Repository navigation
build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend in the npm_and_yarn group across 1 directory #35
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| schedule: | |
| - cron: '5 4 * * *' | |
| timezone: America/Detroit | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker-build: | |
| name: Build, Test and Scan | |
| runs-on: truenas-website-storage-16g | |
| timeout-minutes: 40 | |
| steps: | |
| - name: Start BuildKit storage collection | |
| run: ci-storage-efficiency start | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - name: Test scheduled publication CI guard | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { execFileSync } = require('node:child_process'); | |
| execFileSync(process.execPath, ['--test', '.github/scripts/wait-for-daily-ci.test.cjs'], { stdio: 'inherit' }); | |
| - name: Set up authenticated remote BuildKit | |
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| with: | |
| driver: remote | |
| endpoint: tcp://buildkit:1234 | |
| driver-opts: | | |
| cacert=/run/buildkit/tls/ca.pem | |
| cert=/run/buildkit/tls/client.pem | |
| key=/run/buildkit/tls/client.key | |
| - name: Prepare disk build cache | |
| id: ci_disk_cache_1 | |
| run: ci-cache "truenas-15ed4a3293d99fba" | |
| - name: Prepare immutable image and release tags | |
| id: container_security_1 | |
| shell: bash | |
| env: | |
| SECURITY_PUBLISH: "false" | |
| SECURITY_RELEASE_TAGS: | | |
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | |
| run: bash .github/actions/container-security/container-security.sh prepare | |
| - name: Test Backend, Verify Linked Runtime and Scan Vulnerabilities | |
| id: container_build_1 | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| outputs: ${{ steps.container_security_1.outputs.exporter }} | |
| cache-from: | | |
| type=local,src=${{ steps.ci_disk_cache_1.outputs.from }} | |
| type=gha,version=2,scope=truenas-15ed4a3293d99fba | |
| cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }} | |
| context: . | |
| file: ./Dockerfile | |
| target: runtime | |
| platforms: linux/amd64 | |
| push: false # Push-by-digest is configured in the exporter; tags follow the scan. | |
| no-cache-filters: runtime-base,smoke-test,security-scan | |
| - name: Generate SBOM and enforce High/Critical vulnerability gate | |
| id: container_scan_1 | |
| uses: ./.github/actions/container-security | |
| with: | |
| image: oci-archive:${{ steps.container_security_1.outputs.archive }} | |
| platforms: "linux/amd64" | |
| report-directory: ${{ runner.temp }}/container-security/build-1 | |
| artifact-name: container-security-${{ github.job }}-${{ strategy.job-index || 0 }}-build-1 | |
| - name: Finish and enforce BuildKit storage usage | |
| if: always() | |
| # Keep failure reports; enforce sizing only after the complete build and scan. | |
| continue-on-error: ${{ steps.container_build_1.outcome != 'success' || steps.container_scan_1.outcome != 'success' }} | |
| run: ci-storage-efficiency finish | |
| - name: Upload BuildKit storage usage report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: buildkit-storage-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ strategy.job-index || 0 }} | |
| path: | | |
| ${{ runner.temp }}/ci-storage-usage-start.json | |
| ${{ runner.temp }}/ci-storage-usage.json | |
| if-no-files-found: warn | |
| retention-days: 14 |