff suppressed because it is too large
Load Diff
632
.github/workflows/e2e-tests.yml.backup
vendored
632
.github/workflows/e2e-tests.yml.backup
vendored
@@ -1,632 +0,0 @@
|
||||
# E2E Tests Workflow
|
||||
# Runs Playwright E2E tests with sharding for faster execution
|
||||
# and collects frontend code coverage via @bgotink/playwright-coverage
|
||||
#
|
||||
# Test Execution Architecture:
|
||||
# - Parallel Sharding: Tests split across 4 shards for speed
|
||||
# - Per-Shard HTML Reports: Each shard generates its own HTML report
|
||||
# - No Merging Needed: Smaller reports are easier to debug
|
||||
# - Trace Collection: Failure traces captured for debugging
|
||||
#
|
||||
# Coverage Architecture:
|
||||
# - Backend: Docker container at localhost:8080 (API)
|
||||
# - Frontend: Vite dev server at localhost:3000 (serves source files)
|
||||
# - Tests hit Vite, which proxies API calls to Docker
|
||||
# - V8 coverage maps directly to source files for accurate reporting
|
||||
# - Coverage disabled by default (requires PLAYWRIGHT_COVERAGE=1)
|
||||
#
|
||||
# Triggers:
|
||||
# - Pull requests to main/develop (with path filters)
|
||||
# - Push to main branch
|
||||
# - Manual dispatch with browser selection
|
||||
#
|
||||
# Jobs:
|
||||
# 1. build: Build Docker image and upload as artifact
|
||||
# 2. e2e-tests: Run tests in parallel shards, upload per-shard HTML reports
|
||||
# 3. test-summary: Generate summary with links to shard reports
|
||||
# 4. comment-results: Post test results as PR comment
|
||||
# 5. upload-coverage: Merge and upload E2E coverage to Codecov (if enabled)
|
||||
# 6. e2e-results: Status check to block merge on failure
|
||||
|
||||
name: E2E Tests
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
- development
|
||||
- 'feature/**'
|
||||
paths:
|
||||
- 'frontend/**'
|
||||
- 'backend/**'
|
||||
- 'tests/**'
|
||||
- 'playwright.config.js'
|
||||
- '.github/workflows/e2e-tests.yml'
|
||||
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
browser:
|
||||
description: 'Browser to test'
|
||||
required: false
|
||||
default: 'chromium'
|
||||
type: choice
|
||||
options:
|
||||
- chromium
|
||||
- firefox
|
||||
- webkit
|
||||
- all
|
||||
|
||||
env:
|
||||
NODE_VERSION: '20'
|
||||
GO_VERSION: '1.25.6'
|
||||
GOTOOLCHAIN: auto
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository_owner }}/charon
|
||||
PLAYWRIGHT_COVERAGE: ${{ vars.PLAYWRIGHT_COVERAGE || '0' }}
|
||||
# Enhanced debugging environment variables
|
||||
DEBUG: 'charon:*,charon-test:*'
|
||||
PLAYWRIGHT_DEBUG: '1'
|
||||
CI_LOG_LEVEL: 'verbose'
|
||||
|
||||
concurrency:
|
||||
group: e2e-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
# Build application once, share across test shards
|
||||
build:
|
||||
name: Build Application
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
image_digest: ${{ steps.build-image.outputs.digest }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
cache: true
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
|
||||
- name: Cache npm dependencies
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: npm-${{ hashFiles('package-lock.json') }}
|
||||
restore-keys: npm-
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
||||
|
||||
- name: Build Docker image
|
||||
id: build-image
|
||||
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
push: false
|
||||
load: true
|
||||
tags: charon:e2e-test
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
- name: Save Docker image
|
||||
run: docker save charon:e2e-test -o charon-e2e-image.tar
|
||||
|
||||
- name: Upload Docker image artifact
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: docker-image
|
||||
path: charon-e2e-image.tar
|
||||
retention-days: 1
|
||||
|
||||
# Run tests in parallel shards
|
||||
e2e-tests:
|
||||
name: E2E ${{ matrix.browser }} (Shard ${{ matrix.shard }}/${{ matrix.total-shards }})
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
timeout-minutes: 30
|
||||
env:
|
||||
# Required for security teardown (emergency reset fallback when ACL blocks API)
|
||||
CHARON_EMERGENCY_TOKEN: ${{ secrets.CHARON_EMERGENCY_TOKEN }}
|
||||
# Enable security-focused endpoints and test gating
|
||||
CHARON_EMERGENCY_SERVER_ENABLED: "true"
|
||||
CHARON_SECURITY_TESTS_ENABLED: "true"
|
||||
CHARON_E2E_IMAGE_TAG: charon:e2e-test
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
shard: [1, 2, 3, 4]
|
||||
total-shards: [4]
|
||||
browser: [chromium, firefox, webkit]
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
|
||||
- name: Download Docker image
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
|
||||
with:
|
||||
name: docker-image
|
||||
|
||||
- name: Validate Emergency Token Configuration
|
||||
run: |
|
||||
echo "🔐 Validating emergency token configuration..."
|
||||
|
||||
if [ -z "$CHARON_EMERGENCY_TOKEN" ]; then
|
||||
echo "::error title=Missing Secret::CHARON_EMERGENCY_TOKEN secret not configured in repository settings"
|
||||
echo "::error::Navigate to: Repository Settings → Secrets and Variables → Actions"
|
||||
echo "::error::Create secret: CHARON_EMERGENCY_TOKEN"
|
||||
echo "::error::Generate value with: openssl rand -hex 32"
|
||||
echo "::error::See docs/github-setup.md for detailed instructions"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TOKEN_LENGTH=${#CHARON_EMERGENCY_TOKEN}
|
||||
if [ $TOKEN_LENGTH -lt 64 ]; then
|
||||
echo "::error title=Invalid Token Length::CHARON_EMERGENCY_TOKEN must be at least 64 characters (current: $TOKEN_LENGTH)"
|
||||
echo "::error::Generate new token with: openssl rand -hex 32"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Mask token in output (show first 8 chars only)
|
||||
MASKED_TOKEN="${CHARON_EMERGENCY_TOKEN:0:8}...${CHARON_EMERGENCY_TOKEN: -4}"
|
||||
echo "::notice::Emergency token validated (length: $TOKEN_LENGTH, preview: $MASKED_TOKEN)"
|
||||
env:
|
||||
CHARON_EMERGENCY_TOKEN: ${{ secrets.CHARON_EMERGENCY_TOKEN }}
|
||||
|
||||
- name: Load Docker image
|
||||
run: |
|
||||
docker load -i charon-e2e-image.tar
|
||||
docker images | grep charon
|
||||
|
||||
- name: Generate ephemeral encryption key
|
||||
run: |
|
||||
# Generate a unique, ephemeral encryption key for this CI run
|
||||
# Key is 32 bytes, base64-encoded as required by CHARON_ENCRYPTION_KEY
|
||||
echo "CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> $GITHUB_ENV
|
||||
echo "✅ Generated ephemeral encryption key for E2E tests"
|
||||
|
||||
- name: Start test environment
|
||||
run: |
|
||||
# Use docker-compose.playwright-ci.yml for CI (no .env file, uses GitHub Secrets)
|
||||
# Note: Using pre-built image loaded from artifact - no rebuild needed
|
||||
docker compose -f .docker/compose/docker-compose.playwright-ci.yml --profile security-tests up -d
|
||||
echo "✅ Container started via docker-compose.playwright-ci.yml"
|
||||
|
||||
- name: Wait for service health
|
||||
run: |
|
||||
echo "⏳ Waiting for Charon to be healthy..."
|
||||
MAX_ATTEMPTS=30
|
||||
ATTEMPT=0
|
||||
|
||||
while [[ ${ATTEMPT} -lt ${MAX_ATTEMPTS} ]]; do
|
||||
ATTEMPT=$((ATTEMPT + 1))
|
||||
echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}..."
|
||||
|
||||
if curl -sf http://localhost:8080/api/v1/health > /dev/null 2>&1; then
|
||||
echo "✅ Charon is healthy!"
|
||||
curl -s http://localhost:8080/api/v1/health | jq .
|
||||
exit 0
|
||||
fi
|
||||
|
||||
sleep 2
|
||||
done
|
||||
|
||||
echo "❌ Health check failed"
|
||||
docker compose -f .docker/compose/docker-compose.playwright-ci.yml logs
|
||||
exit 1
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Clean Playwright browser cache
|
||||
run: rm -rf ~/.cache/ms-playwright
|
||||
|
||||
|
||||
- name: Cache Playwright browsers
|
||||
id: playwright-cache
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
with:
|
||||
path: ~/.cache/ms-playwright
|
||||
# Use exact match only - no restore-keys fallback
|
||||
# This ensures we don't restore stale browsers when Playwright version changes
|
||||
key: playwright-${{ matrix.browser }}-${{ hashFiles('package-lock.json') }}
|
||||
|
||||
- name: Install & verify Playwright browsers
|
||||
run: |
|
||||
npx playwright install --with-deps --force
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "🎯 Playwright CLI version"
|
||||
npx playwright --version || true
|
||||
|
||||
echo "🔍 Showing Playwright cache root (if present)"
|
||||
ls -la ~/.cache/ms-playwright || true
|
||||
|
||||
echo "📥 Install or verify browser: ${{ matrix.browser }}"
|
||||
|
||||
# Install when cache miss, otherwise verify the expected executables exist
|
||||
if [[ "${{ steps.playwright-cache.outputs.cache-hit }}" != "true" ]]; then
|
||||
echo "📥 Cache miss - downloading ${{ matrix.browser }} browser..."
|
||||
npx playwright install --with-deps ${{ matrix.browser }}
|
||||
else
|
||||
echo "✅ Cache hit - verifying ${{ matrix.browser }} browser files..."
|
||||
fi
|
||||
|
||||
# Look for the browser-specific headless shell executable(s)
|
||||
case "${{ matrix.browser }}" in
|
||||
chromium)
|
||||
EXPECTED_PATTERN="chrome-headless-shell*"
|
||||
;;
|
||||
firefox)
|
||||
EXPECTED_PATTERN="firefox*"
|
||||
;;
|
||||
webkit)
|
||||
EXPECTED_PATTERN="webkit*"
|
||||
;;
|
||||
*)
|
||||
EXPECTED_PATTERN="*"
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "Searching for expected files (pattern=$EXPECTED_PATTERN)..."
|
||||
find ~/.cache/ms-playwright -maxdepth 4 -type f -name "$EXPECTED_PATTERN" -print || true
|
||||
|
||||
# Attempt to derive the exact executable path Playwright will use
|
||||
echo "Attempting to resolve Playwright's executable path via Node API (best-effort)"
|
||||
node -e "try{ const pw = require('playwright'); const b = pw['${{ matrix.browser }}']; console.log('exePath:', b.executablePath ? b.executablePath() : 'n/a'); }catch(e){ console.error('node-check-failed', e.message); process.exit(0); }" || true
|
||||
|
||||
# If the expected binary is missing, force reinstall
|
||||
MISSING_COUNT=$(find ~/.cache/ms-playwright -maxdepth 4 -type f -name "$EXPECTED_PATTERN" | wc -l || true)
|
||||
if [[ "$MISSING_COUNT" -lt 1 ]]; then
|
||||
echo "⚠️ Expected Playwright browser executable not found (count=$MISSING_COUNT). Forcing reinstall..."
|
||||
npx playwright install --with-deps ${{ matrix.browser }} --force
|
||||
fi
|
||||
|
||||
echo "Post-install: show cache contents (top 5 lines)"
|
||||
find ~/.cache/ms-playwright -maxdepth 3 -printf '%p\n' | head -40 || true
|
||||
|
||||
# Final sanity check: try a headless launch via a tiny Node script (browser-specific args, retry without args)
|
||||
echo "🔁 Verifying browser can be launched (headless)"
|
||||
node -e "(async()=>{ try{ const pw=require('playwright'); const name='${{ matrix.browser }}'; const browser = pw[name]; const argsMap = { chromium: ['--no-sandbox'], firefox: ['--no-sandbox'], webkit: [] }; const args = argsMap[name] || [];
|
||||
// First attempt: launch with recommended args for this browser
|
||||
try {
|
||||
console.log('attempt-launch', name, 'args', JSON.stringify(args));
|
||||
const b = await browser.launch({ headless: true, args });
|
||||
await b.close();
|
||||
console.log('launch-ok', 'argsUsed', JSON.stringify(args));
|
||||
process.exit(0);
|
||||
} catch (err) {
|
||||
console.warn('launch-with-args-failed', err && err.message);
|
||||
if (args.length) {
|
||||
// Retry without args (some browsers reject unknown flags)
|
||||
console.log('retrying-without-args');
|
||||
const b2 = await browser.launch({ headless: true });
|
||||
await b2.close();
|
||||
console.log('launch-ok-no-args');
|
||||
process.exit(0);
|
||||
}
|
||||
throw err;
|
||||
}
|
||||
} catch (e) { console.error('launch-failed', e && e.message); process.exit(2); } })()" || (echo '❌ Browser launch verification failed' && exit 1)
|
||||
|
||||
echo "✅ Playwright ${{ matrix.browser }} ready and verified"
|
||||
|
||||
- name: Run E2E tests (Shard ${{ matrix.shard }}/${{ matrix.total-shards }})
|
||||
run: |
|
||||
echo "════════════════════════════════════════════════════════════"
|
||||
echo "E2E Test Shard ${{ matrix.shard }}/${{ matrix.total-shards }}"
|
||||
echo "Browser: ${{ matrix.browser }}"
|
||||
echo "Start Time: $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
|
||||
echo ""
|
||||
echo "Reporter: HTML (per-shard reports)"
|
||||
echo "Output: playwright-report/ directory"
|
||||
echo "════════════════════════════════════════════════════════════"
|
||||
|
||||
# Capture start time for performance budget tracking
|
||||
SHARD_START=$(date +%s)
|
||||
echo "SHARD_START=$SHARD_START" >> $GITHUB_ENV
|
||||
|
||||
npx playwright test \
|
||||
--project=${{ matrix.browser }} \
|
||||
--shard=${{ matrix.shard }}/${{ matrix.total-shards }}
|
||||
|
||||
# Capture end time for performance budget tracking
|
||||
SHARD_END=$(date +%s)
|
||||
echo "SHARD_END=$SHARD_END" >> $GITHUB_ENV
|
||||
|
||||
SHARD_DURATION=$((SHARD_END - SHARD_START))
|
||||
|
||||
echo ""
|
||||
echo "════════════════════════════════════════════════════════════"
|
||||
echo "Shard ${{ matrix.shard }} Complete | Duration: ${SHARD_DURATION}s"
|
||||
echo "════════════════════════════════════════════════════════════"
|
||||
env:
|
||||
# Test directly against Docker container (no coverage)
|
||||
PLAYWRIGHT_BASE_URL: http://localhost:8080
|
||||
CI: true
|
||||
TEST_WORKER_INDEX: ${{ matrix.shard }}
|
||||
|
||||
- name: Verify shard performance budget
|
||||
if: always()
|
||||
run: |
|
||||
# Calculate shard execution time
|
||||
SHARD_DURATION=$((SHARD_END - SHARD_START))
|
||||
MAX_DURATION=900 # 15 minutes
|
||||
|
||||
echo "📊 Performance Budget Check"
|
||||
echo " Shard Duration: ${SHARD_DURATION}s"
|
||||
echo " Budget Limit: ${MAX_DURATION}s"
|
||||
echo " Utilization: $((SHARD_DURATION * 100 / MAX_DURATION))%"
|
||||
|
||||
# Fail if shard exceeded performance budget
|
||||
if [[ $SHARD_DURATION -gt $MAX_DURATION ]]; then
|
||||
echo "::error::Shard exceeded performance budget: ${SHARD_DURATION}s > ${MAX_DURATION}s"
|
||||
echo "::error::This likely indicates feature flag polling regression or API bottleneck"
|
||||
echo "::error::Review test logs and consider optimizing wait helpers or API calls"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ Shard completed within budget: ${SHARD_DURATION}s"
|
||||
|
||||
- name: Upload HTML report (per-shard)
|
||||
if: always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: playwright-report-${{ matrix.browser }}-shard-${{ matrix.shard }}
|
||||
path: playwright-report/
|
||||
retention-days: 14
|
||||
|
||||
- name: Upload test traces on failure
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: traces-${{ matrix.browser }}-shard-${{ matrix.shard }}
|
||||
path: test-results/**/*.zip
|
||||
retention-days: 7
|
||||
|
||||
- name: Collect Docker logs on failure
|
||||
if: failure()
|
||||
run: |
|
||||
echo "📋 Container logs:"
|
||||
docker compose -f .docker/compose/docker-compose.playwright-ci.yml logs > docker-logs-${{ matrix.browser }}-shard-${{ matrix.shard }}.txt 2>&1
|
||||
|
||||
- name: Upload Docker logs on failure
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: docker-logs-${{ matrix.browser }}-shard-${{ matrix.shard }}
|
||||
path: docker-logs-${{ matrix.browser }}-shard-${{ matrix.shard }}.txt
|
||||
retention-days: 7
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
docker compose -f .docker/compose/docker-compose.playwright-ci.yml down -v 2>/dev/null || true
|
||||
|
||||
# Summarize test results from all shards (no merging needed)
|
||||
test-summary:
|
||||
name: E2E Test Summary
|
||||
runs-on: ubuntu-latest
|
||||
needs: e2e-tests
|
||||
if: always()
|
||||
|
||||
steps:
|
||||
- name: Generate job summary with per-shard links
|
||||
run: |
|
||||
echo "## 📊 E2E Test Results" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "### Per-Shard HTML Reports" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "Each shard generates its own HTML report for easier debugging:" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Browser | Shards | HTML Reports | Traces (on failure) |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "|---------|--------|--------------|---------------------|" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Chromium | 1-4 | \`playwright-report-chromium-shard-{1..4}\` | \`traces-chromium-shard-{1..4}\` |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Firefox | 1-4 | \`playwright-report-firefox-shard-{1..4}\` | \`traces-firefox-shard-{1..4}\` |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| WebKit | 1-4 | \`playwright-report-webkit-shard-{1..4}\` | \`traces-webkit-shard-{1..4}\` |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "### How to View Reports" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "1. Download the shard HTML report artifact (zip file)" >> $GITHUB_STEP_SUMMARY
|
||||
echo "2. Extract and open \`index.html\` in your browser" >> $GITHUB_STEP_SUMMARY
|
||||
echo "3. Or run: \`npx playwright show-report path/to/extracted-folder\`" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "### Debugging Tips" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- **Failed tests?** Download the shard report that failed. Each shard has a focused subset of tests." >> $GITHUB_STEP_SUMMARY
|
||||
echo "- **Traces**: Available in trace artifacts (only on failure)" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- **Docker Logs**: Backend errors available in docker-logs-shard-N artifacts" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- **Local repro**: \`npx playwright test --grep=\"test name\"\`" >> $GITHUB_STEP_SUMMARY
|
||||
|
||||
# Comment on PR with results
|
||||
comment-results:
|
||||
name: Comment Test Results
|
||||
runs-on: ubuntu-latest
|
||||
needs: [e2e-tests, test-summary]
|
||||
if: github.event_name == 'pull_request' && always()
|
||||
permissions:
|
||||
pull-requests: write
|
||||
|
||||
steps:
|
||||
- name: Determine test status
|
||||
id: status
|
||||
run: |
|
||||
if [[ "${{ needs.e2e-tests.result }}" == "success" ]]; then
|
||||
echo "emoji=✅" >> $GITHUB_OUTPUT
|
||||
echo "status=PASSED" >> $GITHUB_OUTPUT
|
||||
echo "message=All E2E tests passed!" >> $GITHUB_OUTPUT
|
||||
elif [[ "${{ needs.e2e-tests.result }}" == "failure" ]]; then
|
||||
echo "emoji=❌" >> $GITHUB_OUTPUT
|
||||
echo "status=FAILED" >> $GITHUB_OUTPUT
|
||||
echo "message=Some E2E tests failed. Check artifacts for per-shard reports." >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "emoji=⚠️" >> $GITHUB_OUTPUT
|
||||
echo "status=UNKNOWN" >> $GITHUB_OUTPUT
|
||||
echo "message=E2E tests did not complete successfully." >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Comment on PR
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const emoji = '${{ steps.status.outputs.emoji }}';
|
||||
const status = '${{ steps.status.outputs.status }}';
|
||||
const message = '${{ steps.status.outputs.message }}';
|
||||
const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
|
||||
|
||||
const body = `## ${emoji} E2E Test Results: ${status}
|
||||
|
||||
${message}
|
||||
|
||||
| Metric | Result |
|
||||
|--------|--------|
|
||||
| Browsers | Chromium, Firefox, WebKit |
|
||||
| Shards per Browser | 4 |
|
||||
| Total Jobs | 12 |
|
||||
| Status | ${status} |
|
||||
|
||||
**Per-Shard HTML Reports** (easier to debug):
|
||||
- \`playwright-report-{browser}-shard-{1..4}\` (12 total artifacts)
|
||||
- Trace artifacts: \`traces-{browser}-shard-{N}\`
|
||||
|
||||
[📊 View workflow run & download reports](${runUrl})
|
||||
|
||||
---
|
||||
<sub>🤖 This comment was automatically generated by the E2E Tests workflow.</sub>`;
|
||||
|
||||
// Find existing comment
|
||||
const { data: comments } = await github.rest.issues.listComments({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
});
|
||||
|
||||
const botComment = comments.find(comment =>
|
||||
comment.user.type === 'Bot' &&
|
||||
comment.body.includes('E2E Test Results')
|
||||
);
|
||||
|
||||
if (botComment) {
|
||||
await github.rest.issues.updateComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
comment_id: botComment.id,
|
||||
body: body
|
||||
});
|
||||
} else {
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: context.issue.number,
|
||||
body: body
|
||||
});
|
||||
}
|
||||
|
||||
# Upload merged E2E coverage to Codecov
|
||||
upload-coverage:
|
||||
name: Upload E2E Coverage
|
||||
runs-on: ubuntu-latest
|
||||
needs: e2e-tests
|
||||
# Coverage is only produced when PLAYWRIGHT_COVERAGE=1 (requires Vite dev server)
|
||||
if: vars.PLAYWRIGHT_COVERAGE == '1'
|
||||
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
|
||||
- name: Download all coverage artifacts
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
|
||||
with:
|
||||
pattern: e2e-coverage-*
|
||||
path: all-coverage
|
||||
merge-multiple: false
|
||||
|
||||
- name: Merge LCOV coverage files
|
||||
run: |
|
||||
# Install lcov for merging
|
||||
sudo apt-get update && sudo apt-get install -y lcov
|
||||
|
||||
# Create merged coverage directory
|
||||
mkdir -p coverage/e2e-merged
|
||||
|
||||
# Find all lcov.info files and merge them
|
||||
LCOV_FILES=$(find all-coverage -name "lcov.info" -type f)
|
||||
|
||||
if [[ -n "$LCOV_FILES" ]]; then
|
||||
# Build merge command
|
||||
MERGE_ARGS=""
|
||||
for file in $LCOV_FILES; do
|
||||
MERGE_ARGS="$MERGE_ARGS -a $file"
|
||||
done
|
||||
|
||||
lcov $MERGE_ARGS -o coverage/e2e-merged/lcov.info
|
||||
echo "✅ Merged $(echo "$LCOV_FILES" | wc -w) coverage files"
|
||||
else
|
||||
echo "⚠️ No coverage files found to merge"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
- name: Upload E2E coverage to Codecov
|
||||
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
files: ./coverage/e2e-merged/lcov.info
|
||||
flags: e2e
|
||||
name: e2e-coverage
|
||||
fail_ci_if_error: false
|
||||
|
||||
- name: Upload merged coverage artifact
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: e2e-coverage-merged
|
||||
path: coverage/e2e-merged/
|
||||
retention-days: 30
|
||||
|
||||
# Final status check - blocks merge if tests fail
|
||||
e2e-results:
|
||||
name: E2E Test Results
|
||||
runs-on: ubuntu-latest
|
||||
needs: e2e-tests
|
||||
if: always()
|
||||
|
||||
steps:
|
||||
- name: Check test results
|
||||
run: |
|
||||
if [[ "${{ needs.e2e-tests.result }}" == "success" ]]; then
|
||||
echo "✅ All E2E tests passed"
|
||||
exit 0
|
||||
elif [[ "${{ needs.e2e-tests.result }}" == "skipped" ]]; then
|
||||
echo "⏭️ E2E tests were skipped"
|
||||
exit 0
|
||||
else
|
||||
echo "❌ E2E tests failed or were cancelled"
|
||||
echo "Result: ${{ needs.e2e-tests.result }}"
|
||||
exit 1
|
||||
fi
|
||||
31
.github/workflows/gh_cache_cleanup.yml
vendored
31
.github/workflows/gh_cache_cleanup.yml
vendored
@@ -1,31 +0,0 @@
|
||||
name: Cleanup github runner caches on closed pull requests
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: 'PR number to clean caches for'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
cleanup:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: write
|
||||
steps:
|
||||
- name: Cleanup
|
||||
run: |
|
||||
echo "Fetching list of cache keys"
|
||||
cacheKeysForPR=$(gh cache list --ref "$BRANCH" --limit 100 --json id --jq '.[].id')
