Repository navigation
ci: retain Actions artifacts for one day #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| schedule: | |
| - cron: '22 0 * * *' | |
| timezone: America/Detroit | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker-build: | |
| name: Build, Test and Scan | |
| runs-on: truenas-website-storage-16g | |
| timeout-minutes: 40 | |
| steps: | |
| - name: Start BuildKit storage collection | |
| run: ci-storage-efficiency start | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - name: Test deployment CI identity and transient retry guard | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { execFileSync } = require('node:child_process'); | |
| execFileSync(process.execPath, ['--test', '.github/scripts/wait-for-daily-ci.test.cjs'], { stdio: 'inherit' }); | |
| - name: Log in to Docker Hub | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Set up authenticated remote BuildKit | |
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| with: | |
| driver: remote | |
| endpoint: tcp://buildkit:1234 | |
| driver-opts: | | |
| cacert=/run/buildkit/tls/ca.pem | |
| cert=/run/buildkit/tls/client.pem | |
| key=/run/buildkit/tls/client.key | |
| - name: Prepare disk build cache | |
| id: ci_disk_cache_1 | |
| run: ci-cache "truenas-15ed4a3293d99fba" | |
| - name: Prepare immutable image and release tags | |
| id: container_security_1 | |
| shell: bash | |
| env: | |
| SECURITY_PUBLISH: "false" | |
| SECURITY_RELEASE_TAGS: | | |
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | |
| run: bash .github/actions/container-security/container-security.sh prepare | |
| - name: Test Backend, Verify Linked Runtime and Scan Vulnerabilities | |
| id: container_build_1 | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| env: | |
| DOCKER_BUILD_RECORD_RETENTION_DAYS: "1" | |
| with: | |
| outputs: ${{ steps.container_security_1.outputs.exporter }} | |
| cache-from: | | |
| type=local,src=${{ steps.ci_disk_cache_1.outputs.from }} | |
| type=gha,version=2,scope=truenas-15ed4a3293d99fba | |
| cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }} | |
| context: . | |
| file: ./Dockerfile | |
| target: runtime | |
| platforms: linux/amd64 | |
| push: false # Push-by-digest is configured in the exporter; tags follow the scan. | |
| no-cache-filters: backend-check,runtime-base,smoke-test,security-scan | |
| - name: Generate SBOM and enforce High/Critical vulnerability gate | |
| id: container_scan_1 | |
| uses: ./.github/actions/container-security | |
| with: | |
| image: oci-archive:${{ steps.container_security_1.outputs.archive }} | |
| platforms: "linux/amd64" | |
| report-directory: ${{ runner.temp }}/container-security/build-1 | |
| artifact-name: container-security-${{ github.job }}-${{ strategy.job-index || 0 }}-build-1 | |
| - name: Finish and enforce BuildKit storage usage | |
| if: always() | |
| # Keep failure reports; enforce sizing only after the complete build and scan. | |
| continue-on-error: ${{ steps.container_build_1.outcome != 'success' || steps.container_scan_1.outcome != 'success' }} | |
| run: ci-storage-efficiency finish | |
| - name: Upload BuildKit storage usage report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: buildkit-storage-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ strategy.job-index || 0 }} | |
| path: | | |
| ${{ runner.temp }}/ci-storage-usage-start.json | |
| ${{ runner.temp }}/ci-storage-usage.json | |
| if-no-files-found: warn | |
| retention-days: 1 |