mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-10 14:20:56 +00:00
Maurice
61378559ca
- sharp 0.35.5 (librsvg CVE), with the musl pins that ship in the image. - follow-redirects 1.16.2, postcss-selector-parser 6.1.5 and serialize-javascript 7.1.3, from the open advisories. - GitHub Actions: github-script 9 and the minor-and-patch group. - plugin-sdk: @types/update-notifier 6.0.9. The grouped npm update is left out: with it the server build runs out of memory in tsc, and the culprit is not found yet.
466 lines
20 KiB
YAML
466 lines
20 KiB
YAML
name: Build & Push Docker Image
|
|
|
|
# The stable release. Dispatched by hand on main, it:
|
|
# 1. refuses to run unless ci-ok passed on the main commit it releases,
|
|
# 2. works out the version from the tags and the bump input,
|
|
# 3. asks the TREK services issuer for the registration dialect of that
|
|
# version and checks it, in a job without write access
|
|
# (registration-dialect.yml); without one the release ships the dialect
|
|
# already on main, but only while that one still has 90 days to run,
|
|
# 4. commits the bump to package.json, the lockfile, Chart.yaml and the
|
|
# dialect, tags it and pushes,
|
|
# 5. builds both platforms from exactly that bump commit (never from
|
|
# whatever main points to by then) and publishes :VERSION,
|
|
# :MAJOR.MINOR, :MAJOR and :latest,
|
|
# 6. publishes the Helm chart from the same commit.
|
|
#
|
|
# Big or risky changes go out as a prerelease first (docker-dev.yml, tagged
|
|
# :latest-pre and :<next>-pre.N); bump=auto here then finalizes that line.
|
|
# Without a prerelease in flight there is no default: the run stops until
|
|
# someone picks patch, minor or major.
|
|
#
|
|
# Each stable release registers new installations in a dialect of its own,
|
|
# which the issuer accepts for 180 days, and for as long as it is the newest
|
|
# release's; renewing a key needs none. dev gets the module when main is merged
|
|
# back into dev after the release; a prerelease asks the issuer for one of its
|
|
# own (docker-dev.yml). The issuer's side, and what to set up before the first
|
|
# release with a dialect, is in the operations guide of the TREK services.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
bump:
|
|
description: 'auto finalizes the prerelease in flight; otherwise pick patch, minor or major'
|
|
type: choice
|
|
options: [auto, patch, minor, major]
|
|
default: auto
|
|
confirm_major:
|
|
description: "Type MAJOR (all caps) to confirm a major release"
|
|
type: string
|
|
default: ''
|
|
ci_from:
|
|
description: 'Take ci-ok from this earlier commit instead of the one on main, when main differs from it only under .github/ (a fix to a release workflow needs no second test run)'
|
|
type: string
|
|
default: ''
|
|
allow_stale_dialect:
|
|
description: 'Ship without a dialect of its own even if the one on main is the original one or has under 90 days left'
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: write
|
|
checks: read
|
|
|
|
concurrency:
|
|
group: stable-build
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
version:
|
|
if: github.repository == 'liketrek/TREK'
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
checks: read
|
|
outputs:
|
|
version: ${{ steps.bump.outputs.VERSION }}
|
|
base: ${{ steps.base.outputs.SHA }}
|
|
steps:
|
|
- name: Release from main only
|
|
if: github.ref != 'refs/heads/main'
|
|
run: |
|
|
echo "::error::Dispatch this workflow on main, not on $GITHUB_REF."