|
||||
|
||||
## Setting this to not fail the workflow while deleting cache keys.
|
||||
set +e
|
||||
echo "Deleting caches..."
|
||||
while IFS= read -r cacheKey; do
|
||||
gh cache delete "$cacheKey"
|
||||
done <<< "$cacheKeysForPR"
|
||||
echo "Done"
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
GH_REPO: ${{ github.repository }}
|
||||
BRANCH: refs/pull/${{ inputs.pr_number }}/merge
|
||||
34
.github/workflows/history-rewrite-tests.yml
vendored
34
.github/workflows/history-rewrite-tests.yml
vendored
@@ -1,34 +0,0 @@
|
||||
name: History Rewrite Tests
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ github.event.workflow_run.conclusion == 'success' }}
|
||||
steps:
|
||||
- name: Checkout with full history
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y bats shellcheck
|
||||
|
||||
- name: Run Bats tests
|
||||
run: |
|
||||
bats ./scripts/history-rewrite/tests || exit 1
|
||||
|
||||
- name: ShellCheck scripts
|
||||
run: |
|
||||
shellcheck scripts/history-rewrite/*.sh || true
|
||||
299
.github/workflows/nightly-build.yml
vendored
299
.github/workflows/nightly-build.yml
vendored
@@ -1,299 +0,0 @@
|
||||
name: Nightly Build & Package
|
||||
on:
|
||||
schedule:
|
||||
# Daily at 09:00 UTC (4am EST / 5am EDT)
|
||||
- cron: '0 9 * * *'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
reason:
|
||||
description: "Why are you running this manually?"
|
||||
required: true
|
||||
default: "manual trigger"
|
||||
skip_tests:
|
||||
description: "Skip test-nightly-image job?"
|
||||
required: false
|
||||
default: "false"
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.7'
|
||||
NODE_VERSION: '24.12.0'
|
||||
GOTOOLCHAIN: auto
|
||||
GHCR_REGISTRY: ghcr.io
|
||||
DOCKERHUB_REGISTRY: docker.io
|
||||
IMAGE_NAME: wikid82/charon
|
||||
|
||||
jobs:
|
||||
sync-development-to-nightly:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
outputs:
|
||||
has_changes: ${{ steps.sync.outputs.has_changes }}
|
||||
|
||||
steps:
|
||||
- name: Checkout nightly branch
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: nightly
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Configure Git
|
||||
run: |
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
- name: Sync development to nightly
|
||||
id: sync
|
||||
run: |
|
||||
# Fetch both branches to ensure we have the latest remote state
|
||||
git fetch origin development
|
||||
git fetch origin nightly
|
||||
|
||||
# Sync local nightly with remote nightly to prevent non-fast-forward errors
|
||||
echo "Syncing local nightly with remote nightly..."
|
||||
git reset --hard origin/nightly
|
||||
|
||||
# Check if there are differences between remote branches
|
||||
if git diff --quiet origin/nightly origin/development; then
|
||||
echo "No changes to sync from development to nightly"
|
||||
echo "has_changes=false" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "Syncing changes from development to nightly"
|
||||
# Fast-forward merge development into nightly
|
||||
git merge origin/development --ff-only -m "chore: sync from development branch [skip ci]" || {
|
||||
# If fast-forward fails, force reset to development
|
||||
echo "Fast-forward not possible, resetting nightly to development"
|
||||
git reset --hard origin/development
|
||||
}
|
||||
# Force push to handle cases where nightly diverged from development
|
||||
git push --force origin nightly
|
||||
echo "has_changes=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
build-and-push-nightly:
|
||||
needs: sync-development-to-nightly
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
HAS_DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN != '' }}
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
id-token: write
|
||||
outputs:
|
||||
version: ${{ steps.meta.outputs.version }}
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
digest: ${{ steps.build.outputs.digest }}
|
||||
|
||||
steps:
|
||||
- name: Checkout nightly branch
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: nightly
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set lowercase image name
|
||||
run: echo "IMAGE_NAME_LC=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ${{ env.GHCR_REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
if: env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: docker.io
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
|
||||
with:
|
||||
images: |
|
||||
${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=raw,value=nightly
|
||||
type=raw,value=nightly-{{date 'YYYY-MM-DD'}}
|
||||
type=sha,prefix=nightly-,format=short
|
||||
labels: |
|
||||
org.opencontainers.image.title=Charon Nightly
|
||||
org.opencontainers.image.description=Nightly build of Charon
|
||||
|
||||
- name: Build and push Docker image
|
||||
id: build
|
||||
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
build-args: |
|
||||
VERSION=nightly-${{ github.sha }}
|
||||
VCS_REF=${{ github.sha }}
|
||||
BUILD_DATE=${{ github.event.repository.pushed_at }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
provenance: true
|
||||
sbom: true
|
||||
|
||||
- name: Record nightly image digest
|
||||
run: |
|
||||
echo "## 🧾 Nightly Image Digest" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "- ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:nightly@${{ steps.build.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Generate SBOM
|
||||
uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
|
||||
with:
|
||||
image: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:nightly@${{ steps.build.outputs.digest }}
|
||||
format: cyclonedx-json
|
||||
output-file: sbom-nightly.json
|
||||
|
||||
- name: Upload SBOM artifact
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
||||
with:
|
||||
name: sbom-nightly
|
||||
path: sbom-nightly.json
|
||||
retention-days: 30
|
||||
|
||||
# Install Cosign for keyless signing
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
|
||||
|
||||
# Sign GHCR image with keyless signing (Sigstore/Fulcio)
|
||||
- name: Sign GHCR Image
|
||||
run: |
|
||||
echo "Signing GHCR nightly image with keyless signing..."
|
||||
cosign sign --yes "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
|
||||
echo "✅ GHCR nightly image signed successfully"
|
||||
|
||||
# Sign Docker Hub image with keyless signing (Sigstore/Fulcio)
|
||||
- name: Sign Docker Hub Image
|
||||
if: env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
run: |
|
||||
echo "Signing Docker Hub nightly image with keyless signing..."
|
||||
cosign sign --yes "${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
|
||||
echo "✅ Docker Hub nightly image signed successfully"
|
||||
|
||||
# Attach SBOM to Docker Hub image
|
||||
- name: Attach SBOM to Docker Hub
|
||||
if: env.HAS_DOCKERHUB_TOKEN == 'true'
|
||||
run: |
|
||||
echo "Attaching SBOM to Docker Hub nightly image..."
|
||||
cosign attach sbom --sbom sbom-nightly.json "${{ env.DOCKERHUB_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
|
||||
echo "✅ SBOM attached to Docker Hub nightly image"
|
||||
|
||||
test-nightly-image:
|
||||
needs: build-and-push-nightly
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
|
||||
steps:
|
||||
- name: Checkout nightly branch
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: nightly
|
||||
|
||||
- name: Set lowercase image name
|
||||
run: echo "IMAGE_NAME_LC=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Log in to GitHub Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ${{ env.GHCR_REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Pull nightly image
|
||||
run: docker pull "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:nightly@${{ needs.build-and-push-nightly.outputs.digest }}"
|
||||
|
||||
- name: Run container smoke test
|
||||
run: |
|
||||
docker run --name charon-nightly -d \
|
||||
-p 8080:8080 \
|
||||
"${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:nightly@${{ needs.build-and-push-nightly.outputs.digest }}"
|
||||
|
||||
# Wait for container to start
|
||||
sleep 10
|
||||
|
||||
# Check container is running
|
||||
docker ps | grep charon-nightly
|
||||
|
||||
# Basic health check
|
||||
curl -f http://localhost:8080/health || exit 1
|
||||
|
||||
# Cleanup
|
||||
docker stop charon-nightly
|
||||
docker rm charon-nightly
|
||||
|
||||
# NOTE: Standalone binary builds removed - Charon uses Docker-only deployment
|
||||
# The build-nightly-release job that ran GoReleaser for Windows/macOS/Linux binaries
|
||||
# was removed because:
|
||||
# 1. Charon is distributed exclusively via Docker images
|
||||
# 2. Cross-compilation was failing due to Unix-specific syscalls
|
||||
# 3. No users download standalone binaries (all use Docker)
|
||||
# If standalone binaries are needed in the future, re-add the job with Linux-only targets
|
||||
|
||||
verify-nightly-supply-chain:
|
||||
needs: build-and-push-nightly
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
security-events: write
|
||||
|
||||
steps:
|
||||
- name: Checkout nightly branch
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: nightly
|
||||
|
||||
- name: Set lowercase image name
|
||||
run: echo "IMAGE_NAME_LC=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Download SBOM
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
||||
with:
|
||||
name: sbom-nightly
|
||||
|
||||
- name: Scan with Grype
|
||||
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
|
||||
with:
|
||||
sbom: sbom-nightly.json
|
||||
fail-build: false
|
||||
severity-cutoff: high
|
||||
|
||||
- name: Scan with Trivy
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push-nightly.outputs.digest }}
|
||||
format: 'sarif'
|
||||
output: 'trivy-nightly.sarif'
|
||||
|
||||
- name: Upload Trivy results
|
||||
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
|
||||
with:
|
||||
sarif_file: 'trivy-nightly.sarif'
|
||||
category: 'trivy-nightly'
|
||||
|
||||
- name: Check for critical CVEs
|
||||
run: |
|
||||
if grep -q "CRITICAL" trivy-nightly.sarif; then
|
||||
echo "❌ Critical vulnerabilities found in nightly build"
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ No critical vulnerabilities found"
|
||||
68
.github/workflows/pr-checklist.yml
vendored
68
.github/workflows/pr-checklist.yml
vendored
@@ -1,68 +0,0 @@
|
||||
name: PR Checklist Validation (History Rewrite)
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: 'PR number to validate'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ inputs.pr_number || github.event.pull_request.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
validate:
|
||||
name: Validate history-rewrite checklist (conditional)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Validate PR checklist (only for history-rewrite changes)
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
env:
|
||||
PR_NUMBER: ${{ inputs.pr_number }}
|
||||
with:
|
||||
script: |
|
||||
const owner = context.repo.owner;
|
||||
const repo = context.repo.repo;
|
||||
const prNumber = Number(process.env.PR_NUMBER || context.issue.number);
|
||||
if (!prNumber) {
|
||||
core.setFailed('Missing PR number input for workflow_dispatch.');
|
||||
return;
|
||||
}
|
||||
const pr = await github.rest.pulls.get({owner, repo, pull_number: prNumber});
|
||||
const body = (pr.data && pr.data.body) || '';
|
||||
|
||||
// Determine if this PR modifies history-rewrite related files
|
||||
// Exclude the template file itself - it shouldn't trigger its own validation
|
||||
const filesResp = await github.rest.pulls.listFiles({ owner, repo, pull_number: prNumber });
|
||||
const files = filesResp.data.map(f => f.filename.toLowerCase());
|
||||
const relevant = files.some(fn => {
|
||||
// Skip the PR template itself
|
||||
if (fn === '.github/pull_request_template/history-rewrite.md') return false;
|
||||
// Check for actual history-rewrite implementation files
|
||||
return fn.startsWith('scripts/history-rewrite/') || fn === 'docs/plans/history_rewrite.md';
|
||||
});
|
||||
if (!relevant) {
|
||||
core.info('No history-rewrite related files changed; skipping checklist validation.');
|
||||
return;
|
||||
}
|
||||
|
||||
// Use a set of named checks with robust regex patterns for checkbox and phrase variants
|
||||
const checks = [
|
||||
{ name: 'preview_removals.sh mention', pattern: /preview_removals\.sh/i },
|
||||
{ name: 'data/backups mention', pattern: /data\/?backups/i },
|
||||
// Accept checked checkbox variants and inline code/backtick usage for the '--force' phrase
|
||||
{ name: 'explicit non-run of --force', pattern: /(?:\[\s*[xX]\s*\]\s*)?(?:i will not run|will not run|do not run|don'?t run|won'?t run)\b[^\n]*--force/i },
|
||||
];
|
||||
|
||||
const missing = checks.filter(c => !c.pattern.test(body)).map(c => c.name);
|
||||
if (missing.length > 0) {
|
||||
// Post a comment to the PR with instructions for filling the checklist
|
||||
const commentBody = `Hi! This PR touches history-rewrite artifacts and requires the checklist in .github/PULL_REQUEST_TEMPLATE/history-rewrite.md. The following items are missing in your PR body: ${missing.join(', ')}\n\nPlease update the PR description using the history-rewrite template and re-run checks.`;
|
||||
await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body: commentBody });
|
||||
core.setFailed('Missing required checklist items: ' + missing.join(', '));
|
||||
}
|
||||
208
.github/workflows/propagate-changes.yml
vendored
208
.github/workflows/propagate-changes.yml
vendored
@@ -1,208 +0,0 @@
|
||||
name: Propagate Changes Between Branches
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["Docker Build, Publish & Test"]
|
||||
types: [completed]
|
||||
branches: [ main, development ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
NODE_VERSION: '24.12.0'
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
issues: write
|
||||
|
||||
jobs:
|
||||
propagate:
|
||||
name: Create PR to synchronize branches
|
||||
runs-on: ubuntu-latest
|
||||
if: >-
|
||||
github.actor != 'github-actions[bot]' &&
|
||||
github.event.workflow_run.conclusion == 'success' &&
|
||||
(github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'development')
|
||||
steps:
|
||||
- name: Set up Node (for github-script)
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
|
||||
- name: Propagate Changes
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
env:
|
||||
CURRENT_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
|
||||
CURRENT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
with:
|
||||
script: |
|
||||
const currentBranch = process.env.CURRENT_BRANCH || context.ref.replace('refs/heads/', '');
|
||||
let excludedBranch = null;
|
||||
|
||||
// Loop Prevention: Identify if this commit is from a merged PR
|
||||
try {
|
||||
const associatedPRs = await github.rest.repos.listPullRequestsAssociatedWithCommit({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
commit_sha: process.env.CURRENT_SHA || context.sha,
|
||||
});
|
||||
|
||||
// If the commit comes from a PR, we identify the source branch
|
||||
// so we don't try to merge changes back into it immediately.
|
||||
if (associatedPRs.data.length > 0) {
|
||||
excludedBranch = associatedPRs.data[0].head.ref;
|
||||
core.info(`Commit ${process.env.CURRENT_SHA || context.sha} is associated with PR #${associatedPRs.data[0].number} coming from '${excludedBranch}'. This branch will be excluded from propagation to prevent loops.`);
|
||||
}
|
||||
} catch (err) {
|
||||
core.warning(`Failed to check associated PRs: ${err.message}`);
|
||||
}
|
||||
|
||||
async function createPR(src, base) {
|
||||
if (src === base) return;
|
||||
|
||||
core.info(`Checking propagation from ${src} to ${base}...`);
|
||||
|
||||
// Check for existing open PRs
|
||||
const { data: pulls } = await github.rest.pulls.list({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
state: 'open',
|
||||
head: `${context.repo.owner}:${src}`,
|
||||
base: base,
|
||||
});
|
||||
|
||||
if (pulls.length > 0) {
|
||||
core.info(`Existing PR found for ${src} -> ${base}. Skipping.`);
|
||||
return;
|
||||
}
|
||||
|
||||
// Compare commits to see if src is ahead of base
|
||||
try {
|
||||
const compare = await github.rest.repos.compareCommits({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
base: base,
|
||||
head: src,
|
||||
});
|
||||
|
||||
// If src is not ahead, nothing to merge
|
||||
if (compare.data.ahead_by === 0) {
|
||||
core.info(`${src} is not ahead of ${base}. No propagation needed.`);
|
||||
return;
|
||||
}
|
||||
|
||||
// If files changed include history-rewrite or other sensitive scripts,
|
||||
// avoid automatic propagation. This prevents bypassing checklist validation
|
||||
// and manual review for potentially destructive changes.
