Repository navigation
build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| schedule: | |
| - cron: '22 0 * * *' | |
| timezone: America/Detroit | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| DOCKER_BUILD_RECORD_UPLOAD: "false" | |
| jobs: | |
| docker-build: | |
| name: Build, Test and Scan | |
| runs-on: truenas-website-storage-16g | |
| timeout-minutes: 40 | |
| steps: | |
| - name: Start BuildKit storage collection | |
| run: ci-storage-efficiency start | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - name: Test deployment CI identity and transient retry guard | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { execFileSync } = require('node:child_process'); | |
| execFileSync(process.execPath, ['--test', '.github/scripts/wait-for-daily-ci.test.cjs'], { stdio: 'inherit' }); | |
| - name: Log in to Docker Hub | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Set up authenticated remote BuildKit | |
| uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| with: | |
| cache-binary: false | |
| driver: remote | |
| endpoint: tcp://buildkit:1234 | |
| driver-opts: | | |
| cacert=/run/buildkit/tls/ca.pem | |
| cert=/run/buildkit/tls/client.pem | |
| key=/run/buildkit/tls/client.key | |
| - name: Prepare disk build cache | |
| id: ci_disk_cache_1 | |
| run: ci-cache "truenas-15ed4a3293d99fba" | |
| - name: Prepare immutable image and release tags | |
| id: container_security_1 | |
| shell: bash | |
| env: | |
| SECURITY_PUBLISH: "false" | |
| SECURITY_RELEASE_TAGS: | | |
| SECURITY_REPORT_DIRECTORY: ${{ runner.temp }}/container-security/build-1 | |
| run: bash .github/actions/container-security/container-security.sh prepare | |
| - name: Test Backend, Verify Linked Runtime and Scan Vulnerabilities | |
| id: container_build_1 | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| env: | |
| DOCKER_BUILD_RECORD_RETENTION_DAYS: "1" | |
| with: | |
| outputs: ${{ steps.container_security_1.outputs.exporter }} | |
| cache-from: | | |
| type=local,src=${{ steps.ci_disk_cache_1.outputs.from }} | |
| cache-to: ${{ steps.ci_disk_cache_1.outputs.to && format('type=local,dest={0},mode=max,ignore-error=true', steps.ci_disk_cache_1.outputs.to) || '' }} | |
| context: . | |
| file: ./Dockerfile | |
| target: runtime | |
| platforms: linux/amd64 | |
| push: false # Push-by-digest is configured in the exporter; tags follow the scan. | |
| no-cache-filters: backend-check,runtime-base,smoke-test,security-scan | |
| - name: Generate SBOM and enforce High/Critical vulnerability gate | |
| id: container_scan_1 | |
| uses: ./.github/actions/container-security | |
| with: | |
| image: oci-archive:${{ steps.container_security_1.outputs.archive }} | |
| platforms: "linux/amd64" | |
| report-directory: ${{ runner.temp }}/container-security/build-1 | |
| artifact-name: container-security-${{ github.job }}-${{ strategy.job-index || 0 }}-build-1 | |
| - name: Finish and enforce BuildKit storage usage | |
| if: always() | |
| # Keep failure reports; enforce sizing only after the complete build and scan. | |
| continue-on-error: ${{ steps.container_build_1.outcome != 'success' || steps.container_scan_1.outcome != 'success' }} | |
| run: ci-storage-efficiency finish | |
| - name: Format bounded plaintext storage diagnostics | |
| id: storage_log | |
| if: always() | |
| run: | | |
| python3 .github/scripts/format-storage-evidence.py \ | |
| --output "$RUNNER_TEMP/ci-storage-evidence.log" \ | |
| --repository "$GITHUB_REPOSITORY" --revision "$GITHUB_SHA" \ | |
| --usage-input "$RUNNER_TEMP/ci-storage-usage-start.json" \ | |
| --usage-input "$RUNNER_TEMP/ci-storage-usage.json" | |
| - name: Upload bounded storage diagnostics | |
| if: ${{ always() && steps.storage_log.outputs.available == 'true' }} | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: ci-log-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ strategy.job-index || 0 }} | |
| path: ${{ runner.temp }}/ci-storage-evidence.log | |
| if-no-files-found: error | |
| retention-days: 1 | |
| cleanup-artifacts: | |
| name: Remove transient build artifacts | |
| needs: ["docker-build"] | |
| if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} | |
| runs-on: truenas-website-storage-8g | |
| timeout-minutes: 10 | |
| permissions: | |
| actions: write | |
| contents: read | |
| steps: | |
| - name: Check out trusted default branch cleanup code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| persist-credentials: false | |
| - name: Set up Python for bounded cleanup | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.13' | |
| - name: Delete non-retained current-run artifacts | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: python3 .github/scripts/cleanup-actions-artifacts.py --current | |