|
|
exit 1
|
|
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
persist-credentials: false
|
|
|
|
# The bump job checks out exactly this commit, so what ci-ok was checked
|
|
# on is what gets released, however long the dialect takes.
|
|
- name: Note the commit being released
|
|
id: base
|
|
run: echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
# The dev push, the main push and any manual run each leave a ci-ok on
|
|
# this commit. scripts/ci/ci-ok-verdict.mjs counts the newest attempt of
|
|
# each, refuses while one is still going, and requires the one that
|
|
# finished last to be green, so a later green run supersedes a flaky or
|
|
# cancelled one. It prints the link of every run it counted.
|
|
- name: Require a green ci-ok on the commit being released
|
|
if: inputs.ci_from == ''
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
sha="$(git rev-parse HEAD)"
|
|
runs="$RUNNER_TEMP/ci-ok-runs.json"
|
|
gh api "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?check_name=ci-ok&filter=all&per_page=100" > "$runs"
|
|
node scripts/ci/ci-ok-verdict.mjs "$runs" "$sha"
|
|
|
|
# ci_from: main carries only workflow changes on top of a commit that
|
|
# already passed. That commit must be an ancestor of main, everything
|
|
# outside .github/ must be identical, and one of its ci-ok runs must be
|
|
# green (its dev push, typically).
|
|
- name: Require a green ci-ok on the commit main's code comes from
|
|
if: inputs.ci_from != ''
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
CI_FROM: ${{ inputs.ci_from }}
|
|
run: |
|
|
set -euo pipefail
|
|
from="$(git rev-parse --verify "$CI_FROM^{commit}")"
|
|
if ! git merge-base --is-ancestor "$from" HEAD; then
|
|
echo "::error::$from is not an ancestor of main."
|
|
exit 1
|
|
fi
|
|
outside="$(git diff --name-only "$from" HEAD -- . ':(exclude).github/**')"
|
|
if [ -n "$outside" ]; then
|
|
echo "::error::main differs from $from outside .github/:"
|
|
echo "$outside"
|
|
exit 1
|
|
fi
|
|
green="$(gh api "repos/$GITHUB_REPOSITORY/commits/$from/check-runs?check_name=ci-ok&filter=all&per_page=100" \
|
|
--jq '[.check_runs[] | select(.status == "completed" and .conclusion == "success")] | length')"
|
|
if [ "$green" -lt 1 ]; then
|
|
echo "::error::$from has no green ci-ok."
|
|
exit 1
|
|
fi
|
|
echo "main differs from $from only under .github/, and $from has $green green ci-ok run(s)."
|
|
|
|
- name: Determine bump type and version
|
|
id: bump
|
|
env:
|
|
BUMP_INPUT: ${{ inputs.bump || 'auto' }}
|
|
CONFIRM_MAJOR: ${{ inputs.confirm_major }}
|
|
run: |
|
|
set -eu
|
|
|
|
# Derive version from git tags, no package.json dependency
|
|
STABLE_TAG=$(git tag -l 'v[0-9]*.[0-9]*.[0-9]*' | grep -v '\-pre\.' | sort -V | tail -1)
|
|
STABLE="${STABLE_TAG#v}"
|
|
STABLE="${STABLE:-0.0.0}"
|
|
|
|
PRE_TAG=$(git tag -l 'v*-pre.*' | sort -V | tail -1)
|
|
|
|
IFS='.' read -r MAJOR MINOR PATCH <<< "$STABLE"
|
|
|
|
if [ "$BUMP_INPUT" = "major" ]; then
|
|
if [ "$CONFIRM_MAJOR" != "MAJOR" ]; then
|
|
echo "::error::confirm_major must equal 'MAJOR' to cut a major release"
|
|
exit 1
|
|
fi
|
|
NEW_VERSION="$((MAJOR + 1)).0.0"
|
|
BUMP="major"
|
|
elif [ "$BUMP_INPUT" = "minor" ]; then
|
|
NEW_VERSION="${MAJOR}.$((MINOR + 1)).0"
|
|
BUMP="minor"
|
|
elif [ "$BUMP_INPUT" = "patch" ]; then
|
|
NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
|
|
BUMP="patch"
|
|
else
|
|
# auto finalizes the in-flight prerelease and nothing else. It used
|
|
# to fall back to a patch, which would have shipped any change,
|
|
# however big, as a patch nobody chose.
|
|
PRE_BASE=""
|
|
if [ -n "$PRE_TAG" ]; then
|
|
PRE_BASE="${PRE_TAG#v}"
|
|
PRE_BASE="${PRE_BASE%-pre.*}"
|
|
fi
|
|
HIGHEST=$(printf '%s\n' "$PRE_BASE" "$STABLE" | sort -V | tail -1)
|
|
if [ -z "$PRE_BASE" ] || [ "$HIGHEST" != "$PRE_BASE" ] || [ "$PRE_BASE" = "$STABLE" ]; then
|
|
echo "::error::No prerelease above $STABLE is in flight, so bump=auto has nothing to finalize. Dispatch again with bump=patch, minor or major."