|
||||
let files = (compare.data.files || []).map(f => (f.filename || '').toLowerCase());
|
||||
|
||||
// Fallback: if compare.files is empty/truncated, aggregate files from the commit list
|
||||
if (files.length === 0 && Array.isArray(compare.data.commits) && compare.data.commits.length > 0) {
|
||||
for (const commit of compare.data.commits) {
|
||||
const commitData = await github.rest.repos.getCommit({ owner: context.repo.owner, repo: context.repo.repo, ref: commit.sha });
|
||||
for (const f of (commitData.data.files || [])) {
|
||||
files.push((f.filename || '').toLowerCase());
|
||||
}
|
||||
}
|
||||
files = Array.from(new Set(files));
|
||||
}
|
||||
|
||||
// Load propagation config (list of sensitive paths) from .github/propagate-config.yml when available
|
||||
// NOTE: .github/workflows/ was removed from defaults - workflow updates SHOULD propagate
|
||||
// to ensure downstream branches have correct CI/CD configurations
|
||||
let configPaths = ['scripts/history-rewrite/', 'data/backups', 'docs/plans/history_rewrite.md'];
|
||||
try {
|
||||
const configResp = await github.rest.repos.getContent({ owner: context.repo.owner, repo: context.repo.repo, path: '.github/propagate-config.yml', ref: src });
|
||||
const contentStr = Buffer.from(configResp.data.content, 'base64').toString('utf8');
|
||||
const lines = contentStr.split(/\r?\n/);
|
||||
let inSensitive = false;
|
||||
const parsedPaths = [];
|
||||
for (const line of lines) {
|
||||
const trimmed = line.trim();
|
||||
if (!inSensitive && trimmed.startsWith('sensitive_paths:')) { inSensitive = true; continue; }
|
||||
if (inSensitive) {
|
||||
if (trimmed.startsWith('-')) parsedPaths.push(trimmed.substring(1).trim());
|
||||
else if (trimmed.length === 0) continue; else break;
|
||||
}
|
||||
}
|
||||
if (parsedPaths.length > 0) configPaths = parsedPaths.map(p => p.toLowerCase());
|
||||
} catch (err) { core.info('No .github/propagate-config.yml or parse failure; using defaults.'); }
|
||||
|
||||
const sensitive = files.some(fn => configPaths.some(sp => fn.startsWith(sp) || fn.includes(sp)));
|
||||
if (sensitive) {
|
||||
core.info(`${src} -> ${base} contains sensitive changes (${files.join(', ')}). Skipping automatic propagation.`);
|
||||
return;
|
||||
}
|
||||
} catch (error) {
|
||||
// If base branch doesn't exist, etc.
|
||||
core.warning(`Error comparing ${src} to ${base}: ${error.message}`);
|
||||
return;
|
||||
}
|
||||
|
||||
// Create PR
|
||||
try {
|
||||
const pr = await github.rest.pulls.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: `Propagate changes from ${src} into ${base}`,
|
||||
head: src,
|
||||
base: base,
|
||||
body: `Automated PR to propagate changes from ${src} into ${base}.\n\nTriggered by push to ${currentBranch}.`,
|
||||
draft: true,
|
||||
});
|
||||
core.info(`Created PR #${pr.data.number} to merge ${src} into ${base}`);
|
||||
// Add an 'auto-propagate' label to the created PR and create the label if missing
|
||||
try {
|
||||
try {
|
||||
await github.rest.issues.getLabel({ owner: context.repo.owner, repo: context.repo.repo, name: 'auto-propagate' });
|
||||
} catch (e) {
|
||||
await github.rest.issues.createLabel({ owner: context.repo.owner, repo: context.repo.repo, name: 'auto-propagate', color: '7dd3fc', description: 'Automatically created propagate PRs' });
|
||||
}
|
||||
await github.rest.issues.addLabels({ owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.data.number, labels: ['auto-propagate'] });
|
||||
} catch (labelErr) {
|
||||
core.warning('Failed to ensure or add auto-propagate label: ' + labelErr.message);
|
||||
}
|
||||
} catch (error) {
|
||||
core.warning(`Failed to create PR from ${src} to ${base}: ${error.message}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (currentBranch === 'main') {
|
||||
// Main -> Development
|
||||
// Only propagate if development is not the source (loop prevention)
|
||||
if (excludedBranch !== 'development') {
|
||||
await createPR('main', 'development');
|
||||
} else {
|
||||
core.info('Push originated from development (excluded). Skipping propagation back to development.');
|
||||
}
|
||||
} else if (currentBranch === 'development') {
|
||||
// Development -> Feature/Hotfix branches (The Pittsburgh Model)
|
||||
// We propagate changes from dev DOWN to features/hotfixes so they stay up to date.
|
||||
|
||||
const branches = await github.paginate(github.rest.repos.listBranches, {
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
});
|
||||
|
||||
// Filter for feature/* and hotfix/* branches using regex
|
||||
// AND exclude the branch that just got merged in (if any)
|
||||
const targetBranches = branches
|
||||
.map(b => b.name)
|
||||
.filter(name => {
|
||||
const isTargetType = /^feature\/|^hotfix\//.test(name);
|
||||
const isExcluded = (name === excludedBranch);
|
||||
return isTargetType && !isExcluded;
|
||||
});
|
||||
|
||||
core.info(`Found ${targetBranches.length} target branches (excluding '${excludedBranch || 'none'}'): ${targetBranches.join(', ')}`);
|
||||
|
||||
for (const targetBranch of targetBranches) {
|
||||
await createPR('development', targetBranch);
|
||||
}
|
||||
}
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
CHARON_TOKEN: ${{ secrets.CHARON_TOKEN }}
|
||||
217
.github/workflows/quality-checks.yml
vendored
217
.github/workflows/quality-checks.yml
vendored
@@ -1,217 +0,0 @@
|
||||
name: Quality Checks
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main, development, 'feature/**' ]
|
||||
pull_request:
|
||||
branches: [ main, development ]
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
checks: write
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.6'
|
||||
NODE_VERSION: '24.12.0'
|
||||
GOTOOLCHAIN: auto
|
||||
|
||||
jobs:
|
||||
backend-quality:
|
||||
name: Backend (Go)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
cache-dependency-path: backend/go.sum
|
||||
|
||||
- name: Repo health check
|
||||
run: |
|
||||
bash scripts/repo_health_check.sh
|
||||
|
||||
- name: Run Go tests
|
||||
id: go-tests
|
||||
working-directory: ${{ github.workspace }}
|
||||
env:
|
||||
CGO_ENABLED: 1
|
||||
run: |
|
||||
bash scripts/go-test-coverage.sh 2>&1 | tee backend/test-output.txt
|
||||
exit ${PIPESTATUS[0]}
|
||||
|
||||
- name: Go Test Summary
|
||||
if: always()
|
||||
working-directory: backend
|
||||
run: |
|
||||
echo "## 🔧 Backend Test Results" >> $GITHUB_STEP_SUMMARY
|
||||
if [ "${{ steps.go-tests.outcome }}" == "success" ]; then
|
||||
echo "✅ **All tests passed**" >> $GITHUB_STEP_SUMMARY
|
||||
PASS_COUNT=$(grep -c "^--- PASS" test-output.txt || echo "0")
|
||||
echo "- Tests passed: $PASS_COUNT" >> $GITHUB_STEP_SUMMARY
|
||||
else
|
||||
echo "❌ **Tests failed**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "### Failed Tests:" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```' >> $GITHUB_STEP_SUMMARY
|
||||
grep -E "^--- FAIL|FAIL\s+github" test-output.txt || echo "See logs for details"
|
||||
grep -E "^--- FAIL|FAIL\s+github" test-output.txt >> $GITHUB_STEP_SUMMARY || echo "See logs for details" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```' >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
|
||||
# Codecov upload moved to `codecov-upload.yml` which is push-only.
|
||||
|
||||
|
||||
- name: Run golangci-lint
|
||||
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
|
||||
with:
|
||||
version: latest
|
||||
working-directory: backend
|
||||
args: --timeout=5m
|
||||
continue-on-error: true
|
||||
|
||||
- name: GORM Security Scanner
|
||||
id: gorm-scan
|
||||
run: |
|
||||
chmod +x scripts/scan-gorm-security.sh
|
||||
./scripts/scan-gorm-security.sh --check
|
||||
continue-on-error: false
|
||||
|
||||
- name: GORM Security Scan Summary
|
||||
if: always()
|
||||
run: |
|
||||
echo "## 🔒 GORM Security Scan Results" >> $GITHUB_STEP_SUMMARY
|
||||
if [ "${{ steps.gorm-scan.outcome }}" == "success" ]; then
|
||||
echo "✅ **No GORM security issues detected**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "All models follow secure GORM patterns:" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ No exposed internal database IDs" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ No exposed API keys or secrets" >> $GITHUB_STEP_SUMMARY
|
||||
echo "- ✅ Response DTOs properly structured" >> $GITHUB_STEP_SUMMARY
|
||||
else
|
||||
echo "❌ **GORM security issues found**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "Run locally for details:" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```bash' >> $GITHUB_STEP_SUMMARY
|
||||
echo "./scripts/scan-gorm-security.sh --report" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```' >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "See [GORM Security Scanner docs](docs/implementation/gorm_security_scanner_complete.md) for remediation guidance." >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
|
||||
- name: Annotate GORM Security Issues
|
||||
if: failure() && steps.gorm-scan.outcome == 'failure'
|
||||
run: |
|
||||
echo "::error title=GORM Security Issues Detected::Run './scripts/scan-gorm-security.sh --report' locally for detailed findings. See docs/implementation/gorm_security_scanner_complete.md for remediation guidance."
|
||||
|
||||
- name: Run Perf Asserts
|
||||
working-directory: backend
|
||||
env:
|
||||
# Conservative defaults to avoid flakiness on CI; tune as necessary
|
||||
PERF_MAX_MS_GETSTATUS_P95: 500ms
|
||||
PERF_MAX_MS_GETSTATUS_P95_PARALLEL: 1500ms
|
||||
PERF_MAX_MS_LISTDECISIONS_P95: 2000ms
|
||||
run: |
|
||||
echo "## 🔍 Running performance assertions (TestPerf)" >> $GITHUB_STEP_SUMMARY
|
||||
go test -run TestPerf -v ./internal/api/handlers -count=1 | tee perf-output.txt
|
||||
exit ${PIPESTATUS[0]}
|
||||
|
||||
frontend-quality:
|
||||
name: Frontend (React)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Repo health check
|
||||
run: |
|
||||
bash scripts/repo_health_check.sh
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: frontend/package-lock.json
|
||||
|
||||
- name: Check if frontend was modified in PR
|
||||
id: check-frontend
|
||||
run: |
|
||||
if [ "${{ github.event_name }}" = "push" ]; then
|
||||
echo "frontend_changed=true" >> $GITHUB_OUTPUT
|
||||
exit 0
|
||||
fi
|
||||
# Try to fetch the PR base ref. This may fail for forked PRs or other cases.
|
||||
git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1 || true
|
||||
|
||||
# Compute changed files against the PR base ref, fallback to origin/main, then fallback to last 10 commits
|
||||
CHANGED=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD 2>/dev/null || echo "")
|
||||
echo "Changed files (base ref):\n$CHANGED"
|
||||
|
||||
if [ -z "$CHANGED" ]; then
|
||||
echo "Base ref diff empty or failed; fetching origin/main for fallback..."
|
||||
git fetch origin main --depth=1 || true
|
||||
CHANGED=$(git diff --name-only origin/main...HEAD 2>/dev/null || echo "")
|
||||
echo "Changed files (main fallback):\n$CHANGED"
|
||||
fi
|
||||
|
||||
if [ -z "$CHANGED" ]; then
|
||||
echo "Still empty; falling back to diffing last 10 commits from HEAD..."
|
||||
CHANGED=$(git diff --name-only HEAD~10...HEAD 2>/dev/null || echo "")
|
||||
echo "Changed files (HEAD~10 fallback):\n$CHANGED"
|
||||
fi
|
||||
|
||||
if echo "$CHANGED" | grep -q '^frontend/'; then
|
||||
echo "frontend_changed=true" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "frontend_changed=false" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Install dependencies
|
||||
working-directory: frontend
|
||||
if: ${{ github.event_name == 'push' || steps.check-frontend.outputs.frontend_changed == 'true' }}
|
||||
run: npm ci
|
||||
|
||||
- name: Run frontend tests and coverage
|
||||
id: frontend-tests
|
||||
working-directory: ${{ github.workspace }}
|
||||
if: ${{ github.event_name == 'push' || steps.check-frontend.outputs.frontend_changed == 'true' }}
|
||||
run: |
|
||||
bash scripts/frontend-test-coverage.sh 2>&1 | tee frontend/test-output.txt
|
||||
exit ${PIPESTATUS[0]}
|
||||
|
||||
- name: Frontend Test Summary
|
||||
if: always()
|
||||
working-directory: frontend
|
||||
run: |
|
||||
echo "## ⚛️ Frontend Test Results" >> $GITHUB_STEP_SUMMARY
|
||||
if [ "${{ steps.frontend-tests.outcome }}" == "success" ]; then
|
||||
echo "✅ **All tests passed**" >> $GITHUB_STEP_SUMMARY
|
||||
# Extract test counts from vitest output
|
||||
if grep -q "Tests:" test-output.txt; then
|
||||
grep "Tests:" test-output.txt | tail -1 >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
else
|
||||
echo "❌ **Tests failed**" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "### Failed Tests:" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```' >> $GITHUB_STEP_SUMMARY
|
||||
# Extract failed test info from vitest output
|
||||
grep -E "FAIL|✕|×|AssertionError|Error:" test-output.txt | head -30 >> $GITHUB_STEP_SUMMARY || echo "See logs for details" >> $GITHUB_STEP_SUMMARY
|
||||
echo '```' >> $GITHUB_STEP_SUMMARY
|
||||
fi
|
||||
|
||||
# Codecov upload moved to `codecov-upload.yml` which is push-only.
|
||||
|
||||
|
||||
|
||||
- name: Run frontend lint
|
||||
working-directory: frontend
|
||||
run: npm run lint
|
||||
continue-on-error: true
|
||||
112
.github/workflows/rate-limit-integration.yml
vendored
112
.github/workflows/rate-limit-integration.yml
vendored
@@ -1,112 +0,0 @@
|
||||
name: Rate Limit integration
|
||||
|
||||
# Phase 2-3: Build Once, Test Many - Use registry image instead of building
|
||||
# This workflow now waits for docker-build.yml to complete and pulls the built image
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag to test (e.g., pr-123-abc1234, latest)'
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
# Prevent race conditions when PR is updated mid-test
|
||||
# Cancels old test runs when new build completes with different SHA
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
rate-limit-integration:
|
||||
name: Rate Limiting Integration
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- name: Build Docker image (Local)
|
||||
run: |
|
||||
echo "Building image locally for integration tests..."
|
||||
docker build -t charon:local .
|
||||
echo "✅ Successfully built charon:local"
|
||||
|
||||
- name: Run rate limit integration tests
|
||||
id: ratelimit-test
|
||||
run: |
|
||||
chmod +x scripts/rate_limit_integration.sh
|
||||
scripts/rate_limit_integration.sh 2>&1 | tee ratelimit-test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Dump Debug Info on Failure
|
||||
if: failure()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔍 Debug Information"
|
||||
echo ""
|
||||
|
||||
echo "### Container Status"
|
||||
echo '```'
|
||||
docker ps -a --filter "name=charon" --filter "name=ratelimit" --filter "name=backend" 2>&1 || true
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Security Config API"
|
||||
echo '```json'
|
||||
curl -s http://localhost:8280/api/v1/security/config 2>/dev/null | head -100 || echo "Could not retrieve security config"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Security Status API"
|
||||
echo '```json'
|
||||
curl -s http://localhost:8280/api/v1/security/status 2>/dev/null | head -100 || echo "Could not retrieve security status"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Caddy Admin Config (rate_limit handlers)"
|
||||
echo '```json'
|
||||
curl -s http://localhost:2119/config 2>/dev/null | grep -A 20 '"handler":"rate_limit"' | head -30 || echo "Could not retrieve Caddy config"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Charon Container Logs (last 100 lines)"
|
||||
echo '```'
|
||||
docker logs charon-ratelimit-test 2>&1 | tail -100 || echo "No container logs available"
|
||||
echo '```'
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Rate Limit Integration Summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## ⏱️ Rate Limit Integration Test Results"
|
||||
if [ "${{ steps.ratelimit-test.outcome }}" == "success" ]; then
|
||||
echo "✅ **All rate limit tests passed**"
|
||||
echo ""
|
||||
echo "### Test Results:"
|
||||
echo '```'
|
||||
grep -E "✓|=== ALL|HTTP 429|HTTP 200" ratelimit-test-output.txt | head -30 || echo "See logs for details"
|
||||
echo '```'
|
||||
echo ""
|
||||
echo "### Verified Behaviors:"
|
||||
echo "- Requests within limit return HTTP 200"
|
||||
echo "- Requests exceeding limit return HTTP 429"
|
||||
echo "- Retry-After header present on blocked responses"
|
||||
echo "- Rate limit window resets correctly"
|
||||
else
|
||||
echo "❌ **Rate limit tests failed**"
|
||||
echo ""
|
||||
echo "### Failure Details:"
|
||||
echo '```'
|
||||
grep -E "✗|FAIL|Error|failed|expected" ratelimit-test-output.txt | head -30 || echo "See logs for details"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
docker rm -f charon-ratelimit-test || true
|
||||
docker rm -f ratelimit-backend || true
|
||||
docker volume rm charon_ratelimit_data caddy_ratelimit_data caddy_ratelimit_config 2>/dev/null || true
|
||||
docker network rm containers_default || true
|
||||
71
.github/workflows/release-goreleaser.yml
vendored
71
.github/workflows/release-goreleaser.yml
vendored
@@ -1,71 +0,0 @@
|
||||
name: Release (GoReleaser)
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
GO_VERSION: '1.25.7'
|
||||
NODE_VERSION: '24.12.0'
|
||||
GOTOOLCHAIN: auto
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
goreleaser:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
# Use the built-in GITHUB_TOKEN by default for GitHub API operations.
|
||||
# If you need to provide a PAT with elevated permissions, add a GITHUB_TOKEN secret
|
||||
# at the repo or organization level and update the env here accordingly.
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
|
||||
- name: Build Frontend
|
||||
working-directory: frontend
|
||||
run: |
|
||||
# Inject version into frontend build from tag (if present)
|
||||
VERSION=${GITHUB_REF#refs/tags/}
|
||||
echo "VITE_APP_VERSION=${VERSION}" >> "$GITHUB_ENV"
|
||||
npm ci
|
||||
npm run build
|
||||
|
||||
- name: Install Cross-Compilation Tools (Zig)
|
||||
# Security: Pinned to full SHA for supply chain security
|
||||
uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2
|
||||
with:
|
||||
version: 0.13.0
|
||||
|
||||
# GITHUB_TOKEN is set from GITHUB_TOKEN or CHARON_TOKEN (fallback), defaulting to GITHUB_TOKEN
|
||||
|
||||
|
||||
- name: Run GoReleaser
|
||||
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
|
||||
with:
|
||||
distribution: goreleaser
|
||||
version: '~> v2.5'
|
||||
args: release --clean
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
# CGO settings are handled in .goreleaser.yaml via Zig
|
||||
33
.github/workflows/renovate.yml
vendored
33
.github/workflows/renovate.yml
vendored
@@ -1,33 +0,0 @@
|
||||
name: Renovate
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 5 * * *' # daily 05:00 UTC
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}
|
||||
cancel-in-progress: false
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
issues: write
|
||||
|
||||
jobs:
|
||||
renovate:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Run Renovate
|
||||
uses: renovatebot/github-action@e23f4d9675532445118c886434f5a34292b630b4 # v46.0.2
|
||||
with:
|
||||
configurationFile: .github/renovate.json
|
||||
token: ${{ secrets.RENOVATE_TOKEN || secrets.GITHUB_TOKEN }}
|
||||
env:
|
||||
LOG_LEVEL: debug
|
||||
101
.github/workflows/renovate_prune.yml
vendored
101
.github/workflows/renovate_prune.yml
vendored
@@ -1,101 +0,0 @@
|
||||
name: "Prune Renovate Branches"
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: '0 3 * * *' # daily at 03:00 UTC
|
||||
|
||||
permissions:
|
||||
contents: write # required to delete branch refs
|
||||
pull-requests: read
|
||||
|
||||
jobs:
|
||||
prune:
|
||||
runs-on: ubuntu-latest
|
||||
concurrency:
|
||||
group: prune-renovate-branches
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
BRANCH_PREFIX: "renovate/" # adjust if you use a different prefix
|
||||
|
||||
steps:
|
||||
- name: Choose GitHub Token
|
||||
run: |
|
||||
if [ -n "${{ secrets.GITHUB_TOKEN }}" ]; then
|
||||
echo "Using GITHUB_TOKEN" >&2
|
||||
echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_ENV"
|
||||
else
|
||||
echo "Using CHARON_TOKEN fallback" >&2
|
||||
echo "GITHUB_TOKEN=${{ secrets.CHARON_TOKEN }}" >> "$GITHUB_ENV"
|
||||
fi
|
||||
- name: Prune renovate branches
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
github-token: ${{ env.GITHUB_TOKEN }}
|
||||
script: |
|
||||
const owner = context.repo.owner;
|
||||
const repo = context.repo.repo;
|
||||
const branchPrefix = (process.env.BRANCH_PREFIX || 'renovate/').replace(/^refs\/heads\//, '');
|
||||
const refPrefix = `heads/${branchPrefix}`; // e.g. "heads/renovate/"
|
||||
|
||||
core.info(`Searching for refs with prefix: ${refPrefix}`);
|
||||
|
||||
// List matching refs (branches) under the prefix
|
||||
let refs;
|
||||
try {
|
||||
refs = await github.rest.git.listMatchingRefs({
|
||||
owner,
|
||||
repo,
|
||||
ref: refPrefix
|
||||
});
|
||||
} catch (err) {
|
||||
core.info(`No matching refs or API error: ${err.message}`);
|
||||
refs = { data: [] };
|
||||
}
|
||||
|
||||
for (const r of refs.data) {
|
||||
const fullRef = r.ref; // "refs/heads/renovate/..."
