Skip to content

ci: run owner pull request checks on the self-hosted mac mini #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
agentHits merged 2 commits into from
Oct 7, 2026
Merged

ci: run owner pull request checks on the self-hosted mac mini #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b1ad148
ci: run owner pull request checks on the self-hosted mac mini
agentHits Oct 7, 2026
db78c6a
test: give the super password alert sweep a 30 s timeout
agentHits Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,16 @@ on:
permissions:
contents: read

concurrency:
group: pull-request-${{ github.event.pull_request.number }}
cancel-in-progress: true

jobs:
audit:
runs-on: ubuntu-latest
# Only the owner's own PRs reach the Mac mini runners. A fork PR could rewrite
# this line, so the repo also requires approval for every outside contributor.
runs-on: ${{ (github.event.pull_request.user.login == github.repository_owner && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted", "dokploy-ci"]') || 'ubuntu-latest' }}
timeout-minutes: 30
steps:
- uses: actions/checkout@v7
with:
Expand All @@ -21,7 +28,8 @@ jobs:
- run: bun audit --audit-level=moderate --ignore GHSA-vfj7-8cjw-p6xm

pr-check:
runs-on: ubuntu-latest
runs-on: ${{ (github.event.pull_request.user.login == github.repository_owner && github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted", "dokploy-ci"]') || 'ubuntu-latest' }}
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
Expand All @@ -38,14 +46,14 @@ jobs:
node-version: 24.4.0

- name: Install Nixpacks
if: matrix.job == 'test'
if: matrix.job == 'test' && runner.environment == 'github-hosted'
run: |
export NIXPACKS_VERSION=1.41.0
curl -sSL https://nixpacks.com/install.sh | bash
echo "Nixpacks installed $NIXPACKS_VERSION"

- name: Install Railpack
if: matrix.job == 'test'
if: matrix.job == 'test' && runner.environment == 'github-hosted'
run: |
export RAILPACK_VERSION=0.15.4
curl -sSL https://railpack.com/install.sh | bash
Expand All @@ -58,7 +66,10 @@ jobs:
- name: Initialize Docker Swarm
if: matrix.job == 'test'
run: |
docker swarm init
# The Mac mini keeps its swarm between runs.
if [ "$(docker info --format '{{.Swarm.LocalNodeState}}')" != "active" ]; then
docker swarm init
fi
docker network create --driver overlay dokploy-network || true
echo "✅ Docker Swarm initialized"

Expand Down
3 changes: 2 additions & 1 deletion apps/dokploy/__test__/security/super-password-alerts.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,6 +318,7 @@ describe("super password alerts", () => {
]);
});

// About 20 bcrypt hashes run here; with every CPU core busy they exceed 5 s.
it("covers every super password event with no secrets in the payloads", async () => {
seedTelegram("alerts", { messageThreadId: "42" });
seedDiscord("backup");
Expand Down Expand Up @@ -428,7 +429,7 @@ describe("super password alerts", () => {
telegramCalls().map(([, text, buttons]) => ({ text, buttons })),
);
expect(telegramOnly).not.toContain("super-password-reset?token=");
});
}, 30_000);

it("puts the one-time lock link on opened and extended alerts as a Telegram button", async () => {
seedTelegram("alerts");
Expand Down
Loading