mirror of
https://github.com/kevinveenbirkenbach/homepage.veen.world.git
synced 2026-09-10 21:26:48 +00:00
Kevin Veen-Birkenbach
2c7f0a23d1
CodeQL flagged docker/setup-buildx-action, docker/login-action, docker/build-push-action and cypress-io/github-action as unpinned: a moving v3 or v6 tag lets whoever controls it change what runs with the workflow's GHCR write token. Each action is now pinned to the commit its tag points to today, with the exact release as a trailing comment (v3.12.0, v3.7.0, v6.19.2, v6.10.9), resolved through the GitHub API, so the code that runs does not change. GitHub's own actions/* were not flagged and keep their tags. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
91 lines
2.3 KiB
YAML
91 lines
2.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- "**"
|
|
tags-ignore:
|
|
- "**"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
security:
|
|
name: Run security workflow
|
|
uses: ./.github/workflows/security.yml
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
security-events: write
|
|
|
|
tests:
|
|
name: Run test workflow
|
|
uses: ./.github/workflows/tests.yml
|
|
|
|
lint:
|
|
name: Run lint workflow
|
|
uses: ./.github/workflows/lint.yml
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
publish:
|
|
name: Publish image
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- security
|
|
- tests
|
|
- lint
|
|
if: github.event_name == 'push'
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Detect semver tag on current commit
|
|
id: semver
|
|
run: |
|
|
SEMVER_TAG="$(git tag --points-at "$GITHUB_SHA" | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)"
|
|
if [ -n "$SEMVER_TAG" ]; then
|
|
{
|
|
echo "found=true"
|
|
echo "raw_tag=$SEMVER_TAG"
|
|
echo "version=${SEMVER_TAG#v}"
|
|
} >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "found=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Compute image name
|
|
if: steps.semver.outputs.found == 'true'
|
|
id: image
|
|
run: echo "name=ghcr.io/$(echo "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up Docker Buildx
|
|
if: steps.semver.outputs.found == 'true'
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
|
|
|
- name: Login to GHCR
|
|
if: steps.semver.outputs.found == 'true'
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and publish image
|
|
if: steps.semver.outputs.found == 'true'
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
push: true
|
|
tags: ${{ steps.image.outputs.name }}:${{ steps.semver.outputs.version }}
|