|
||||
const branchName = fullRef.replace('refs/heads/', '');
|
||||
core.info(`Evaluating branch: ${branchName}`);
|
||||
|
||||
// Find PRs for this branch (head = "owner:branch")
|
||||
const prs = await github.rest.pulls.list({
|
||||
owner,
|
||||
repo,
|
||||
head: `${owner}:${branchName}`,
|
||||
state: 'all',
|
||||
per_page: 100
|
||||
});
|
||||
|
||||
let shouldDelete = false;
|
||||
if (!prs.data || prs.data.length === 0) {
|
||||
core.info(`No PRs found for ${branchName} — marking for deletion.`);
|
||||
shouldDelete = true;
|
||||
} else {
|
||||
// If none of the PRs are open, safe to delete
|
||||
const hasOpen = prs.data.some(p => p.state === 'open');
|
||||
if (!hasOpen) {
|
||||
core.info(`All PRs for ${branchName} are closed — marking for deletion.`);
|
||||
shouldDelete = true;
|
||||
} else {
|
||||
core.info(`Open PR(s) exist for ${branchName} — skipping deletion.`);
|
||||
}
|
||||
}
|
||||
|
||||
if (shouldDelete) {
|
||||
try {
|
||||
await github.rest.git.deleteRef({
|
||||
owner,
|
||||
repo,
|
||||
ref: `heads/${branchName}`
|
||||
});
|
||||
core.info(`Deleted branch: ${branchName}`);
|
||||
} catch (delErr) {
|
||||
core.warning(`Failed to delete ${branchName}: ${delErr.message}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
- name: Done
|
||||
run: echo "Prune run completed."
|
||||
41
.github/workflows/repo-health.yml
vendored
41
.github/workflows/repo-health.yml
vendored
@@ -1,41 +0,0 @@
|
||||
name: Repo Health Check
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 0 * * *'
|
||||
workflow_dispatch: {}
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
repo_health:
|
||||
name: Repo health
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
lfs: true
|
||||
|
||||
- name: Set up Git
|
||||
run: |
|
||||
git --version
|
||||
git lfs install --local || true
|
||||
|
||||
- name: Run repo health check
|
||||
env:
|
||||
MAX_MB: 100
|
||||
LFS_ALLOW_MB: 50
|
||||
run: |
|
||||
bash scripts/repo_health_check.sh
|
||||
|
||||
- name: Upload health output
|
||||
if: always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: repo-health-output
|
||||
path: |
|
||||
/tmp/repo_big_files.txt
|
||||
336
.github/workflows/security-pr.yml
vendored
336
.github/workflows/security-pr.yml
vendored
@@ -1,336 +0,0 @@
|
||||
# Security Scan for Pull Requests
|
||||
# Runs Trivy security scanning on PR Docker images after the build workflow completes
|
||||
# This workflow extracts the charon binary from the container and performs filesystem scanning
|
||||
name: Security Scan (PR)
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: 'PR number to scan (optional)'
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
concurrency:
|
||||
group: security-pr-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
security-scan:
|
||||
name: Trivy Binary Scan
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
# Run for: manual dispatch, PR builds, or any push builds from docker-build
|
||||
if: >-
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
github.event_name == 'pull_request' ||
|
||||
((github.event.workflow_run.event == 'push' || github.event.workflow_run.pull_requests[0].number != null) &&
|
||||
(github.event.workflow_run.status != 'completed' || github.event.workflow_run.conclusion == 'success'))
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
security-events: write
|
||||
actions: read
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
# actions/checkout v4.2.2
|
||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
|
||||
|
||||
- name: Extract PR number from workflow_run
|
||||
id: pr-info
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
||||
# Manual dispatch - use input or fail gracefully
|
||||
if [[ -n "${{ inputs.pr_number }}" ]]; then
|
||||
echo "pr_number=${{ inputs.pr_number }}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Using manually provided PR number: ${{ inputs.pr_number }}"
|
||||
else
|
||||
echo "⚠️ No PR number provided for manual dispatch"
|
||||
echo "pr_number=" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Extract PR number from context
|
||||
HEAD_SHA="${{ github.event.workflow_run.head_sha || github.event.pull_request.head.sha || github.sha }}"
|
||||
echo "🔍 Looking for PR with head SHA: ${HEAD_SHA}"
|
||||
|
||||
# Query GitHub API for PR associated with this commit
|
||||
PR_NUMBER=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/commits/${HEAD_SHA}/pulls" \
|
||||
--jq '.[0].number // empty' 2>/dev/null || echo "")
|
||||
|
||||
if [[ -n "${PR_NUMBER}" ]]; then
|
||||
echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Found PR number: ${PR_NUMBER}"
|
||||
else
|
||||
echo "⚠️ Could not find PR number for SHA: ${HEAD_SHA}"
|
||||
echo "pr_number=" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Check if this is a push event (not a PR)
|
||||
if [[ "${{ github.event_name }}" == "push" || "${{ github.event.workflow_run.event }}" == "push" || -z "${PR_NUMBER}" ]]; then
|
||||
HEAD_BRANCH="${{ github.event.workflow_run.head_branch || github.ref_name }}"
|
||||
echo "is_push=true" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Detected push build from branch: ${HEAD_BRANCH}"
|
||||
else
|
||||
echo "is_push=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Build Docker image (Local)
|
||||
if: github.event_name == 'push' || github.event_name == 'pull_request'
|
||||
run: |
|
||||
echo "Building image locally for security scan..."
|
||||
docker build -t charon:local .
|
||||
echo "✅ Successfully built charon:local"
|
||||
|
||||
- name: Check for PR image artifact
|
||||
id: check-artifact
|
||||
if: (steps.pr-info.outputs.pr_number != '' || steps.pr-info.outputs.is_push == 'true') && github.event_name != 'push' && github.event_name != 'pull_request'
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
# Determine artifact name based on event type
|
||||
if [[ "${{ steps.pr-info.outputs.is_push }}" == "true" ]]; then
|
||||
ARTIFACT_NAME="push-image"
|
||||
else
|
||||
PR_NUMBER="${{ steps.pr-info.outputs.pr_number }}"
|
||||
ARTIFACT_NAME="pr-image-${PR_NUMBER}"
|
||||
fi
|
||||
RUN_ID="${{ github.event.workflow_run.id }}"
|
||||
|
||||
echo "🔍 Checking for artifact: ${ARTIFACT_NAME}"
|
||||
|
||||
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
|
||||
# For manual dispatch, find the most recent workflow run with this artifact
|
||||
RUN_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/actions/workflows/docker-build.yml/runs?status=success&per_page=10" \
|
||||
--jq '.workflow_runs[0].id // empty' 2>/dev/null || echo "")
|
||||
|
||||
if [[ -z "${RUN_ID}" ]]; then
|
||||
echo "⚠️ No successful workflow runs found"
|
||||
echo "artifact_exists=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
elif [[ -z "${RUN_ID}" ]]; then
|
||||
# If triggered by push/pull_request, RUN_ID is empty. Find recent run for this commit.
|
||||
HEAD_SHA="${{ github.event.workflow_run.head_sha || github.event.pull_request.head.sha || github.sha }}"
|
||||
echo "🔍 Searching for workflow run for SHA: ${HEAD_SHA}"
|
||||
# Retry a few times as the run might be just starting or finishing
|
||||
for i in {1..3}; do
|
||||
RUN_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/actions/workflows/docker-build.yml/runs?head_sha=${HEAD_SHA}&status=success&per_page=1" \
|
||||
--jq '.workflow_runs[0].id // empty' 2>/dev/null || echo "")
|
||||
if [[ -n "${RUN_ID}" ]]; then break; fi
|
||||
echo "⏳ Waiting for workflow run to appear/complete... ($i/3)"
|
||||
sleep 5
|
||||
done
|
||||
fi
|
||||
|
||||
echo "run_id=${RUN_ID}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Check if the artifact exists in the workflow run
|
||||
ARTIFACT_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" \
|
||||
--jq ".artifacts[] | select(.name == \"${ARTIFACT_NAME}\") | .id" 2>/dev/null || echo "")
|
||||
|
||||
if [[ -n "${ARTIFACT_ID}" ]]; then
|
||||
echo "artifact_exists=true" >> "$GITHUB_OUTPUT"
|
||||
echo "artifact_id=${ARTIFACT_ID}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Found artifact: ${ARTIFACT_NAME} (ID: ${ARTIFACT_ID})"
|
||||
else
|
||||
echo "artifact_exists=false" >> "$GITHUB_OUTPUT"
|
||||
echo "⚠️ Artifact not found: ${ARTIFACT_NAME}"
|
||||
echo "ℹ️ This is expected for non-PR builds or if the image was not uploaded"
|
||||
fi
|
||||
|
||||
- name: Skip if no artifact
|
||||
if: ((steps.pr-info.outputs.pr_number == '' && steps.pr-info.outputs.is_push != 'true') || steps.check-artifact.outputs.artifact_exists != 'true') && github.event_name != 'push' && github.event_name != 'pull_request'
|
||||
run: |
|
||||
echo "ℹ️ Skipping security scan - no PR image artifact available"
|
||||
echo "This is expected for:"
|
||||
echo " - Pushes to main/release branches"
|
||||
echo " - PRs where Docker build failed"
|
||||
echo " - Manual dispatch without PR number"
|
||||
exit 0
|
||||
|
||||
- name: Download PR image artifact
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true'
|
||||
# actions/download-artifact v4.1.8
|
||||
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
|
||||
with:
|
||||
name: ${{ steps.pr-info.outputs.is_push == 'true' && 'push-image' || format('pr-image-{0}', steps.pr-info.outputs.pr_number) }}
|
||||
run-id: ${{ steps.check-artifact.outputs.run_id }}
|
||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Load Docker image
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true'
|
||||
run: |
|
||||
echo "📦 Loading Docker image..."
|
||||
docker load < charon-pr-image.tar
|
||||
echo "✅ Docker image loaded"
|
||||
docker images | grep charon
|
||||
|
||||
- name: Extract charon binary from container
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request'
|
||||
id: extract
|
||||
run: |
|
||||
# Use local image for Push/PR events
|
||||
if [[ "${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "pull_request" ]]; then
|
||||
echo "Using local image: charon:local"
|
||||
CONTAINER_ID=$(docker create "charon:local")
|
||||
echo "container_id=${CONTAINER_ID}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Extract the charon binary
|
||||
mkdir -p ./scan-target
|
||||
docker cp "${CONTAINER_ID}:/app/charon" ./scan-target/charon
|
||||
docker rm "${CONTAINER_ID}"
|
||||
|
||||
if [[ -f "./scan-target/charon" ]]; then
|
||||
echo "✅ Binary extracted successfully"
|
||||
ls -lh ./scan-target/charon
|
||||
echo "binary_path=./scan-target" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "❌ Failed to extract binary"
|
||||
exit 1
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Normalize image name for reference
|
||||
IMAGE_NAME=$(echo "${{ github.repository_owner }}/charon" | tr '[:upper:]' '[:lower:]')
|
||||
if [[ "${{ steps.pr-info.outputs.is_push }}" == "true" ]]; then
|
||||
BRANCH_NAME="${{ github.event.workflow_run.head_branch }}"
|
||||
if [[ -z "${BRANCH_NAME}" ]]; then
|
||||
echo "❌ ERROR: Branch name is empty for push build"
|
||||
exit 1
|
||||
fi
|
||||
# Normalize branch name for Docker tag (replace / and other special chars with -)
|
||||
# This matches docker/metadata-action behavior: type=ref,event=branch
|
||||
TAG_SAFE_BRANCH="${BRANCH_NAME//\//-}"
|
||||
IMAGE_REF="ghcr.io/${IMAGE_NAME}:${TAG_SAFE_BRANCH}"
|
||||
elif [[ -n "${{ steps.pr-info.outputs.pr_number }}" ]]; then
|
||||
IMAGE_REF="ghcr.io/${IMAGE_NAME}:pr-${{ steps.pr-info.outputs.pr_number }}"
|
||||
else
|
||||
echo "❌ ERROR: Cannot determine image reference"
|
||||
echo " - is_push: ${{ steps.pr-info.outputs.is_push }}"
|
||||
echo " - pr_number: ${{ steps.pr-info.outputs.pr_number }}"
|
||||
echo " - branch: ${{ github.event.workflow_run.head_branch }}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Validate the image reference format
|
||||
if [[ ! "${IMAGE_REF}" =~ ^ghcr\.io/[a-z0-9_-]+/[a-z0-9_-]+:[a-zA-Z0-9._-]+$ ]]; then
|
||||
echo "❌ ERROR: Invalid image reference format: ${IMAGE_REF}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🔍 Extracting binary from: ${IMAGE_REF}"
|
||||
|
||||
# Create container without starting it
|
||||
CONTAINER_ID=$(docker create "${IMAGE_REF}")
|
||||
echo "container_id=${CONTAINER_ID}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Extract the charon binary
|
||||
mkdir -p ./scan-target
|
||||
docker cp "${CONTAINER_ID}:/app/charon" ./scan-target/charon
|
||||
|
||||
# Cleanup container
|
||||
docker rm "${CONTAINER_ID}"
|
||||
|
||||
# Verify extraction
|
||||
if [[ -f "./scan-target/charon" ]]; then
|
||||
echo "✅ Binary extracted successfully"
|
||||
ls -lh ./scan-target/charon
|
||||
echo "binary_path=./scan-target" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "❌ Failed to extract binary"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Run Trivy filesystem scan (SARIF output)
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request'
|
||||
# aquasecurity/trivy-action v0.33.1
|
||||
uses: aquasecurity/trivy-action@22438a435773de8c97dc0958cc0b823c45b064ac
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
scan-ref: ${{ steps.extract.outputs.binary_path }}
|
||||
format: 'sarif'
|
||||
output: 'trivy-binary-results.sarif'
|
||||
severity: 'CRITICAL,HIGH,MEDIUM'
|
||||
continue-on-error: true
|
||||
|
||||
- name: Upload Trivy SARIF to GitHub Security
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request'
|
||||
# github/codeql-action v4
|
||||
uses: github/codeql-action/upload-sarif@b13d724d35ff0a814e21683638ed68ed34cf53d1
|
||||
with:
|
||||
sarif_file: 'trivy-binary-results.sarif'
|
||||
category: ${{ steps.pr-info.outputs.is_push == 'true' && format('security-scan-{0}', github.event.workflow_run.head_branch) || format('security-scan-pr-{0}', steps.pr-info.outputs.pr_number) }}
|
||||
continue-on-error: true
|
||||
|
||||
- name: Run Trivy filesystem scan (fail on CRITICAL/HIGH)
|
||||
if: steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request'
|
||||
# aquasecurity/trivy-action v0.33.1
|
||||
uses: aquasecurity/trivy-action@22438a435773de8c97dc0958cc0b823c45b064ac
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
scan-ref: ${{ steps.extract.outputs.binary_path }}
|
||||
format: 'table'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1'
|
||||
|
||||
- name: Upload scan artifacts
|
||||
if: always() && (steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request')
|
||||
# actions/upload-artifact v4.4.3
|
||||
uses: actions/upload-artifact@47309c993abb98030a35d55ef7ff34b7fa1074b5
|
||||
with:
|
||||
name: ${{ steps.pr-info.outputs.is_push == 'true' && format('security-scan-{0}', github.event.workflow_run.head_branch) || format('security-scan-pr-{0}', steps.pr-info.outputs.pr_number) }}
|
||||
path: |
|
||||
trivy-binary-results.sarif
|
||||
retention-days: 14
|
||||
|
||||
- name: Create job summary
|
||||
if: always() && (steps.check-artifact.outputs.artifact_exists == 'true' || github.event_name == 'push' || github.event_name == 'pull_request')
|
||||
run: |
|
||||
{
|
||||
if [[ "${{ steps.pr-info.outputs.is_push }}" == "true" ]]; then
|
||||
echo "## 🔒 Security Scan Results - Branch: ${{ github.event.workflow_run.head_branch }}"
|
||||
else
|
||||
echo "## 🔒 Security Scan Results - PR #${{ steps.pr-info.outputs.pr_number }}"
|
||||
fi
|
||||
echo ""
|
||||
echo "**Scan Type**: Trivy Filesystem Scan"
|
||||
echo "**Target**: \`/app/charon\` binary"
|
||||
echo "**Severity Filter**: CRITICAL, HIGH"
|
||||
echo ""
|
||||
if [[ "${{ job.status }}" == "success" ]]; then
|
||||
echo "✅ **PASSED**: No CRITICAL or HIGH vulnerabilities found"
|
||||
else
|
||||
echo "❌ **FAILED**: CRITICAL or HIGH vulnerabilities detected"
|
||||
echo ""
|
||||
echo "Please review the Trivy scan output and address the vulnerabilities."
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cleanup
|
||||
if: always() && steps.check-artifact.outputs.artifact_exists == 'true'
|
||||
run: |
|
||||
echo "🧹 Cleaning up..."
|
||||
rm -rf ./scan-target
|
||||
echo "✅ Cleanup complete"
|
||||
160
.github/workflows/security-weekly-rebuild.yml
vendored
160
.github/workflows/security-weekly-rebuild.yml
vendored
@@ -1,160 +0,0 @@
|
||||
name: Weekly Security Rebuild
|
||||
|
||||
# Note: This workflow filename has remained consistent. The related docker-publish.yml
|
||||
# was replaced by docker-build.yml in commit f640524b (Dec 21, 2025).
|
||||
# GitHub Advanced Security may show warnings about the old filename until its tracking updates.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 2 * * 0' # Sundays at 02:00 UTC
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
force_rebuild:
|
||||
description: 'Force rebuild without cache'
|
||||
required: false
|
||||
type: boolean
|
||||
default: true
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository_owner }}/charon
|
||||
|
||||
jobs:
|
||||
security-rebuild:
|
||||
name: Security Rebuild & Scan
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 60
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
security-events: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Normalize image name
|
||||
run: |
|
||||
echo "IMAGE_NAME=$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||
|
||||
- name: Resolve Debian base image digest
|
||||
id: base-image
|
||||
run: |
|
||||
docker pull debian:trixie-slim
|
||||
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' debian:trixie-slim)
|
||||
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
|
||||
echo "Base image digest: $DIGEST"
|
||||
|
||||
- name: Log in to Container Registry
|
||||
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=raw,value=security-scan-{{date 'YYYYMMDD'}}
|
||||
|
||||
- name: Build Docker image (NO CACHE)
|
||||
id: build
|
||||
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
no-cache: ${{ github.event_name == 'schedule' || inputs.force_rebuild }}
|
||||
pull: true # Always pull fresh base images to get latest security patches
|
||||
build-args: |
|
||||
VERSION=security-scan
|
||||
BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
|
||||
VCS_REF=${{ github.sha }}
|
||||
BASE_IMAGE=${{ steps.base-image.outputs.digest }}
|
||||
|
||||
- name: Run Trivy vulnerability scanner (CRITICAL+HIGH)
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
|
||||
format: 'table'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
exit-code: '1' # Fail workflow if vulnerabilities found
|
||||
continue-on-error: true
|
||||
|
||||
- name: Run Trivy vulnerability scanner (SARIF)
|
||||
id: trivy-sarif
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
|
||||
format: 'sarif'
|
||||
output: 'trivy-weekly-results.sarif'
|
||||
severity: 'CRITICAL,HIGH,MEDIUM'
|
||||
|
||||
- name: Upload Trivy results to GitHub Security
|
||||
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
|
||||
with:
|
||||
sarif_file: 'trivy-weekly-results.sarif'
|
||||
|
||||
- name: Run Trivy vulnerability scanner (JSON for artifact)
|
||||
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
|
||||
with:
|
||||
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
|
||||
format: 'json'
|
||||
output: 'trivy-weekly-results.json'
|
||||
severity: 'CRITICAL,HIGH,MEDIUM,LOW'
|
||||
|
||||
- name: Upload Trivy JSON results
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: trivy-weekly-scan-${{ github.run_number }}
|
||||
path: trivy-weekly-results.json
|
||||
retention-days: 90
|
||||
|
||||
- name: Check Debian package versions
|
||||
run: |
|
||||
{
|
||||
echo "## 📦 Installed Package Versions"
|
||||
echo ""
|
||||
echo "Checking key security packages:"
|
||||
echo '```'
|
||||
docker run --rm --entrypoint "" "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" \
|
||||
sh -c "dpkg -l | grep -E 'libc-ares|curl|libcurl|openssl|libssl' || echo 'No matching packages found'"
|
||||
echo '```'
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Create security scan summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔒 Weekly Security Rebuild Complete"
|
||||
echo ""
|
||||
echo "- **Build Date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC")"
|
||||
echo "- **Image:** ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}"
|
||||
echo "- **Cache Used:** No (forced fresh build)"
|
||||
echo "- **Trivy Scan:** Completed (see Security tab for details)"
|
||||
echo ""
|
||||
echo "### Next Steps:"
|
||||
echo "1. Review Security tab for new vulnerabilities"
|
||||
echo "2. Check Trivy JSON artifact for detailed package info"
|
||||
echo "3. If critical CVEs found, trigger production rebuild"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Notify on security issues (optional)
|
||||
if: failure()
|
||||
run: |
|
||||
echo "::warning::Weekly security scan found HIGH or CRITICAL vulnerabilities. Review the Security tab."
