mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 07:41:27 +00:00
ci: build images on every change, add install script
- docker job: buildx + GHA cache, GHCR push on main/tags via metadata-action tags, Trivy scan (report-only) - fix: tag pushes now trigger the workflow so releases publish images - root compose: parameterized host ports, backend healthcheck, frontend waits for healthy backend - install.sh: generates .env secrets, builds, boots, waits for health - README: easy-install section, port remap docs, CI badge Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Tomas DvorakandDevin committed
1 parent
8bf73e910a
commit
c07ae2bef6
5 files changed
+208
-22
No files matched your search
+92
-14
@@ -5,6 +5,16 @@ on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
tags:
|
||||
- "v*"
|
||||
workflow_dispatch:
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
infra:
|
||||
@@ -20,10 +30,17 @@ jobs:
|
||||
- name: Validate Docker Compose with .env.example
|
||||
run: docker compose -f infra/docker-compose.yml --env-file .env.example config -q
|
||||
|
||||
- name: Validate root Docker Compose config
|
||||
run: docker compose -f docker-compose.yml config -q
|
||||
|
||||
- name: Validate root Docker Compose with .env.example
|
||||
run: docker compose -f docker-compose.yml --env-file .env.example config -q
|
||||
|
||||
- name: Validate startup scripts
|
||||
run: |
|
||||
bash -n start-unified.sh
|
||||
bash -n start.sh
|
||||
bash -n install.sh
|
||||
|
||||
- name: Run startup preflight tests
|
||||
run: bash scripts/test-start-unified-preflight.sh
|
||||
@@ -44,6 +61,9 @@ jobs:
|
||||
go-version-file: app/backend/go.mod
|
||||
cache: true
|
||||
|
||||
- name: Vet
|
||||
run: go vet ./...
|
||||
|
||||
- name: Run backend tests
|
||||
run: go test ./...
|
||||
|
||||
@@ -86,13 +106,14 @@ jobs:
|
||||
|
||||
- name: Boot stack
|
||||
run: |
|
||||
export BETTER_AUTH_SECRET=$(openssl rand -hex 32)
|
||||
export BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
|
||||
BETTER_AUTH_SECRET=$(openssl rand -hex 32)
|
||||
BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
|
||||
export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
|
||||
docker compose -f infra/docker-compose.yml up -d --build postgres redis backend frontend traefik
|
||||
|
||||
- name: Wait for backend health
|
||||
run: |
|
||||
for i in $(seq 1 60); do
|
||||
for _ in $(seq 1 60); do
|
||||
if curl -sf http://localhost:8082/health; then exit 0; fi
|
||||
sleep 5
|
||||
done
|
||||
@@ -101,7 +122,7 @@ jobs:
|
||||
|
||||
- name: Check frontend responds
|
||||
run: |
|
||||
for i in $(seq 1 30); do
|
||||
for _ in $(seq 1 30); do
|
||||
if curl -sf http://localhost:3000/ -o /dev/null; then exit 0; fi
|
||||
sleep 2
|
||||
done
|
||||
@@ -112,35 +133,92 @@ jobs:
|
||||
if: always()
|
||||
run: docker compose -f infra/docker-compose.yml down -v
|
||||
|
||||
images:
|
||||
name: Publish images to GHCR
|
||||
docker:
|
||||
name: Build & publish images
|
||||
runs-on: ubuntu-latest
|
||||
needs: [backend, frontend, smoke]
|
||||
if: startsWith(github.ref, 'refs/tags/v')
|
||||
permissions:
|
||||
packages: write
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Login to GHCR
|
||||
if: github.event_name != 'pull_request'
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Build and push backend
|
||||
- name: Backend image metadata
|
||||
id: meta-backend
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ghcr.io/${{ github.repository }}-backend
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=pr
|
||||
type=ref,event=tag
|
||||
type=semver,pattern={{version}}
|
||||
type=sha,format=short
|
||||
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
|
||||
|
||||
- name: Frontend image metadata
|
||||
id: meta-frontend
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ghcr.io/${{ github.repository }}-frontend
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=ref,event=pr
|
||||
type=ref,event=tag
|
||||
type=semver,pattern={{version}}
|
||||
type=sha,format=short
|
||||
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
|
||||
|
||||
- name: Build backend image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: app/backend
|
||||
push: true
|
||||
tags: ghcr.io/${{ github.repository }}-backend:${{ github.ref_name }},ghcr.io/${{ github.repository }}-backend:latest
|
||||
load: true
|
||||
push: ${{ github.event_name != 'pull_request' }}
|
||||
tags: ${{ steps.meta-backend.outputs.tags }}
|
||||
labels: ${{ steps.meta-backend.outputs.labels }}
|
||||
cache-from: type=gha,scope=backend
|
||||
cache-to: type=gha,mode=max,scope=backend
|
||||
|
||||
- name: Build and push frontend
|
||||
- name: Build frontend image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: app/frontend
|
||||
push: true
|
||||
tags: ghcr.io/${{ github.repository }}-frontend:${{ github.ref_name }},ghcr.io/${{ github.repository }}-frontend:latest
|
||||
load: true
|
||||
push: ${{ github.event_name != 'pull_request' }}
|
||||
tags: ${{ steps.meta-frontend.outputs.tags }}
|
||||
labels: ${{ steps.meta-frontend.outputs.labels }}
|
||||
cache-from: type=gha,scope=frontend
|
||||
cache-to: type=gha,mode=max,scope=frontend
|
||||
|
||||
- name: Scan backend image
|
||||
uses: aquasecurity/[email protected]
|
||||
with:
|
||||
image-ref: ${{ fromJSON(steps.meta-backend.outputs.json).tags[0] }}
|
||||
format: table
|
||||
exit-code: "0"
|
||||
ignore-unfixed: true
|
||||
vuln-type: os,library
|
||||
severity: CRITICAL,HIGH
|
||||
|
||||
- name: Scan frontend image
|
||||
uses: aquasecurity/[email protected]
|
||||
with:
|
||||
image-ref: ${{ fromJSON(steps.meta-frontend.outputs.json).tags[0] }}
|
||||
format: table
|
||||
exit-code: "0"
|
||||
ignore-unfixed: true
|
||||
vuln-type: os,library
|
||||
severity: CRITICAL,HIGH
|
||||
Reference in new issue
Block a user