Repository navigation
chore(deps): bump the pip group across 1 directory with 2 updates #64
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and publish image | ||
|
Check warning on line 1 in .github/workflows/publish-image.yml
|
||
| on: | ||
| schedule: | ||
| - cron: '22 0 * * *' | ||
| timezone: America/Detroit | ||
| push: | ||
| branches: [main] | ||
| pull_request_target: | ||
| branches: [main] | ||
| workflow_dispatch: | ||
| permissions: | ||
| contents: read | ||
| concurrency: | ||
| group: ghcr-main | ||
| cancel-in-progress: false | ||
| env: | ||
| DOCKER_BUILD_RECORD_UPLOAD: "false" | ||
| jobs: | ||
| verify: | ||
| name: Verify and scan image (pull request) | ||
| if: >- | ||
| github.event_name == 'pull_request_target' && | ||
| github.event.pull_request.head.repo.full_name == github.repository && | ||
| (github.actor == 'javaDevJT' || | ||
| (github.actor == 'quarterback-ci[bot]' && | ||
| github.event.pull_request.user.id == 341165314) || | ||
| (github.actor == 'dependabot[bot]' && | ||
| github.event.pull_request.user.login == 'dependabot[bot]' && | ||
| github.event.pull_request.user.id == 49699333)) | ||
| runs-on: truenas-routelisttotesla-storage-40g | ||
| timeout-minutes: 60 | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Start BuildKit storage collection | ||
| run: ci-storage-efficiency start | ||
| - name: Check out pull request source | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| persist-credentials: false | ||
| - name: Log in to Docker Hub | ||
| if: github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]' | ||
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| - name: Set up private BuildKit | ||
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | ||
| with: | ||
| cache-binary: false | ||
| driver: remote | ||
| endpoint: tcp://buildkit:1234 | ||
| driver-opts: | | ||
| cacert=/run/buildkit/tls/ca.pem | ||
| cert=/run/buildkit/tls/client.pem | ||
| key=/run/buildkit/tls/client.key | ||
| - name: Prepare disk build cache | ||
| id: ci_disk_cache_1 | ||
| run: ci-cache "routelisttotesla-linux-amd64" | ||
| - name: Prepare immutable scan artifact | ||
| id: container_security_1 | ||
| shell: bash | ||
| env: | ||
| SECURITY_PUBLISH: "false" | ||
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | ||
| run: bash .github/actions/container-security/container-security.sh prepare | ||
| - name: Build and test pull request image | ||
| id: container_build_1 | ||
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | ||
| env: | ||
| DOCKER_BUILD_RECORD_RETENTION_DAYS: "1" | ||
| with: | ||
| outputs: ${{ steps.container_security_1.outputs.exporter }} | ||
| cache-from: type=local,src=${{ steps.ci_disk_cache_1.outputs.from }} | ||
| cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }} | ||
| context: . | ||
| platforms: linux/amd64 | ||
| no-cache-filters: runtime-base,ocr-build,runtime | ||
| push: false | ||
| build-args: | | ||
| VCS_REF=${{ github.event.pull_request.head.sha }} | ||
| QB_SOURCE_COMMIT=${{ github.event.pull_request.head.sha }} | ||
| tags: ${{ steps.container_security_1.outputs.repository }} | ||
| - name: Generate SBOM and enforce High/Critical vulnerability gate | ||
| id: container_scan_1 | ||
| uses: ./.github/actions/container-security | ||
| with: | ||
| image: oci-archive:${{ steps.container_security_1.outputs.archive }} | ||
| platforms: linux/amd64 | ||
| report-directory: ${{ runner.temp }}/container-security/build-1 | ||
| artifact-name: container-security-${{ github.job }}-build-1 | ||
| - name: Finish BuildKit storage collection | ||
| if: always() | ||
| run: ci-storage-efficiency finish | ||
| publish: | ||
| if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main' | ||
| runs-on: truenas-routelisttotesla-storage-40g | ||
| timeout-minutes: 60 | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - name: Start BuildKit storage collection | ||
| run: ci-storage-efficiency start | ||
| - name: Check out source | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Log in to Docker Hub | ||
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| - name: Set up private BuildKit | ||
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | ||
| with: | ||
| cache-binary: false | ||
| driver: remote | ||
| endpoint: tcp://buildkit:1234 | ||
| driver-opts: | | ||
| cacert=/run/buildkit/tls/ca.pem | ||
| cert=/run/buildkit/tls/client.pem | ||
| key=/run/buildkit/tls/client.key | ||
| - name: Log in to GHCR | ||
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Prepare disk build cache | ||