|
||||
446
.github/workflows/supply-chain-pr.yml
vendored
446
.github/workflows/supply-chain-pr.yml
vendored
@@ -1,446 +0,0 @@
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
||||
---
|
||||
name: Supply Chain Verification (PR)
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
pr_number:
|
||||
description: "PR number to verify (optional, will auto-detect from workflow_run)"
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
concurrency:
|
||||
group: supply-chain-pr-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
security-events: write
|
||||
actions: read
|
||||
|
||||
jobs:
|
||||
verify-supply-chain:
|
||||
name: Verify Supply Chain
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
# Run for: manual dispatch, or successful workflow_run triggered by push/PR
|
||||
if: >
|
||||
github.event_name == 'workflow_dispatch' ||
|
||||
github.event_name == 'pull_request' ||
|
||||
(github.event_name == 'workflow_run' &&
|
||||
(github.event.workflow_run.event == 'push' || github.event.workflow_run.pull_requests[0].number != null) &&
|
||||
(github.event.workflow_run.status != 'completed' || github.event.workflow_run.conclusion == 'success'))
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
# actions/checkout v4.2.2
|
||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
|
||||
|
||||
- name: Extract PR number from workflow_run
|
||||
id: pr-number
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
INPUT_PR_NUMBER: ${{ inputs.pr_number }}
|
||||
EVENT_NAME: ${{ github.event_name }}
|
||||
HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.event.pull_request.head.sha || github.sha }}
|
||||
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
WORKFLOW_RUN_EVENT: ${{ github.event.workflow_run.event }}
|
||||
REPO_OWNER: ${{ github.repository_owner }}
|
||||
REPO_NAME: ${{ github.repository }}
|
||||
run: |
|
||||
if [[ -n "${INPUT_PR_NUMBER}" ]]; then
|
||||
echo "pr_number=${INPUT_PR_NUMBER}" >> "$GITHUB_OUTPUT"
|
||||
echo "📋 Using manually provided PR number: ${INPUT_PR_NUMBER}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ "${EVENT_NAME}" != "workflow_run" && "${EVENT_NAME}" != "push" && "${EVENT_NAME}" != "pull_request" ]]; then
|
||||
echo "❌ No PR number provided and not triggered by workflow_run/push/pr"
|
||||
echo "pr_number=" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "🔍 Looking for PR with head SHA: ${HEAD_SHA}"
|
||||
echo "🔍 Head branch: ${HEAD_BRANCH}"
|
||||
|
||||
# Search for PR by head SHA
|
||||
PR_NUMBER=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/pulls?state=open&head=${REPO_OWNER}:${HEAD_BRANCH}" \
|
||||
--jq '.[0].number // empty' 2>/dev/null || echo "")
|
||||
|
||||
if [[ -z "${PR_NUMBER}" ]]; then
|
||||
# Fallback: search by commit SHA
|
||||
PR_NUMBER=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/commits/${HEAD_SHA}/pulls" \
|
||||
--jq '.[0].number // empty' 2>/dev/null || echo "")
|
||||
fi
|
||||
|
||||
if [[ -z "${PR_NUMBER}" ]]; then
|
||||
echo "⚠️ Could not find PR number for this workflow run"
|
||||
echo "pr_number=" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Found PR number: ${PR_NUMBER}"
|
||||
fi
|
||||
|
||||
# Check if this is a push event (not a PR)
|
||||
if [[ "${WORKFLOW_RUN_EVENT}" == "push" || "${EVENT_NAME}" == "push" || -z "${PR_NUMBER}" ]]; then
|
||||
echo "is_push=true" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Detected push build from branch: ${HEAD_BRANCH}"
|
||||
else
|
||||
echo "is_push=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Sanitize branch name
|
||||
id: sanitize
|
||||
env:
|
||||
BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
|
||||
run: |
|
||||
# Sanitize branch name for use in artifact names
|
||||
# Replace / with - to avoid invalid reference format errors
|
||||
SANITIZED=$(echo "$BRANCH_NAME" | tr '/' '-')
|
||||
echo "branch=${SANITIZED}" >> "$GITHUB_OUTPUT"
|
||||
echo "📋 Sanitized branch name: ${BRANCH_NAME} -> ${SANITIZED}"
|
||||
|
||||
- name: Check for PR image artifact
|
||||
id: check-artifact
|
||||
if: github.event_name == 'workflow_run' && (steps.pr-number.outputs.pr_number != '' || steps.pr-number.outputs.is_push == 'true')
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
IS_PUSH: ${{ steps.pr-number.outputs.is_push }}
|
||||
PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }}
|
||||
RUN_ID: ${{ github.event.workflow_run.id }}
|
||||
HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.event.pull_request.head.sha || github.sha }}
|
||||
REPO_NAME: ${{ github.repository }}
|
||||
run: |
|
||||
# Determine artifact name based on event type
|
||||
if [[ "${IS_PUSH}" == "true" ]]; then
|
||||
ARTIFACT_NAME="push-image"
|
||||
else
|
||||
ARTIFACT_NAME="pr-image-${PR_NUMBER}"
|
||||
fi
|
||||
|
||||
echo "🔍 Looking for artifact: ${ARTIFACT_NAME}"
|
||||
|
||||
if [[ -n "${RUN_ID}" ]]; then
|
||||
# Search in the triggering workflow run
|
||||
ARTIFACT_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/actions/runs/${RUN_ID}/artifacts" \
|
||||
--jq ".artifacts[] | select(.name == \"${ARTIFACT_NAME}\") | .id" 2>/dev/null || echo "")
|
||||
else
|
||||
# If RUN_ID is empty (push/pr trigger), try to find a recent successful run for this SHA
|
||||
echo "🔍 Searching for workflow run for SHA: ${HEAD_SHA}"
|
||||
# Retry a few times as the run might be just starting or finishing
|
||||
for i in {1..3}; do
|
||||
RUN_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/actions/workflows/docker-build.yml/runs?head_sha=${HEAD_SHA}&status=success&per_page=1" \
|
||||
--jq '.workflow_runs[0].id // empty' 2>/dev/null || echo "")
|
||||
if [[ -n "${RUN_ID}" ]]; then
|
||||
echo "✅ Found Run ID: ${RUN_ID}"
|
||||
break
|
||||
fi
|
||||
echo "⏳ Waiting for workflow run to appear/complete... ($i/3)"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
if [[ -n "${RUN_ID}" ]]; then
|
||||
ARTIFACT_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/actions/runs/${RUN_ID}/artifacts" \
|
||||
--jq ".artifacts[] | select(.name == \"${ARTIFACT_NAME}\") | .id" 2>/dev/null || echo "")
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -z "${ARTIFACT_ID}" ]]; then
|
||||
# Fallback for manual or missing info: search recent artifacts by name
|
||||
echo "🔍 Falling back to search by artifact name..."
|
||||
ARTIFACT_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/actions/artifacts?name=${ARTIFACT_NAME}" \
|
||||
--jq '.artifacts[0].id // empty' 2>/dev/null || echo "")
|
||||
fi
|
||||
|
||||
if [[ -z "${ARTIFACT_ID}" ]]; then
|
||||
echo "⚠️ No artifact found: ${ARTIFACT_NAME}"
|
||||
echo "artifact_found=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
{
|
||||
echo "artifact_found=true"
|
||||
echo "artifact_id=${ARTIFACT_ID}"
|
||||
echo "artifact_name=${ARTIFACT_NAME}"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Found artifact: ${ARTIFACT_NAME} (ID: ${ARTIFACT_ID})"
|
||||
|
||||
- name: Skip if no artifact
|
||||
if: github.event_name == 'workflow_run' && ((steps.pr-number.outputs.pr_number == '' && steps.pr-number.outputs.is_push != 'true') || steps.check-artifact.outputs.artifact_found != 'true')
|
||||
run: |
|
||||
echo "ℹ️ No PR image artifact found - skipping supply chain verification"
|
||||
echo "This is expected if the Docker build did not produce an artifact for this PR"
|
||||
exit 0
|
||||
|
||||
- name: Download PR image artifact
|
||||
if: github.event_name == 'workflow_run' && steps.check-artifact.outputs.artifact_found == 'true'
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
ARTIFACT_ID: ${{ steps.check-artifact.outputs.artifact_id }}
|
||||
ARTIFACT_NAME: ${{ steps.check-artifact.outputs.artifact_name }}
|
||||
REPO_NAME: ${{ github.repository }}
|
||||
run: |
|
||||
echo "📦 Downloading artifact: ${ARTIFACT_NAME}"
|
||||
|
||||
gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${REPO_NAME}/actions/artifacts/${ARTIFACT_ID}/zip" \
|
||||
> artifact.zip
|
||||
|
||||
unzip -o artifact.zip
|
||||
echo "✅ Artifact downloaded and extracted"
|
||||
|
||||
- name: Load Docker image (Artifact)
|
||||
if: github.event_name == 'workflow_run' && steps.check-artifact.outputs.artifact_found == 'true'
|
||||
id: load-image-artifact
|
||||
run: |
|
||||
if [[ ! -f "charon-pr-image.tar" ]]; then
|
||||
echo "❌ charon-pr-image.tar not found in artifact"
|
||||
ls -la
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🐳 Loading Docker image..."
|
||||
LOAD_OUTPUT=$(docker load -i charon-pr-image.tar)
|
||||
echo "${LOAD_OUTPUT}"
|
||||
|
||||
# Extract image name from load output
|
||||
IMAGE_NAME=$(echo "${LOAD_OUTPUT}" | grep -oP 'Loaded image: \K.*' || echo "")
|
||||
|
||||
if [[ -z "${IMAGE_NAME}" ]]; then
|
||||
# Try alternative format
|
||||
IMAGE_NAME=$(echo "${LOAD_OUTPUT}" | grep -oP 'Loaded image ID: \K.*' || echo "")
|
||||
fi
|
||||
|
||||
if [[ -z "${IMAGE_NAME}" ]]; then
|
||||
# Fallback: list recent images
|
||||
IMAGE_NAME=$(docker images --format "{{.Repository}}:{{.Tag}}" | head -1)
|
||||
fi
|
||||
|
||||
echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Loaded image: ${IMAGE_NAME}"
|
||||
|
||||
- name: Build Docker image (Local)
|
||||
if: github.event_name != 'workflow_run'
|
||||
id: build-image-local
|
||||
run: |
|
||||
echo "🐳 Building Docker image locally..."
|
||||
docker build -t charon:local .
|
||||
echo "image_name=charon:local" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Built image: charon:local"
|
||||
|
||||
- name: Set Target Image
|
||||
id: set-target
|
||||
run: |
|
||||
if [[ "${{ github.event_name }}" == "workflow_run" ]]; then
|
||||
echo "image_name=${{ steps.load-image-artifact.outputs.image_name }}" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "image_name=${{ steps.build-image-local.outputs.image_name }}" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Generate SBOM using official Anchore action (auto-updated by Renovate)
|
||||
- name: Generate SBOM
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
|
||||
id: sbom
|
||||
with:
|
||||
image: ${{ steps.set-target.outputs.image_name }}
|
||||
format: cyclonedx-json
|
||||
output-file: sbom.cyclonedx.json
|
||||
|
||||
- name: Count SBOM components
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
id: sbom-count
|
||||
run: |
|
||||
COMPONENT_COUNT=$(jq '.components | length' sbom.cyclonedx.json 2>/dev/null || echo "0")
|
||||
echo "component_count=${COMPONENT_COUNT}" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ SBOM generated with ${COMPONENT_COUNT} components"
|
||||
|
||||
# Scan for vulnerabilities using manual Grype installation (pinned to v0.107.1)
|
||||
- name: Install Grype
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
run: |
|
||||
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.107.1
|
||||
|
||||
- name: Scan for vulnerabilities
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
id: grype-scan
|
||||
run: |
|
||||
echo "🔍 Scanning SBOM for vulnerabilities..."
|
||||
grype sbom:sbom.cyclonedx.json -o json > grype-results.json
|
||||
grype sbom:sbom.cyclonedx.json -o sarif > grype-results.sarif
|
||||
|
||||
- name: Debug Output Files
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
run: |
|
||||
echo "📂 Listing workspace files:"
|
||||
ls -la
|
||||
|
||||
- name: Process vulnerability results
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
id: vuln-summary
|
||||
run: |
|
||||
# Verify scan actually produced output
|
||||
if [[ ! -f "grype-results.json" ]]; then
|
||||
echo "❌ Error: grype-results.json not found!"
|
||||
echo "Available files:"
|
||||
ls -la
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Debug content (head)
|
||||
echo "📄 Grype JSON Preview:"
|
||||
head -n 20 grype-results.json
|
||||
|
||||
# Count vulnerabilities by severity - strict failing if file is missing (already checked above)
|
||||
CRITICAL_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' grype-results.json 2>/dev/null || echo "0")
|
||||
HIGH_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' grype-results.json 2>/dev/null || echo "0")
|
||||
MEDIUM_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' grype-results.json 2>/dev/null || echo "0")
|
||||
LOW_COUNT=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' grype-results.json 2>/dev/null || echo "0")
|
||||
TOTAL_COUNT=$(jq '.matches | length' grype-results.json 2>/dev/null || echo "0")
|
||||
|
||||
{
|
||||
echo "critical_count=${CRITICAL_COUNT}"
|
||||
echo "high_count=${HIGH_COUNT}"
|
||||
echo "medium_count=${MEDIUM_COUNT}"
|
||||
echo "low_count=${LOW_COUNT}"
|
||||
echo "total_count=${TOTAL_COUNT}"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
echo "📊 Vulnerability Summary:"
|
||||
echo " Critical: ${CRITICAL_COUNT}"
|
||||
echo " High: ${HIGH_COUNT}"
|
||||
echo " Medium: ${MEDIUM_COUNT}"
|
||||
echo " Low: ${LOW_COUNT}"
|
||||
echo " Total: ${TOTAL_COUNT}"
|
||||
|
||||
- name: Upload SARIF to GitHub Security
|
||||
if: steps.check-artifact.outputs.artifact_found == 'true'
|
||||
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4
|
||||
continue-on-error: true
|
||||
with:
|
||||
sarif_file: grype-results.sarif
|
||||
category: supply-chain-pr
|
||||
|
||||
- name: Upload supply chain artifacts
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
# actions/upload-artifact v4.6.0
|
||||
uses: actions/upload-artifact@47309c993abb98030a35d55ef7ff34b7fa1074b5
|
||||
with:
|
||||
name: ${{ steps.pr-number.outputs.is_push == 'true' && format('supply-chain-{0}', steps.sanitize.outputs.branch) || format('supply-chain-pr-{0}', steps.pr-number.outputs.pr_number) }}
|
||||
path: |
|
||||
sbom.cyclonedx.json
|
||||
grype-results.json
|
||||
retention-days: 14
|
||||
|
||||
- name: Comment on PR
|
||||
if: steps.set-target.outputs.image_name != '' && steps.pr-number.outputs.is_push != 'true'
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
PR_NUMBER="${{ steps.pr-number.outputs.pr_number }}"
|
||||
COMPONENT_COUNT="${{ steps.sbom-count.outputs.component_count }}"
|
||||
CRITICAL_COUNT="${{ steps.vuln-summary.outputs.critical_count }}"
|
||||
HIGH_COUNT="${{ steps.vuln-summary.outputs.high_count }}"
|
||||
MEDIUM_COUNT="${{ steps.vuln-summary.outputs.medium_count }}"
|
||||
LOW_COUNT="${{ steps.vuln-summary.outputs.low_count }}"
|
||||
TOTAL_COUNT="${{ steps.vuln-summary.outputs.total_count }}"
|
||||
|
||||
# Determine status emoji
|
||||
if [[ "${CRITICAL_COUNT}" -gt 0 ]]; then
|
||||
STATUS="❌ **FAILED**"
|
||||
STATUS_EMOJI="🚨"
|
||||
elif [[ "${HIGH_COUNT}" -gt 0 ]]; then
|
||||
STATUS="⚠️ **WARNING**"
|
||||
STATUS_EMOJI="⚠️"
|
||||
else
|
||||
STATUS="✅ **PASSED**"
|
||||
STATUS_EMOJI="✅"
|
||||
fi
|
||||
|
||||
COMMENT_BODY=$(cat <<EOF
|
||||
## ${STATUS_EMOJI} Supply Chain Verification Results
|
||||
|
||||
${STATUS}
|
||||
|
||||
### 📦 SBOM Summary
|
||||
- **Components**: ${COMPONENT_COUNT}
|
||||
|
||||
### 🔍 Vulnerability Scan
|
||||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| 🔴 Critical | ${CRITICAL_COUNT} |
|
||||
| 🟠 High | ${HIGH_COUNT} |
|
||||
| 🟡 Medium | ${MEDIUM_COUNT} |
|
||||
| 🟢 Low | ${LOW_COUNT} |
|
||||
| **Total** | **${TOTAL_COUNT}** |
|
||||
|
||||
### 📎 Artifacts
|
||||
- SBOM (CycloneDX JSON) and Grype results available in workflow artifacts
|
||||
|
||||
---
|
||||
<sub>Generated by Supply Chain Verification workflow • [View Details](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})</sub>
|
||||
EOF
|
||||
)
|
||||
|
||||
# Find and update existing comment or create new one
|
||||
COMMENT_ID=$(gh api \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
|
||||
--jq '.[] | select(.body | contains("Supply Chain Verification Results")) | .id' | head -1)
|
||||
|
||||
if [[ -n "${COMMENT_ID}" ]]; then
|
||||
echo "📝 Updating existing comment..."
|
||||
gh api \
|
||||
--method PATCH \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
|
||||
-f body="${COMMENT_BODY}"
|
||||
else
|
||||
echo "📝 Creating new comment..."
|
||||
gh api \
|
||||
--method POST \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "X-GitHub-Api-Version: 2022-11-28" \
|
||||
"/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments" \
|
||||
-f body="${COMMENT_BODY}"
|
||||
fi
|
||||
|
||||
echo "✅ PR comment posted"
|
||||
|
||||
- name: Fail on critical vulnerabilities
|
||||
if: steps.set-target.outputs.image_name != ''
|
||||
run: |
|
||||
CRITICAL_COUNT="${{ steps.vuln-summary.outputs.critical_count }}"
|
||||
|
||||
if [[ "${CRITICAL_COUNT}" -gt 0 ]]; then
|
||||
echo "🚨 Found ${CRITICAL_COUNT} CRITICAL vulnerabilities!"
|
||||
echo "Please review the vulnerability report and address critical issues before merging."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ No critical vulnerabilities found"
|
||||
816
.github/workflows/supply-chain-verify.yml
vendored
816
.github/workflows/supply-chain-verify.yml
vendored
@@ -1,816 +0,0 @@
|
||||
name: Supply Chain Verification
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
schedule:
|
||||
- cron: '0 0 * * 1' # Mondays 00:00 UTC
|
||||
workflow_run:
|
||||
workflows:
|
||||
- Docker Build, Publish & Test
|
||||
types:
|
||||
- completed
|
||||
release:
|
||||
types:
|
||||
- published
|
||||
- prereleased
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
id-token: write # OIDC token for keyless verification
|
||||
attestations: write # Create/verify attestations
|
||||
security-events: write
|
||||
pull-requests: write # Comment on PRs
|
||||
|
||||
jobs:
|
||||
verify-sbom:
|
||||
name: Verify SBOM
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
image_exists: ${{ steps.image-check.outputs.exists }}
|
||||
# Only run on scheduled scans for main branch, or if workflow_run completed successfully
|
||||
# Critical Fix #5: Exclude PR builds to prevent duplicate verification (now handled inline in docker-build.yml)
|
||||
if: |
|
||||
(github.event_name != 'schedule' || github.ref == 'refs/heads/main') &&
|
||||
(github.event_name != 'workflow_run' ||
|
||||
(github.event.workflow_run.event != 'pull_request' &&
|
||||
(github.event.workflow_run.status != 'completed' || github.event.workflow_run.conclusion == 'success')))
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
# Debug: Log workflow_run context for initial validation (can be removed after confidence)
|
||||
- name: Debug Workflow Run Context
|
||||
if: github.event_name == 'workflow_run'
|
||||
run: |
|
||||
echo "Workflow Run Event Details:"
|
||||
echo " Workflow: ${{ github.event.workflow_run.name }}"
|
||||
echo " Conclusion: ${{ github.event.workflow_run.conclusion }}"
|
||||
echo " Head Branch: ${{ github.event.workflow_run.head_branch }}"
|
||||
echo " Head SHA: ${{ github.event.workflow_run.head_sha }}"
|
||||
echo " Event: ${{ github.event.workflow_run.event }}"
|
||||
echo " PR Count: ${{ toJson(github.event.workflow_run.pull_requests) }}"
|
||||
|
||||
- name: Determine Image Tag
|
||||
id: tag
|
||||
run: |
|
||||
if [[ "${{ github.event_name }}" == "release" ]]; then
|
||||
TAG="${{ github.event.release.tag_name }}"
|
||||
elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
|
||||
BRANCH="${{ github.event.workflow_run.head_branch }}"
|
||||
# Extract tag from the workflow that triggered us
|
||||
if [[ "${BRANCH}" == "main" ]]; then
|
||||
TAG="latest"
|
||||
elif [[ "${BRANCH}" == "development" ]]; then
|
||||
TAG="dev"
|
||||
elif [[ "${BRANCH}" == "nightly" ]]; then
|
||||
TAG="nightly"
|
||||
elif [[ "${{ github.event.workflow_run.event }}" == "pull_request" ]]; then
|
||||
# Extract PR number from workflow_run context with null handling
|
||||
PR_NUMBER=$(jq -r '.pull_requests[0].number // empty' <<< '${{ toJson(github.event.workflow_run.pull_requests) }}')
|
||||
if [[ -n "${PR_NUMBER}" ]]; then
|
||||
TAG="pr-${PR_NUMBER}"
|
||||
else
|
||||
# Fallback to SHA-based tag if PR number not available
|
||||
TAG="sha-$(echo "${{ github.event.workflow_run.head_sha }}" | cut -c1-7)"
|
||||
fi
|
||||
else
|
||||
# For feature branches and other pushes, sanitize branch name for Docker tag
|
||||
# Replace / with - to avoid invalid reference format errors
|
||||
TAG=$(echo "${BRANCH}" | tr '/' '-')
|
||||
fi
|
||||
else
|
||||
TAG="latest"
|
||||
fi
|
||||
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
|
||||
echo "Determined image tag: ${TAG}"
|
||||
|
||||
- name: Check Image Availability
|
||||
id: image-check
|
||||
env:
|
||||
IMAGE: ghcr.io/${{ github.repository_owner }}/charon:${{ steps.tag.outputs.tag }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
echo "Checking if image exists: ${IMAGE}"
|
||||
|
||||
# Authenticate with GHCR using GitHub token
|
||||
echo "${GH_TOKEN}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
|
||||
|
||||
if docker manifest inspect "${IMAGE}" >/dev/null 2>&1; then
|
||||
echo "✅ Image exists and is accessible"
|
||||
echo "exists=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "⚠️ Image not found - likely not built yet"
|
||||
echo "This is normal for PR workflows before docker-build completes"
|
||||
echo "exists=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Generate SBOM using official Anchore action (auto-updated by Renovate)
|
||||
- name: Generate and Verify SBOM
|
||||
if: steps.image-check.outputs.exists == 'true'
|
||||
uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/charon:${{ steps.tag.outputs.tag }}
|
||||
format: cyclonedx-json
|
||||
output-file: sbom-verify.cyclonedx.json
|
||||
|
||||
- name: Verify SBOM Completeness
|
||||
if: steps.image-check.outputs.exists == 'true'
|
||||
run: |
|
||||
echo "Verifying SBOM completeness..."
|
||||
echo ""
|
||||
|
||||
# Count components
|
||||
COMPONENT_COUNT=$(jq '.components | length' sbom-verify.cyclonedx.json 2>/dev/null || echo "0")
|
||||
|
||||
echo "SBOM components: ${COMPONENT_COUNT}"
|
||||
|
||||
if [[ ${COMPONENT_COUNT} -eq 0 ]]; then
|
||||
echo "⚠️ SBOM contains no components - may indicate an issue"
|
||||
else
|
||||
echo "✅ SBOM contains ${COMPONENT_COUNT} components"
|
||||
fi
|
||||
|
||||
- name: Upload SBOM Artifact
|
||||
if: steps.image-check.outputs.exists == 'true' && always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
||||
with:
|
||||
name: sbom-${{ steps.tag.outputs.tag }}
|
||||
path: sbom-verify.cyclonedx.json
|
||||
retention-days: 30
|
||||
|
||||
- name: Validate SBOM File
|
||||
id: validate-sbom
|
||||
if: steps.image-check.outputs.exists == 'true'
|
||||
run: |
|
||||
echo "Validating SBOM file..."
|
||||
echo ""
|
||||
|
||||
# Check jq availability
|
||||
if ! command -v jq &> /dev/null; then
|
||||
echo "❌ jq is not available"
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check file exists
|
||||
if [[ ! -f sbom-verify.cyclonedx.json ]]; then
|
||||
echo "❌ SBOM file does not exist"
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Check file is non-empty
|
||||
if [[ ! -s sbom-verify.cyclonedx.json ]]; then
|
||||
echo "❌ SBOM file is empty"
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Validate JSON structure
|
||||
if ! jq empty sbom-verify.cyclonedx.json 2>/dev/null; then
|
||||
echo "❌ SBOM file contains invalid JSON"
|
||||
echo "SBOM content:"
|
||||
cat sbom-verify.cyclonedx.json
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Validate CycloneDX structure
|
||||
BOMFORMAT=$(jq -r '.bomFormat // "missing"' sbom-verify.cyclonedx.json)
|
||||
SPECVERSION=$(jq -r '.specVersion // "missing"' sbom-verify.cyclonedx.json)
|
||||
COMPONENTS=$(jq '.components // [] | length' sbom-verify.cyclonedx.json)
|
||||
|
||||
echo "SBOM Format: ${BOMFORMAT}"
|
||||
echo "Spec Version: ${SPECVERSION}"
|
||||
echo "Components: ${COMPONENTS}"
|
||||
echo ""
|
||||
|
||||
if [[ "${BOMFORMAT}" != "CycloneDX" ]]; then
|
||||
echo "❌ Invalid bomFormat: expected 'CycloneDX', got '${BOMFORMAT}'"
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ "${COMPONENTS}" == "0" ]]; then
|
||||
echo "⚠️ SBOM has no components - may indicate incomplete scan"
|
||||
echo "valid=partial" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "✅ SBOM is valid with ${COMPONENTS} components"
|
||||
echo "valid=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
echo "SBOM Format: ${BOMFORMAT}"
|
||||
echo "Spec Version: ${SPECVERSION}"
|
||||
echo "Components: ${COMPONENTS}"
|
||||
echo ""
|
||||
|
||||
if [[ "${BOMFORMAT}" != "CycloneDX" ]]; then
|
||||
echo "❌ Invalid bomFormat: expected 'CycloneDX', got '${BOMFORMAT}'"
|
||||
echo "valid=false" >> "$GITHUB_OUTPUT"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ "${COMPONENTS}" == "0" ]]; then
|
||||
echo "⚠️ SBOM has no components - may indicate incomplete scan"
|
||||
echo "valid=partial" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "✅ SBOM is valid with ${COMPONENTS} components"
|
||||
echo "valid=true" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# Scan for vulnerabilities using official Anchore action (auto-updated by Renovate)
|
||||
- name: Scan for Vulnerabilities
|
||||
if: steps.validate-sbom.outputs.valid == 'true'
|
||||
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
|
||||
id: scan
|
||||
with:
|
||||
sbom: sbom-verify.cyclonedx.json
|
||||
fail-build: false
|
||||
output-format: json
|
||||
|
||||
- name: Process Vulnerability Results
|
||||
if: steps.validate-sbom.outputs.valid == 'true'
|
||||
run: |
|
||||
echo "Processing vulnerability results..."
|
||||
|
||||
# The scan-action outputs results.json and results.sarif
|
||||
# Rename for consistency
|
||||
if [[ -f results.json ]]; then
|
||||
mv results.json vuln-scan.json
|
||||
fi
|
||||
if [[ -f results.sarif ]]; then
|
||||
mv results.sarif vuln-scan.sarif
|
||||
fi
|
||||
|
||||
# Parse and categorize results
|
||||
CRITICAL=$(jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length' vuln-scan.json 2>/dev/null || echo "0")
|
||||
HIGH=$(jq '[.matches[] | select(.vulnerability.severity == "High")] | length' vuln-scan.json 2>/dev/null || echo "0")
|
||||
MEDIUM=$(jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length' vuln-scan.json 2>/dev/null || echo "0")
|
||||
LOW=$(jq '[.matches[] | select(.vulnerability.severity == "Low")] | length' vuln-scan.json 2>/dev/null || echo "0")
|
||||
|
||||
echo ""
|
||||
echo "Vulnerability counts:"
|
||||
echo " Critical: ${CRITICAL}"
|
||||
echo " High: ${HIGH}"
|
||||
echo " Medium: ${MEDIUM}"
|
||||
echo " Low: ${LOW}"
|
||||
|
||||
# Set warnings for critical vulnerabilities
|
||||
if [[ ${CRITICAL} -gt 0 ]]; then
|
||||
echo "::warning::${CRITICAL} critical vulnerabilities found"
|
||||
fi
|
||||
|
||||
# Store for PR comment
|
||||
{
|
||||
echo "CRITICAL_VULNS=${CRITICAL}"
|
||||
echo "HIGH_VULNS=${HIGH}"
|
||||
echo "MEDIUM_VULNS=${MEDIUM}"
|
||||
echo "LOW_VULNS=${LOW}"
|
||||
} >> "$GITHUB_ENV"
|
||||
|
||||
- name: Parse Vulnerability Details
|
||||
if: steps.validate-sbom.outputs.valid == 'true'
|
||||
run: |
|
||||
echo "Parsing detailed vulnerability information..."
|
||||
|
||||
# Generate detailed vulnerability tables grouped by severity
|
||||
# Limit to first 20 per severity to keep PR comment readable
|
||||
|
||||
# Critical vulnerabilities
|
||||
jq -r '
|
||||
[.matches[] | select(.vulnerability.severity == "Critical")] |
|
||||
sort_by(.vulnerability.id) |
|
||||
limit(20; .[]) |
|
||||
"| \(.vulnerability.id) | \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // "No fix available") | \(.vulnerability.description[0:80] // "N/A") |"
|
||||
' vuln-scan.json > critical-vulns.txt
|
||||
|
||||
# High severity vulnerabilities
|
||||
jq -r '
|
||||
[.matches[] | select(.vulnerability.severity == "High")] |
|
||||
sort_by(.vulnerability.id) |
|
||||
limit(20; .[]) |
|
||||
"| \(.vulnerability.id) | \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // "No fix available") | \(.vulnerability.description[0:80] // "N/A") |"
|
||||
' vuln-scan.json > high-vulns.txt
|
||||
|
||||
# Medium severity vulnerabilities
|
||||
jq -r '
|
||||
[.matches[] | select(.vulnerability.severity == "Medium")] |
|
||||
sort_by(.vulnerability.id) |
|
||||
limit(20; .[]) |
|
||||
"| \(.vulnerability.id) | \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // "No fix available") | \(.vulnerability.description[0:80] // "N/A") |"
|
||||
' vuln-scan.json > medium-vulns.txt
|
||||
|
||||
# Low severity vulnerabilities
|
||||
jq -r '
|
||||
[.matches[] | select(.vulnerability.severity == "Low")] |
|
||||
sort_by(.vulnerability.id) |
|
||||
limit(20; .[]) |
|
||||
"| \(.vulnerability.id) | \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // "No fix available") | \(.vulnerability.description[0:80] // "N/A") |"
|
||||
' vuln-scan.json > low-vulns.txt
|
||||
|
||||
echo "✅ Vulnerability details parsed and saved"
|
||||
|
||||
- name: Upload Vulnerability Scan Artifact
|
||||
if: steps.validate-sbom.outputs.valid == 'true' && always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
||||
with:
|
||||
name: vulnerability-scan-${{ steps.tag.outputs.tag }}
|
||||
path: |
|
||||
vuln-scan.json
|
||||
critical-vulns.txt
|
||||
high-vulns.txt
|
||||
medium-vulns.txt
|
||||
low-vulns.txt
|
||||
retention-days: 30
|
||||
|
||||
- name: Report Skipped Scan
|
||||
if: steps.image-check.outputs.exists != 'true' || steps.validate-sbom.outputs.valid != 'true'
|
||||
run: |
|
||||
{
|
||||
echo "## ⚠️ Vulnerability Scan Skipped"
|
||||
echo ""
|
||||
|
||||
if [[ "${{ steps.image-check.outputs.exists }}" != "true" ]]; then
|
||||
echo "**Reason**: Docker image not available yet"
|
||||
echo ""
|
||||
echo "This is expected for PR workflows. The image will be scanned"
|
||||
echo "after it's built by the docker-build workflow."
|
||||
elif [[ "${{ steps.validate-sbom.outputs.valid }}" != "true" ]]; then
|
||||
echo "**Reason**: SBOM validation failed"
|
||||
echo ""
|
||||
echo "Check the 'Validate SBOM File' step for details."
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "✅ Workflow completed successfully (scan skipped)"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Determine PR Number
|
||||
id: pr-number
|
||||
if: |
|
||||
github.event_name == 'pull_request' ||
|
||||
(github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request')
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||||
with:
|
||||
result-encoding: string
|
||||
script: |
|
||||
// Determine PR number from context
|
||||
let prNumber;
|
||||
if (context.eventName === 'pull_request') {
|
||||
prNumber = context.issue.number;
|
||||
} else if (context.eventName === 'workflow_run') {
|
||||
const pullRequests = context.payload.workflow_run.pull_requests;
|
||||
if (pullRequests && pullRequests.length > 0) {
|
||||
prNumber = pullRequests[0].number;
|
||||
}
|
||||
}
|
||||
|
||||
if (!prNumber) {
|
||||
console.log('No PR number found');
|
||||
return '';
|
||||
}
|
||||
|
||||
console.log(`Found PR number: ${prNumber}`);
|
||||
return prNumber;
|
||||
|
||||
- name: Build PR Comment Body
|
||||
id: comment-body
|
||||
if: steps.pr-number.outputs.result != ''
|
||||
run: |
|
||||
TIMESTAMP=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
IMAGE_EXISTS="${{ steps.image-check.outputs.exists }}"
|
||||
SBOM_VALID="${{ steps.validate-sbom.outputs.valid }}"
|
||||
CRITICAL="${CRITICAL_VULNS:-0}"
|
||||
HIGH="${HIGH_VULNS:-0}"
|
||||
MEDIUM="${MEDIUM_VULNS:-0}"
|
||||
LOW="${LOW_VULNS:-0}"
|
||||
TOTAL=$((CRITICAL + HIGH + MEDIUM + LOW))
|
||||
|
||||
# Build comment body
|
||||
COMMENT_BODY="## 🔒 Supply Chain Security Scan
|
||||
|
||||
**Last Updated**: ${TIMESTAMP}
|
||||
**Workflow Run**: [#${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
|
||||
|
||||
---
|
||||
|
||||
"
|
||||
|
||||
if [[ "${IMAGE_EXISTS}" != "true" ]]; then
|
||||
COMMENT_BODY+="### ⏳ Status: Waiting for Image
|
||||
|
||||
The Docker image has not been built yet. This scan will run automatically once the docker-build workflow completes.
|
||||
|
||||
_This is normal for PR workflows._
|
||||
"
|
||||
elif [[ "${SBOM_VALID}" != "true" ]]; then
|
||||
COMMENT_BODY+="### ⚠️ Status: SBOM Validation Failed
|
||||
|
||||
The Software Bill of Materials (SBOM) could not be validated. Please check the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.
|
||||
|
||||
**Action Required**: Review and resolve SBOM generation issues.
|
||||
"
|
||||
else
|
||||
# Scan completed successfully
|
||||
if [[ ${TOTAL} -eq 0 ]]; then
|
||||
COMMENT_BODY+="### ✅ Status: No Vulnerabilities Detected
|
||||
|
||||
🎉 Great news! No security vulnerabilities were found in this image.
|
||||
|
||||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| 🔴 Critical | 0 |
|
||||
| 🟠 High | 0 |
|
||||
| 🟡 Medium | 0 |
|
||||
| 🔵 Low | 0 |
|
||||
"
|
||||
else
|
||||
# Vulnerabilities found
|
||||
if [[ ${CRITICAL} -gt 0 ]]; then
|
||||
COMMENT_BODY+="### 🚨 Status: Critical Vulnerabilities Detected
|
||||
|
||||
⚠️ **Action Required**: ${CRITICAL} critical vulnerabilities require immediate attention!
|
||||
"
|
||||
elif [[ ${HIGH} -gt 0 ]]; then
|
||||
COMMENT_BODY+="### ⚠️ Status: High-Severity Vulnerabilities Detected
|
||||
|
||||
${HIGH} high-severity vulnerabilities found. Please review and address.
|
||||
"
|
||||
else
|
||||
COMMENT_BODY+="### 📊 Status: Vulnerabilities Detected
|
||||
|
||||
Security scan found ${TOTAL} vulnerabilities.