| id: ci_disk_cache_1 | ||
| run: ci-cache "routelisttotesla-linux-amd64" | ||
| - name: Prepare immutable image and release tags | ||
| id: container_security_1 | ||
| shell: bash | ||
| env: | ||
| SECURITY_PUBLISH: "true" | ||
| SECURITY_RELEASE_TAGS: | | ||
| ghcr.io/javadevjt/routelisttotesla:latest | ||
| ghcr.io/javadevjt/routelisttotesla:sha-${{ github.sha }} | ||
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | ||
| run: bash .github/actions/container-security/container-security.sh prepare | ||
| - name: Build, test, and publish | ||
| id: container_build_1 | ||
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | ||
| env: | ||
| DOCKER_BUILD_RECORD_RETENTION_DAYS: "1" | ||
| with: | ||
| outputs: ${{ steps.container_security_1.outputs.exporter }} | ||
| cache-from: | | ||
| type=local,src=${{ steps.ci_disk_cache_1.outputs.from }} | ||
| cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }} | ||
| context: . | ||
| platforms: linux/amd64 | ||
| # Refresh the assembled runtime and its derived OCR environment together. | ||
| no-cache-filters: runtime-base,ocr-build,runtime | ||
| push: false # Push-by-digest is configured in the exporter; tags follow the scan. | ||
| build-args: | | ||
| VCS_REF=${{ github.sha }} | ||
| QB_SOURCE_COMMIT=${{ github.sha }} | ||
| tags: ${{ steps.container_security_1.outputs.repository }} | ||
| - name: Generate SBOM and enforce High/Critical vulnerability gate | ||
| uses: ./.github/actions/container-security | ||
| with: | ||
| image: registry:${{ steps.container_security_1.outputs.repository }}@${{ steps.container_build_1.outputs.digest }} | ||
| platforms: "linux/amd64" | ||
| report-directory: ${{ runner.temp }}/container-security/build-1 | ||
| artifact-name: container-security-${{ github.job }}-${{ strategy.job-index || 0 }}-build-1 | ||
| - name: Finish and enforce BuildKit storage usage | ||
| if: always() | ||
| run: ci-storage-efficiency finish | ||
| - name: Format bounded plaintext storage diagnostics | ||
| id: storage_log | ||
| if: always() | ||
| run: | | ||
| python3 .github/scripts/format-storage-evidence.py \ | ||
| --output "$RUNNER_TEMP/ci-storage-evidence.log" \ | ||
| --repository "$GITHUB_REPOSITORY" --revision "$GITHUB_SHA" \ | ||
| --usage-input "$RUNNER_TEMP/ci-storage-usage-start.json" \ | ||
| --usage-input "$RUNNER_TEMP/ci-storage-usage.json" | ||
| - name: Upload bounded storage diagnostics | ||
| if: ${{ always() && steps.storage_log.outputs.available == 'true' }} | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: ci-log-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ strategy.job-index || 0 }} | ||
| path: ${{ runner.temp }}/ci-storage-evidence.log | ||
| if-no-files-found: error | ||
| retention-days: 1 | ||
| - name: Publish release tags only after the vulnerability gate passes | ||
| shell: bash | ||
| env: | ||
| SECURITY_IMAGE: ${{ steps.container_security_1.outputs.repository }}@${{ steps.container_build_1.outputs.digest }} | ||
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | ||
| run: bash .github/actions/container-security/container-security.sh publish | ||
| - name: Emit portable build receipt marker | ||
| shell: bash | ||
| env: | ||
| SOURCE_SHA: ${{ github.sha }} | ||
| RUN_ID: ${{ github.run_id }} | ||
| RUN_ATTEMPT: ${{ github.run_attempt }} | ||
| IMAGE_DIGEST: ${{ steps.container_build_1.outputs.digest }} | ||
| run: | | ||
| set -euo pipefail | ||
| [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] | ||
| [[ "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]] | ||
| printf 'QB_BUILD_RECEIPT_V1 source_sha=%s run_id=%s run_attempt=%s digest=%s\n' \ | ||
| "$SOURCE_SHA" "$RUN_ID" "$RUN_ATTEMPT" "$IMAGE_DIGEST" | ||
| cleanup-artifacts: | ||
| name: Remove transient build artifacts | ||
| needs: ["publish"] | ||
| if: ${{ always() && github.event_name != 'pull_request_target' }} | ||
| runs-on: truenas-routelisttotesla-storage-8g | ||
| timeout-minutes: 10 | ||
| permissions: | ||
| actions: write | ||
| contents: read | ||
| steps: | ||
| - name: Check out trusted default branch cleanup code | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| ref: ${{ github.event.repository.default_branch }} | ||
| persist-credentials: false | ||
| - name: Set up Python for bounded cleanup | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | ||
| with: | ||
| python-version: '3.13' | ||
| - name: Delete non-retained current-run artifacts | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: python3 .github/scripts/cleanup-actions-artifacts.py --current | ||