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
| Severity | Count |
|
||||
|----------|-------|
|
||||
| 🔴 Critical | ${CRITICAL} |
|
||||
| 🟠 High | ${HIGH} |
|
||||
| 🟡 Medium | ${MEDIUM} |
|
||||
| 🔵 Low | ${LOW} |
|
||||
| **Total** | **${TOTAL}** |
|
||||
|
||||
## 🔍 Detailed Findings
|
||||
|
||||
"
|
||||
|
||||
# Add detailed vulnerability tables by severity
|
||||
# Critical Vulnerabilities
|
||||
if [[ ${CRITICAL} -gt 0 ]]; then
|
||||
COMMENT_BODY+="<details>
|
||||
<summary>🔴 <b>Critical Vulnerabilities (${CRITICAL})</b></summary>
|
||||
|
||||
| CVE | Package | Current Version | Fixed Version | Description |
|
||||
|-----|---------|----------------|---------------|-------------|
|
||||
"
|
||||
|
||||
if [[ -f critical-vulns.txt && -s critical-vulns.txt ]]; then
|
||||
COMMENT_BODY+="$(cat critical-vulns.txt)"
|
||||
|
||||
# If more than 20, add truncation message
|
||||
if [[ ${CRITICAL} -gt 20 ]]; then
|
||||
REMAINING=$((CRITICAL - 20))
|
||||
COMMENT_BODY+="
|
||||
|
||||
_...and ${REMAINING} more. View the [full scan results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for complete details._
|
||||
"
|
||||
fi
|
||||
else
|
||||
COMMENT_BODY+="| N/A | N/A | N/A | N/A | Details unavailable |
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
</details>
|
||||
|
||||
"
|
||||
fi
|
||||
|
||||
# High Severity Vulnerabilities
|
||||
if [[ ${HIGH} -gt 0 ]]; then
|
||||
COMMENT_BODY+="<details>
|
||||
<summary>🟠 <b>High Severity Vulnerabilities (${HIGH})</b></summary>
|
||||
|
||||
| CVE | Package | Current Version | Fixed Version | Description |
|
||||
|-----|---------|----------------|---------------|-------------|
|
||||
"
|
||||
|
||||
if [[ -f high-vulns.txt && -s high-vulns.txt ]]; then
|
||||
COMMENT_BODY+="$(cat high-vulns.txt)"
|
||||
|
||||
if [[ ${HIGH} -gt 20 ]]; then
|
||||
REMAINING=$((HIGH - 20))
|
||||
COMMENT_BODY+="
|
||||
|
||||
_...and ${REMAINING} more. View the [full scan results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for complete details._
|
||||
"
|
||||
fi
|
||||
else
|
||||
COMMENT_BODY+="| N/A | N/A | N/A | N/A | Details unavailable |
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
</details>
|
||||
|
||||
"
|
||||
fi
|
||||
|
||||
# Medium Severity Vulnerabilities
|
||||
if [[ ${MEDIUM} -gt 0 ]]; then
|
||||
COMMENT_BODY+="<details>
|
||||
<summary>🟡 <b>Medium Severity Vulnerabilities (${MEDIUM})</b></summary>
|
||||
|
||||
| CVE | Package | Current Version | Fixed Version | Description |
|
||||
|-----|---------|----------------|---------------|-------------|
|
||||
"
|
||||
|
||||
if [[ -f medium-vulns.txt && -s medium-vulns.txt ]]; then
|
||||
COMMENT_BODY+="$(cat medium-vulns.txt)"
|
||||
|
||||
if [[ ${MEDIUM} -gt 20 ]]; then
|
||||
REMAINING=$((MEDIUM - 20))
|
||||
COMMENT_BODY+="
|
||||
|
||||
_...and ${REMAINING} more. View the [full scan results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for complete details._
|
||||
"
|
||||
fi
|
||||
else
|
||||
COMMENT_BODY+="| N/A | N/A | N/A | N/A | Details unavailable |
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
</details>
|
||||
|
||||
"
|
||||
fi
|
||||
|
||||
# Low Severity Vulnerabilities
|
||||
if [[ ${LOW} -gt 0 ]]; then
|
||||
COMMENT_BODY+="<details>
|
||||
<summary>🔵 <b>Low Severity Vulnerabilities (${LOW})</b></summary>
|
||||
|
||||
| CVE | Package | Current Version | Fixed Version | Description |
|
||||
|-----|---------|----------------|---------------|-------------|
|
||||
"
|
||||
|
||||
if [[ -f low-vulns.txt && -s low-vulns.txt ]]; then
|
||||
COMMENT_BODY+="$(cat low-vulns.txt)"
|
||||
|
||||
if [[ ${LOW} -gt 20 ]]; then
|
||||
REMAINING=$((LOW - 20))
|
||||
COMMENT_BODY+="
|
||||
|
||||
_...and ${REMAINING} more. View the [full scan results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for complete details._
|
||||
"
|
||||
fi
|
||||
else
|
||||
COMMENT_BODY+="| N/A | N/A | N/A | N/A | Details unavailable |
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
</details>
|
||||
|
||||
"
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
📋 [View detailed vulnerability report](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
|
||||
"
|
||||
fi
|
||||
fi
|
||||
|
||||
COMMENT_BODY+="
|
||||
---
|
||||
|
||||
<sub><!-- supply-chain-security-comment --></sub>
|
||||
"
|
||||
|
||||
# Save to file for the next step (handles multi-line)
|
||||
echo "$COMMENT_BODY" > /tmp/comment-body.txt
|
||||
|
||||
# Also output for debugging
|
||||
echo "Generated comment body:"
|
||||
cat /tmp/comment-body.txt
|
||||
|
||||
- name: Find Existing PR Comment
|
||||
id: find-comment
|
||||
if: steps.pr-number.outputs.result != ''
|
||||
uses: peter-evans/find-comment@v3.2.0
|
||||
with:
|
||||
issue-number: ${{ steps.pr-number.outputs.result }}
|
||||
comment-author: 'github-actions[bot]'
|
||||
body-includes: '<!-- supply-chain-security-comment -->'
|
||||
|
||||
- name: Update or Create PR Comment
|
||||
if: steps.pr-number.outputs.result != ''
|
||||
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
|
||||
with:
|
||||
issue-number: ${{ steps.pr-number.outputs.result }}
|
||||
body-path: /tmp/comment-body.txt
|
||||
edit-mode: replace
|
||||
comment-id: ${{ steps.find-comment.outputs.comment-id }}
|
||||
|
||||
verify-docker-image:
|
||||
name: Verify Docker Image Supply Chain
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event_name == 'release'
|
||||
needs: verify-sbom
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Install Verification Tools
|
||||
run: |
|
||||
# Install Cosign
|
||||
curl -sLO https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64
|
||||
echo "4e84f155f98be2c2d3e63dea0e80b0ca5b4d843f5f4b1d3e8c9b7e4e7c0e0e0e cosign-linux-amd64" | sha256sum -c || {
|
||||
echo "⚠️ Checksum verification skipped (update with actual hash)"
|
||||
}
|
||||
sudo install cosign-linux-amd64 /usr/local/bin/cosign
|
||||
rm cosign-linux-amd64
|
||||
|
||||
# Install SLSA Verifier
|
||||
curl -sLO https://github.com/slsa-framework/slsa-verifier/releases/download/v2.6.0/slsa-verifier-linux-amd64
|
||||
sudo install slsa-verifier-linux-amd64 /usr/local/bin/slsa-verifier
|
||||
rm slsa-verifier-linux-amd64
|
||||
|
||||
- name: Determine Image Tag
|
||||
id: tag
|
||||
run: |
|
||||
TAG="${{ github.event.release.tag_name }}"
|
||||
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Verify Cosign Signature with Rekor Fallback
|
||||
env:
|
||||
IMAGE: ghcr.io/${{ github.repository_owner }}/charon:${{ steps.tag.outputs.tag }}
|
||||
run: |
|
||||
echo "Verifying Cosign signature for ${IMAGE}..."
|
||||
|
||||
# Try with Rekor
|
||||
if cosign verify "${IMAGE}" \
|
||||
--certificate-identity-regexp="https://github.com/${{ github.repository }}" \
|
||||
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" 2>&1; then
|
||||
echo "✅ Cosign signature verified (with Rekor)"
|
||||
else
|
||||
echo "⚠️ Rekor verification failed, trying offline verification..."
|
||||
|
||||
# Fallback: verify without Rekor
|
||||
if cosign verify "${IMAGE}" \
|
||||
--certificate-identity-regexp="https://github.com/${{ github.repository }}" \
|
||||
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
|
||||
--insecure-ignore-tlog 2>&1; then
|
||||
echo "✅ Cosign signature verified (offline mode)"
|
||||
echo "::warning::Verified without Rekor - transparency log unavailable"
|
||||
else
|
||||
echo "❌ Signature verification failed"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
- name: Verify Docker Hub Image Signature
|
||||
if: needs.verify-sbom.outputs.image_exists == 'true'
|
||||
continue-on-error: true
|
||||
run: |
|
||||
echo "Verifying Docker Hub image signature..."
|
||||
cosign verify "docker.io/wikid82/charon:${{ steps.tag.outputs.tag }}" \
|
||||
--certificate-identity-regexp="https://github.com/Wikid82/Charon" \
|
||||
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" && \
|
||||
echo "✅ Docker Hub signature verified" || \
|
||||
echo "⚠️ Docker Hub signature verification failed (image may not exist or not signed)"
|
||||
|
||||
- name: Verify SLSA Provenance
|
||||
env:
|
||||
IMAGE: ghcr.io/${{ github.repository_owner }}/charon:${{ steps.tag.outputs.tag }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
echo "Verifying SLSA provenance for ${IMAGE}..."
|
||||
|
||||
# This will be enabled once provenance generation is added
|
||||
echo "⚠️ SLSA provenance verification not yet implemented"
|
||||
echo "Will be enabled after Phase 3 workflow updates"
|
||||
|
||||
- name: Create Verification Report
|
||||
if: always()
|
||||
run: |
|
||||
cat << EOF > verification-report.md
|
||||
# Supply Chain Verification Report
|
||||
|
||||
**Image**: ghcr.io/${{ github.repository_owner }}/charon:${{ steps.tag.outputs.tag }}
|
||||
**Date**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||
**Workflow**: ${{ github.workflow }}
|
||||
**Run**: ${{ github.run_id }}
|
||||
|
||||
## Results
|
||||
|
||||
- **SBOM Verification**: ${{ needs.verify-sbom.result }}
|
||||
- **Cosign Signature**: ${{ job.status }}
|
||||
- **SLSA Provenance**: Not yet implemented (Phase 3)
|
||||
|
||||
## Verification Failure Recovery
|
||||
|
||||
If verification failed:
|
||||
1. Check workflow logs for detailed error messages
|
||||
2. Verify signing steps ran successfully in build workflow
|
||||
3. Confirm attestations were pushed to registry
|
||||
4. Check Rekor status: https://status.sigstore.dev
|
||||
5. For Rekor outages, manual verification may be required
|
||||
6. Re-run build if signatures/provenance are missing
|
||||
EOF
|
||||
|
||||
cat verification-report.md >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
verify-release-artifacts:
|
||||
name: Verify Release Artifacts
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event_name == 'release'
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
|
||||
- name: Install Verification Tools
|
||||
run: |
|
||||
# Install Cosign
|
||||
curl -sLO https://github.com/sigstore/cosign/releases/download/v2.4.1/cosign-linux-amd64
|
||||
sudo install cosign-linux-amd64 /usr/local/bin/cosign
|
||||
rm cosign-linux-amd64
|
||||
|
||||
- name: Download Release Assets
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
TAG="${{ github.event.release.tag_name }}"
|
||||
mkdir -p ./release-assets
|
||||
gh release download "${TAG}" --dir ./release-assets || {
|
||||
echo "⚠️ No release assets found or download failed"
|
||||
exit 0
|
||||
}
|
||||
|
||||
- name: Verify Artifact Signatures with Fallback
|
||||
continue-on-error: true
|
||||
run: |
|
||||
if [[ ! -d ./release-assets ]] || [[ -z "$(ls -A ./release-assets 2>/dev/null)" ]]; then
|
||||
echo "⚠️ No release assets to verify"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Verifying Cosign signatures for release artifacts..."
|
||||
|
||||
VERIFIED_COUNT=0
|
||||
FAILED_COUNT=0
|
||||
|
||||
for artifact in ./release-assets/*; do
|
||||
# Skip signature and certificate files
|
||||
if [[ "$artifact" == *.sig || "$artifact" == *.pem || "$artifact" == *provenance* || "$artifact" == *.txt || "$artifact" == *.md ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
if [[ -f "$artifact" ]]; then
|
||||
echo "Verifying: $(basename "$artifact")"
|
||||
|
||||
# Check if signature files exist
|
||||
if [[ ! -f "${artifact}.sig" ]] || [[ ! -f "${artifact}.pem" ]]; then
|
||||
echo "⚠️ No signature files found for $(basename "$artifact")"
|
||||
FAILED_COUNT=$((FAILED_COUNT + 1))
|
||||
continue
|
||||
fi
|
||||
|
||||
# Try with Rekor
|
||||
if cosign verify-blob "$artifact" \
|
||||
--signature "${artifact}.sig" \
|
||||
--certificate "${artifact}.pem" \
|
||||
--certificate-identity-regexp="https://github.com/${{ github.repository }}" \
|
||||
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" 2>&1; then
|
||||
echo "✅ Verified with Rekor"
|
||||
VERIFIED_COUNT=$((VERIFIED_COUNT + 1))
|
||||
else
|
||||
echo "⚠️ Rekor unavailable, trying offline..."
|
||||
if cosign verify-blob "$artifact" \
|
||||
--signature "${artifact}.sig" \
|
||||
--certificate "${artifact}.pem" \
|
||||
--certificate-identity-regexp="https://github.com/${{ github.repository }}" \
|
||||
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
|
||||
--insecure-ignore-tlog 2>&1; then
|
||||
echo "✅ Verified offline"
|
||||
VERIFIED_COUNT=$((VERIFIED_COUNT + 1))
|
||||
else
|
||||
echo "❌ Verification failed"
|
||||
FAILED_COUNT=$((FAILED_COUNT + 1))
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Verification summary: ${VERIFIED_COUNT} verified, ${FAILED_COUNT} failed"
|
||||
|
||||
if [[ ${FAILED_COUNT} -gt 0 ]]; then
|
||||
echo "⚠️ Some artifacts failed verification"
|
||||
else
|
||||
echo "✅ All artifacts verified successfully"
|
||||
fi
|
||||
221
.github/workflows/update-geolite2.yml
vendored
221
.github/workflows/update-geolite2.yml
vendored
@@ -1,221 +0,0 @@
|
||||
name: Update GeoLite2 Checksum
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 2 * * 1' # Weekly on Mondays at 2 AM UTC
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
issues: write
|
||||
|
||||
jobs:
|
||||
update-checksum:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
|
||||
- name: Download and calculate checksum
|
||||
id: checksum
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "📥 Downloading GeoLite2-Country.mmdb..."
|
||||
DOWNLOAD_URL="https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb"
|
||||
|
||||
# Download with retry logic
|
||||
for i in {1..3}; do
|
||||
if curl -fsSL "$DOWNLOAD_URL" -o /tmp/geolite2.mmdb; then
|
||||
echo "✅ Download successful on attempt $i"
|
||||
break
|
||||
else
|
||||
echo "❌ Download failed on attempt $i"
|
||||
if [ "$i" -eq 3 ]; then
|
||||
echo "error=download_failed" >> "$GITHUB_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
sleep 5
|
||||
fi
|
||||
done
|
||||
|
||||
# Calculate checksum
|
||||
CURRENT=$(sha256sum /tmp/geolite2.mmdb | cut -d' ' -f1)
|
||||
|
||||
# Validate checksum format (64 hex characters)
|
||||
if ! [[ "$CURRENT" =~ ^[a-f0-9]{64}$ ]]; then
|
||||
echo "❌ Invalid checksum format: $CURRENT"
|
||||
echo "error=invalid_checksum_format" >> "$GITHUB_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract current checksum from Dockerfile
|
||||
OLD=$(grep "ARG GEOLITE2_COUNTRY_SHA256=" Dockerfile | cut -d'=' -f2)
|
||||
|
||||
# Validate old checksum format
|
||||
if ! [[ "$OLD" =~ ^[a-f0-9]{64}$ ]]; then
|
||||
echo "❌ Invalid old checksum format in Dockerfile: $OLD"
|
||||
echo "error=invalid_dockerfile_checksum" >> "$GITHUB_OUTPUT"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🔍 Checksum comparison:"
|
||||
echo " Current (Dockerfile): $OLD"
|
||||
echo " Latest (Downloaded): $CURRENT"
|
||||
|
||||
echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
|
||||
echo "old=$OLD" >> "$GITHUB_OUTPUT"
|
||||
|
||||
if [ "$CURRENT" != "$OLD" ]; then
|
||||
echo "needs_update=true" >> "$GITHUB_OUTPUT"
|
||||
echo "⚠️ Checksum mismatch detected - update required"
|
||||
else
|
||||
echo "needs_update=false" >> "$GITHUB_OUTPUT"
|
||||
echo "✅ Checksum matches - no update needed"
|
||||
fi
|
||||
|
||||
- name: Update Dockerfile
|
||||
if: steps.checksum.outputs.needs_update == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "📝 Updating Dockerfile with new checksum..."
|
||||
sed -i "s/ARG GEOLITE2_COUNTRY_SHA256=.*/ARG GEOLITE2_COUNTRY_SHA256=${{ steps.checksum.outputs.current }}/" Dockerfile
|
||||
|
||||
# Verify the change was applied
|
||||
if ! grep -q "ARG GEOLITE2_COUNTRY_SHA256=${{ steps.checksum.outputs.current }}" Dockerfile; then
|
||||
echo "❌ Failed to update Dockerfile"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ Dockerfile updated successfully"
|
||||
|
||||
- name: Verify Dockerfile syntax
|
||||
if: steps.checksum.outputs.needs_update == 'true'
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
echo "🔍 Verifying Dockerfile syntax..."
|
||||
# Use BuildKit's --check flag for syntax validation (no actual build)
|
||||
DOCKER_BUILDKIT=1 docker build --check -f Dockerfile . 2>&1 || {
|
||||
echo "❌ Dockerfile syntax validation failed"
|
||||
exit 1
|
||||
}
|
||||
echo "✅ Dockerfile syntax is valid"
|
||||
|
||||
- name: Create Pull Request
|
||||
if: steps.checksum.outputs.needs_update == 'true'
|
||||
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
|
||||
with:
|
||||
title: "chore(docker): update GeoLite2-Country.mmdb checksum"
|
||||
body: |
|
||||
🤖 **Automated GeoLite2 Database Checksum Update**
|
||||
|
||||
The GeoLite2-Country.mmdb database has been updated upstream.
|
||||
|
||||
### Changes
|
||||
- **Old checksum:** `${{ steps.checksum.outputs.old }}`
|
||||
- **New checksum:** `${{ steps.checksum.outputs.current }}`
|
||||
- **File modified:** `Dockerfile` (line 352)
|
||||
|
||||
### Verification Required
|
||||
- [ ] Local build passes: `docker build --no-cache -t test .`
|
||||
- [ ] Container starts successfully
|
||||
- [ ] API health check responds: `curl http://localhost:8080/api/v1/health`
|
||||
- [ ] CI build passes
|
||||
|
||||
### Testing Commands
|
||||
```bash
|
||||
# Verify checksum locally
|
||||
curl -fsSL "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb" | sha256sum
|
||||
|
||||
# Build and test
|
||||
docker build --no-cache --pull -t charon:test-geolite2 .
|
||||
docker run --rm charon:test-geolite2 /app/charon --version
|
||||
```
|
||||
|
||||
### Related Documentation
|
||||
- [Dockerfile](/Dockerfile#L352)
|
||||
- [Implementation Plan](/docs/plans/current_spec.md)
|
||||
|
||||
---
|
||||
|
||||
**Auto-generated by:** `.github/workflows/update-geolite2.yml`
|
||||
**Trigger:** Scheduled weekly check (Mondays 2 AM UTC)
|
||||
branch: bot/update-geolite2-checksum
|
||||
delete-branch: true
|
||||
commit-message: |
|
||||
chore(docker): update GeoLite2-Country.mmdb checksum
|
||||
|
||||
Automated checksum update for GeoLite2-Country.mmdb database.
|
||||
|
||||
Old: ${{ steps.checksum.outputs.old }}
|
||||
New: ${{ steps.checksum.outputs.current }}
|
||||
|
||||
Auto-generated by: .github/workflows/update-geolite2.yml
|
||||
labels: |
|
||||
dependencies
|
||||
automated
|
||||
docker
|
||||
|
||||
- name: Report failure via GitHub Issue
|
||||
if: failure()
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const errorType = '${{ steps.checksum.outputs.error }}' || 'unknown';
|
||||
const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
|
||||
|
||||
const errorMessages = {
|
||||
'download_failed': '❌ Failed to download GeoLite2-Country.mmdb after 3 attempts',
|
||||
'invalid_checksum_format': '❌ Downloaded file produced invalid checksum format',
|
||||
'invalid_dockerfile_checksum': '❌ Current Dockerfile contains invalid checksum format',
|
||||
'unknown': '❌ Workflow failed with unknown error'
|
||||
};
|
||||
|
||||
const title = `🚨 GeoLite2 Checksum Update Failed (${errorType})`;
|
||||
const body = `
|
||||
## Automated GeoLite2 Update Workflow Failed
|
||||
|
||||
**Error Type:** \`${errorType}\`
|
||||
**Error Message:** ${errorMessages[errorType] || errorMessages.unknown}
|
||||
|
||||
### Workflow Details
|
||||
- **Run URL:** ${runUrl}
|
||||
- **Triggered:** ${context.eventName === 'schedule' ? 'Scheduled (weekly)' : 'Manual dispatch'}
|
||||
- **Timestamp:** ${new Date().toISOString()}
|
||||
|
||||
### Required Actions
|
||||
1. Review workflow logs: ${runUrl}
|
||||
2. Check upstream source availability: https://github.com/P3TERX/GeoLite.mmdb
|
||||
3. Verify network connectivity from GitHub Actions runners
|
||||
4. If upstream is unavailable, consider alternative sources
|
||||
|
||||
### Manual Update (if needed)
|
||||
\`\`\`bash
|
||||
# Download and verify checksum
|
||||
curl -fsSL "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb" | sha256sum
|
||||
|
||||
# Update Dockerfile line 352
|
||||
vim Dockerfile # or use sed
|
||||
|
||||
# Test build
|
||||
docker build --no-cache -t test .
|
||||
\`\`\`
|
||||
|
||||
### Related Documentation
|
||||
- [Implementation Plan](/docs/plans/current_spec.md)
|
||||
- [Workflow File](/.github/workflows/update-geolite2.yml)
|
||||
|
||||
---
|
||||
|
||||
**Auto-generated by:** \`.github/workflows/update-geolite2.yml\`
|
||||
`;
|
||||
|
||||
await github.rest.issues.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: title,
|
||||
body: body,
|
||||
labels: ['bug', 'automated', 'ci-cd', 'docker']
|
||||
});
|
||||
99
.github/workflows/waf-integration.yml
vendored
99
.github/workflows/waf-integration.yml
vendored
@@ -1,99 +0,0 @@
|
||||
name: WAF integration
|
||||
|
||||
# Phase 2-3: Build Once, Test Many - Use registry image instead of building
|
||||
# This workflow now waits for docker-build.yml to complete and pulls the built image
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag to test (e.g., pr-123-abc1234, latest)'
|
||||
required: false
|
||||
type: string
|
||||
pull_request:
|
||||
|
||||
# Prevent race conditions when PR is updated mid-test
|
||||
# Cancels old test runs when new build completes with different SHA
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.event.workflow_run.event || github.event_name }}-${{ github.event.workflow_run.head_branch || github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
waf-integration:
|
||||
name: Coraza WAF Integration
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- name: Build Docker image (Local)
|
||||
run: |
|
||||
echo "Building image locally for integration tests..."
|
||||
docker build -t charon:local .
|
||||
echo "✅ Successfully built charon:local"
|
||||
|
||||
- name: Run WAF integration tests
|
||||
id: waf-test
|
||||
run: |
|
||||
chmod +x scripts/coraza_integration.sh
|
||||
scripts/coraza_integration.sh 2>&1 | tee waf-test-output.txt
|
||||
exit "${PIPESTATUS[0]}"
|
||||
|
||||
- name: Dump Debug Info on Failure
|
||||
if: failure()
|
||||
run: |
|
||||
{
|
||||
echo "## 🔍 Debug Information"
|
||||
echo ""
|
||||
|
||||
echo "### Container Status"
|
||||
echo '```'
|
||||
docker ps -a --filter "name=charon" --filter "name=coraza" 2>&1 || true
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Caddy Admin Config"
|
||||
echo '```json'
|
||||
curl -s http://localhost:2019/config 2>/dev/null | head -200 || echo "Could not retrieve Caddy config"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### Charon Container Logs (last 100 lines)"
|
||||
echo '```'
|
||||
docker logs charon-debug 2>&1 | tail -100 || echo "No container logs available"
|
||||
echo '```'
|
||||
echo ""
|
||||
|
||||
echo "### WAF Ruleset Files"
|
||||
echo '```'
|
||||
docker exec charon-debug sh -c 'ls -la /app/data/caddy/coraza/rulesets/ 2>/dev/null && echo "---" && cat /app/data/caddy/coraza/rulesets/*.conf 2>/dev/null' || echo "No ruleset files found"
|
||||
echo '```'
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: WAF Integration Summary
|
||||
if: always()
|
||||
run: |
|
||||
{
|
||||
echo "## 🛡️ WAF Integration Test Results"
|
||||
if [ "${{ steps.waf-test.outcome }}" == "success" ]; then
|
||||
echo "✅ **All WAF tests passed**"
|
||||
echo ""
|
||||
echo "### Test Results:"
|
||||
echo '```'
|
||||
grep -E "^✓|^===|^Coraza" waf-test-output.txt || echo "See logs for details"
|
||||
echo '```'
|
||||
else
|
||||
echo "❌ **WAF tests failed**"
|
||||
echo ""
|
||||
echo "### Failure Details:"
|
||||
echo '```'
|
||||
grep -E "^✗|Unexpected|Error|failed" waf-test-output.txt | head -20 || echo "See logs for details"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: |
|
||||
docker rm -f charon-debug || true
|
||||
docker rm -f coraza-backend || true
|
||||
docker network rm containers_default || true
|
||||
485
.github/workflows/weekly-nightly-promotion.yml
vendored
485
.github/workflows/weekly-nightly-promotion.yml
vendored
@@ -1,485 +0,0 @@
|
||||
name: Weekly Nightly to Main Promotion
|
||||
|
||||
# Creates a PR from nightly → main every Monday for scheduled release promotion.
|
||||
# Includes safety checks for workflow status and provides manual trigger option.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
# Every Monday at 09:00 UTC (4am EST / 5am EDT)
|
||||
- cron: '0 9 * * 1'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
reason:
|
||||
description: 'Why are you running this manually?'
|
||||
required: true
|
||||
default: 'Ad-hoc promotion request'
|
||||
skip_workflow_check:
|
||||
description: 'Skip nightly workflow status check?'
|
||||
required: false
|
||||
type: boolean
|
||||
default: false
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
NODE_VERSION: '24.12.0'
|
||||
SOURCE_BRANCH: 'nightly'
|
||||
TARGET_BRANCH: 'main'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
issues: write
|
||||
actions: read
|
||||
|
||||
jobs:
|
||||
check-nightly-health:
|
||||
name: Verify Nightly Branch Health
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
is_healthy: ${{ steps.check.outputs.is_healthy }}
|
||||
latest_run_url: ${{ steps.check.outputs.latest_run_url }}
|
||||
failure_reason: ${{ steps.check.outputs.failure_reason }}
|
||||
|
||||
steps:
|
||||
- name: Check Nightly Workflow Status
|
||||
id: check
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const skipCheck = '${{ inputs.skip_workflow_check }}' === 'true';
|
||||
|
||||
if (skipCheck) {
|
||||
core.info('Skipping workflow health check as requested');
|
||||
core.setOutput('is_healthy', 'true');
|
||||
core.setOutput('latest_run_url', 'N/A - check skipped');
|
||||
core.setOutput('failure_reason', '');
|
||||
return;
|
||||
}
|
||||
|
||||
core.info('Checking nightly branch workflow health...');
|
||||
|
||||
// Get the latest workflow runs on the nightly branch
|
||||
const { data: runs } = await github.rest.actions.listWorkflowRunsForRepo({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
branch: 'nightly',
|
||||
status: 'completed',
|
||||
per_page: 10,
|
||||
});
|
||||
|
||||
if (runs.workflow_runs.length === 0) {
|
||||
core.setOutput('is_healthy', 'true');
|
||||
core.setOutput('latest_run_url', 'No completed runs found');
|
||||
core.setOutput('failure_reason', '');
|
||||
core.info('No completed workflow runs found on nightly - proceeding');
|
||||
return;
|
||||
}
|
||||
|
||||
// Check the most recent critical workflows
|
||||
const criticalWorkflows = ['Nightly Build & Package', 'Quality Checks', 'E2E Tests'];
|
||||
const recentRuns = runs.workflow_runs.slice(0, 10);
|
||||
|
||||
let hasFailure = false;
|
||||
let failureReason = '';
|
||||
let latestRunUrl = recentRuns[0]?.html_url || 'N/A';
|
||||
|
||||
for (const workflowName of criticalWorkflows) {
|
||||
const latestRun = recentRuns.find(r => r.name === workflowName);
|
||||
if (latestRun && latestRun.conclusion === 'failure') {
|
||||
hasFailure = true;
|
||||
failureReason = `${workflowName} failed (${latestRun.html_url})`;
|
||||
latestRunUrl = latestRun.html_url;
|
||||
core.warning(`Critical workflow "${workflowName}" has failed`);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
core.setOutput('is_healthy', hasFailure ? 'false' : 'true');
|
||||
core.setOutput('latest_run_url', latestRunUrl);
|
||||
core.setOutput('failure_reason', failureReason);
|
||||
|
||||
if (hasFailure) {
|
||||
core.warning(`Nightly branch has failing workflows: ${failureReason}`);
|
||||
} else {
|
||||
core.info('Nightly branch is healthy - all critical workflows passing');
|
||||
}
|
||||
|
||||
create-promotion-pr:
|
||||
name: Create Promotion PR
|
||||
needs: check-nightly-health
|
||||
runs-on: ubuntu-latest
|
||||
if: needs.check-nightly-health.outputs.is_healthy == 'true'
|
||||
outputs:
|
||||
pr_number: ${{ steps.create-pr.outputs.pr_number }}
|
||||
pr_url: ${{ steps.create-pr.outputs.pr_url }}
|
||||
skipped: ${{ steps.check-diff.outputs.skipped }}
|
||||
|
||||
steps:
|
||||
- name: Checkout Repository
|
||||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
with:
|
||||
ref: ${{ env.TARGET_BRANCH }}
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Check for Differences
|
||||
id: check-diff
|
||||
run: |
|
||||
git fetch origin "${{ env.SOURCE_BRANCH }}"
|
||||
|
||||
# Compare the branches
|
||||
AHEAD_COUNT=$(git rev-list --count "origin/${{ env.TARGET_BRANCH }}..origin/${{ env.SOURCE_BRANCH }}")
|
||||
BEHIND_COUNT=$(git rev-list --count "origin/${{ env.SOURCE_BRANCH }}..origin/${{ env.TARGET_BRANCH }}")
|
||||
|
||||
echo "Nightly is $AHEAD_COUNT commits ahead of main"
|
||||
echo "Nightly is $BEHIND_COUNT commits behind main"
|
||||
|
||||
if [ "$AHEAD_COUNT" -eq 0 ]; then
|
||||
echo "No changes to promote - nightly is up-to-date with main"
|
||||
echo "skipped=true" >> "$GITHUB_OUTPUT"
|
||||
echo "skip_reason=No changes to promote" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "skipped=false" >> "$GITHUB_OUTPUT"
|
||||
echo "ahead_count=$AHEAD_COUNT" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Generate Commit Summary
|
||||
id: commits
|
||||
if: steps.check-diff.outputs.skipped != 'true'
|
||||
run: |
|
||||
# Get the date for the PR title
|
||||
DATE=$(date -u +%Y-%m-%d)
|
||||
echo "date=$DATE" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# Generate commit log
|
||||
COMMIT_LOG=$(git log --oneline "origin/${{ env.TARGET_BRANCH }}..origin/${{ env.SOURCE_BRANCH }}" | head -50)
|
||||
COMMIT_COUNT=$(git rev-list --count "origin/${{ env.TARGET_BRANCH }}..origin/${{ env.SOURCE_BRANCH }}")
|
||||
|
||||
# Store commit log in a file to preserve formatting
|
||||
cat > /tmp/commit_log.md << 'COMMITS_EOF'
|
||||
## Commits Being Promoted
|
||||
|
||||
COMMITS_EOF
|
||||
|
||||
{
|
||||
if [ "$COMMIT_COUNT" -gt 50 ]; then
|
||||
echo "_Showing first 50 of $COMMIT_COUNT commits:_"
|
||||
fi
|
||||
|
||||
echo '```'
|
||||
echo "$COMMIT_LOG"
|
||||
echo '```'
|
||||
|
||||
if [ "$COMMIT_COUNT" -gt 50 ]; then
|
||||
echo ""
|
||||
echo "_...and $((COMMIT_COUNT - 50)) more commits_"
|
||||
fi
|
||||
} >> /tmp/commit_log.md
|
||||
|
||||
# Get files changed summary
|
||||
FILES_CHANGED=$(git diff --stat "origin/${{ env.TARGET_BRANCH }}..origin/${{ env.SOURCE_BRANCH }}" | tail -1)
|
||||
echo "files_changed=$FILES_CHANGED" >> "$GITHUB_OUTPUT"
|
||||
echo "commit_count=$COMMIT_COUNT" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Check for Existing PR
|
||||
id: existing-pr
|
||||
if: steps.check-diff.outputs.skipped != 'true'
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const { data: pulls } = await github.rest.pulls.list({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
state: 'open',
|
||||
head: `${context.repo.owner}:${{ env.SOURCE_BRANCH }}`,
|
||||
base: '${{ env.TARGET_BRANCH }}',
|
||||
});
|
||||
|
||||
if (pulls.length > 0) {
|
||||
core.info(`Existing PR found: #${pulls[0].number}`);
|
||||
core.setOutput('exists', 'true');
|
||||
core.setOutput('pr_number', pulls[0].number);
|
||||
core.setOutput('pr_url', pulls[0].html_url);
|
||||
} else {
|
||||
core.setOutput('exists', 'false');
|
||||
}
|
||||
|
||||
- name: Create Promotion PR
|
||||
id: create-pr
|
||||
if: steps.check-diff.outputs.skipped != 'true' && steps.existing-pr.outputs.exists != 'true'
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const date = '${{ steps.commits.outputs.date }}';
|
||||
const commitCount = '${{ steps.commits.outputs.commit_count }}';
|
||||
const filesChanged = '${{ steps.commits.outputs.files_changed }}';
|
||||
const commitLog = fs.readFileSync('/tmp/commit_log.md', 'utf8');
|
||||
|
||||
const triggerReason = '${{ inputs.reason }}' || 'Scheduled weekly promotion';
|
||||
|
||||
const body = `## 🚀 Weekly Nightly to Main Promotion
|
||||
|
||||
**Date:** ${date}
|
||||
**Trigger:** ${triggerReason}
|
||||
**Commits:** ${commitCount} commits to promote
|
||||
**Changes:** ${filesChanged}
|
||||
|
||||
---
|
||||
|
||||
${commitLog}
|
||||
|
||||
---
|
||||
|
||||
## Pre-Merge Checklist
|
||||
|
||||
- [ ] All status checks pass
|
||||
- [ ] No critical security issues identified
|
||||
- [ ] Changelog is up-to-date (auto-generated via workflow)
|
||||
- [ ] Version bump is appropriate (if applicable)
|
||||
|
||||
## Merge Instructions
|
||||
|
||||
This PR promotes changes from \`nightly\` to \`main\`. Once all checks pass:
|
||||
|
||||
1. **Review** the commit summary above
|
||||
2. **Approve** if changes look correct
|
||||
3. **Merge** using "Merge commit" to preserve history
|
||||
|
||||
---
|
||||
|
||||
_This PR was automatically created by the [Weekly Nightly Promotion](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow._
|
||||
`;
|
||||
|
||||
try {
|
||||
const pr = await github.rest.pulls.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: `Weekly: Promote nightly to main (${date})`,
|
||||
head: '${{ env.SOURCE_BRANCH }}',
|
||||
base: '${{ env.TARGET_BRANCH }}',
|
||||
body: body,
|
||||
draft: false,
|
||||
});
|
||||
|
||||
core.info(`Created PR #${pr.data.number}: ${pr.data.html_url}`);
|
||||
core.setOutput('pr_number', pr.data.number);
|
||||
core.setOutput('pr_url', pr.data.html_url);
|
||||
|
||||
// Add labels (create if they don't exist)
|
||||
const labels = ['automated', 'weekly-promotion'];
|
||||
for (const label of labels) {
|
||||
try {
|
||||
await github.rest.issues.getLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: label,
|
||||
});
|
||||
} catch (e) {
|
||||
// Label doesn't exist, create it
|
||||
const colors = {
|
||||
'automated': '0e8a16',
|
||||
'weekly-promotion': '5319e7',
|
||||
};
|
||||
await github.rest.issues.createLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: label,
|
||||
color: colors[label] || 'ededed',
|
||||
description: label === 'automated'
|
||||
? 'Automatically generated by CI/CD'
|
||||
: 'Weekly promotion from nightly to main',
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
await github.rest.issues.addLabels({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: pr.data.number,
|
||||
labels: labels,
|
||||
});
|
||||
|
||||
core.info('Labels added successfully');
|
||||
|
||||
} catch (error) {
|
||||
core.setFailed(`Failed to create PR: ${error.message}`);
|
||||
}
|
||||
|
||||
- name: Update Existing PR
|
||||
if: steps.check-diff.outputs.skipped != 'true' && steps.existing-pr.outputs.exists == 'true'
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const prNumber = ${{ steps.existing-pr.outputs.pr_number }};
|
||||
core.info(`PR #${prNumber} already exists - adding comment with update`);
|
||||
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: prNumber,
|
||||
body: `🔄 **Weekly check:** This PR is still open. New commits may have been added to \`nightly\` since the original PR was created.\n\n_Triggered by [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})_`,
|
||||
});
|
||||
|
||||
core.setOutput('pr_number', prNumber);
|
||||
core.setOutput('pr_url', '${{ steps.existing-pr.outputs.pr_url }}');
|
||||
|
||||
notify-on-failure:
|
||||
name: Notify on Failure
|
||||
needs: [check-nightly-health, create-promotion-pr]
|
||||
runs-on: ubuntu-latest
|
||||
if: |
|
||||
always() &&
|
||||
(needs.check-nightly-health.outputs.is_healthy == 'false' ||
|
||||
needs.create-promotion-pr.result == 'failure')
|
||||
|
||||
steps:
|
||||
- name: Create Failure Issue
|
||||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
||||
with:
|
||||
script: |
|
||||
const isHealthy = '${{ needs.check-nightly-health.outputs.is_healthy }}';
|
||||
const failureReason = '${{ needs.check-nightly-health.outputs.failure_reason }}';
|
||||
const latestRunUrl = '${{ needs.check-nightly-health.outputs.latest_run_url }}';
|
||||
const prResult = '${{ needs.create-promotion-pr.result }}';
|
||||
|
||||
let title, body;
|
||||
|
||||
if (isHealthy === 'false') {
|
||||
title = '🚨 Weekly Promotion Blocked: Nightly Branch Unhealthy';
|
||||
body = `## Weekly Promotion Failed
|
||||
|
||||
The weekly promotion from \`nightly\` to \`main\` was **blocked** because the nightly branch has failing workflows.
|
||||
|
||||
### Failure Details
|
||||
|
||||
- **Reason:** ${failureReason}
|
||||
- **Latest Run:** ${latestRunUrl}
|
||||
- **Workflow Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||
|
||||
### Required Actions
|
||||
|
||||
1. Investigate the failing workflow on the nightly branch
|
||||
2. Fix the underlying issue
|
||||
3. Re-run the failed workflow
|
||||
4. Manually trigger the weekly promotion workflow once nightly is healthy
|
||||
|
||||
---
|
||||
|
||||
_This issue was automatically created by the Weekly Nightly Promotion workflow._
|
||||
`;
|
||||
} else {
|
||||
title = '🚨 Weekly Promotion Failed: PR Creation Error';
|
||||
body = `## Weekly Promotion Failed
|
||||
|
||||
The weekly promotion workflow encountered an error while trying to create the PR.
|
||||
|
||||
### Details
|
||||
|
||||
- **PR Creation Result:** ${prResult}
|
||||
- **Workflow Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||
|
||||
### Required Actions
|
||||
|
||||
1. Check the workflow logs for detailed error information
|
||||
2. Manually create the promotion PR if needed
|
||||
3. Investigate and fix any configuration issues
|
||||
|
||||
---
|
||||
|
||||
_This issue was automatically created by the Weekly Nightly Promotion workflow._
|
||||
`;
|
||||
}
|
||||
|
||||
// Check for existing open issues with same title
|
||||
const { data: issues } = await github.rest.issues.listForRepo({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
state: 'open',
|
||||
labels: 'weekly-promotion-failure',
|
||||
});
|
||||
|
||||
const existingIssue = issues.find(i => i.title === title);
|
||||
|
||||
if (existingIssue) {
|
||||
// Add comment to existing issue
|
||||
await github.rest.issues.createComment({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
issue_number: existingIssue.number,
|
||||
body: `🔄 **Update:** This issue occurred again.\n\n${body}`,
|
||||
});
|
||||
core.info(`Updated existing issue #${existingIssue.number}`);
|
||||
} else {
|
||||
// Create label if it doesn't exist
|
||||
try {
|
||||
await github.rest.issues.getLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: 'weekly-promotion-failure',
|
||||
});
|
||||
} catch (e) {
|
||||
await github.rest.issues.createLabel({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
name: 'weekly-promotion-failure',
|
||||
color: 'd73a4a',
|
||||
description: 'Weekly promotion workflow failure',
|
||||
});
|
||||
}
|
||||
|
||||
// Create new issue
|
||||
const issue = await github.rest.issues.create({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
title: title,
|
||||
body: body,
|
||||
labels: ['weekly-promotion-failure', 'automated'],
|
||||
});
|
||||
core.info(`Created issue #${issue.data.number}`);
|
||||
}
|
||||
|
||||
summary:
|
||||
name: Workflow Summary
|
||||
needs: [check-nightly-health, create-promotion-pr]
|
||||
runs-on: ubuntu-latest
|
||||
if: always()
|
||||
|
||||
steps:
|
||||
- name: Generate Summary
|
||||
run: |
|
||||
{
|
||||
echo "## 📋 Weekly Nightly Promotion Summary"
|
||||
echo ""
|
||||
|
||||
HEALTH="${{ needs.check-nightly-health.outputs.is_healthy }}"
|
||||
SKIPPED="${{ needs.create-promotion-pr.outputs.skipped }}"
|
||||
PR_URL="${{ needs.create-promotion-pr.outputs.pr_url }}"
|
||||
PR_NUMBER="${{ needs.create-promotion-pr.outputs.pr_number }}"
|
||||
FAILURE_REASON="${{ needs.check-nightly-health.outputs.failure_reason }}"
|
||||
|
||||
echo "| Step | Status |"
|
||||
echo "|------|--------|"
|
||||
|
||||
if [ "$HEALTH" = "true" ]; then
|
||||
echo "| Nightly Health Check | ✅ Healthy |"
|
||||
else
|
||||
echo "| Nightly Health Check | ❌ Unhealthy: $FAILURE_REASON |"
|
||||
fi
|
||||
|
||||
if [ "$SKIPPED" = "true" ]; then
|
||||
echo "| PR Creation | ⏭️ Skipped (no changes) |"
|
||||
elif [ -n "$PR_URL" ]; then
|
||||
echo "| PR Creation | ✅ [PR #$PR_NUMBER]($PR_URL) |"
|
||||
else
|
||||
echo "| PR Creation | ❌ Failed |"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "---"
|
||||
echo "_Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}_"
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
Reference in New Issue
Block a user