|
|
exit 1
|
|
fi
|
|
PRE_MAJOR="$(echo "$PRE_BASE" | cut -d. -f1)"
|
|
# Refuse to auto-finalize a major bump, it would bypass confirm_major
|
|
if [ "$PRE_MAJOR" -gt "$MAJOR" ]; then
|
|
echo "::error::In-flight prerelease $PRE_TAG is a major bump ($STABLE to $PRE_BASE). Use bump=major with confirm_major=MAJOR to finalize."
|
|
exit 1
|
|
fi
|
|
NEW_VERSION="$PRE_BASE"
|
|
BUMP="finalize"
|
|
fi
|
|
|
|
# Patch releases have carried migrations before, so this only warns:
|
|
# whoever pinned :MAJOR.MINOR gets this schema change too.
|
|
if [ "$BUMP" = "patch" ] && [ -n "$STABLE_TAG" ] \
|
|
&& [ -n "$(git diff --name-only --diff-filter=A "$STABLE_TAG" HEAD -- server/src/db/migrations/)" ]; then
|
|
echo "::warning::$NEW_VERSION is a patch release that adds database migrations."
|
|
fi
|
|
|
|
echo "Bump type: $BUMP"
|
|
echo "VERSION=$NEW_VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "$STABLE to $NEW_VERSION ($BUMP)"
|
|
|
|
# The registration dialect of this version, fetched and checked in a job
|
|
# without write access. It never fails; without an artifact from it the
|
|
# bump decides below whether the dialect on main may ship.
|
|
dialect:
|
|
needs: version
|
|
uses: ./.github/workflows/registration-dialect.yml
|
|
with:
|
|
version: ${{ needs.version.outputs.version }}
|
|
ref: ${{ needs.version.outputs.base }}
|
|
secrets:
|
|
TREK_DIALECT_TOKEN: ${{ secrets.TREK_DIALECT_TOKEN }}
|
|
|
|
# Runs whatever became of the dialect job, a timeout or a lost runner
|
|
# included: no artifact means the dialect on main, if it may still ship.
|
|
version-bump:
|
|
needs: [version, dialect]
|
|
if: ${{ !cancelled() && needs.version.result == 'success' }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 120
|
|
outputs:
|
|
sha: ${{ steps.commit.outputs.SHA }}
|
|
steps:
|
|
- uses: actions/create-github-app-token@v3
|
|
id: app-token
|
|
with:
|
|
app-id: ${{ secrets.RELEASE_APP_ID }}
|
|
private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
|
|
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ needs.version.outputs.base }}
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
|
|
- name: Take over the checked dialect
|
|
id: take
|
|
uses: actions/download-artifact@v7
|
|
continue-on-error: true
|
|
with:
|
|
name: registration-dialect
|
|
path: ${{ runner.temp }}/dialect
|
|
|
|
# Without a dialect of its own the release ships the one on main, but
|
|
# only while the issuer takes new registrations in it for 90 more days:
|
|
# dialect 0 closes on the issuer's transition date, and a dialect with
|
|
# little left would shut out new installations of this release soon after
|
|
# it is out. Then this stops before anything is committed, unless
|
|
# allow_stale_dialect says to ship anyway. The issuer keeps the newest
|
|
# release's dialect open past its date, so the date here is the least it
|
|
# has, not the most.
|
|
- name: Place the dialect
|
|
env:
|
|
VERSION: ${{ needs.version.outputs.version }}
|
|
TAKEN: ${{ steps.take.outcome }}
|
|
ALLOW_STALE: ${{ inputs.allow_stale_dialect }}
|
|
run: |
|
|
set -u
|
|
target=server/src/nest/service-identity/registration-dialect.ts
|
|
fetched="$RUNNER_TEMP/dialect/registration-dialect.ts"
|
|
dialect_id() { sed -n "s/^const DIALECT = '\(.*\)';$/\1/p" "$1"; }
|
|
report() {
|
|
echo "$2$1"
|
|
printf '### Registration dialect\n%s\n' "$1" >> "$GITHUB_STEP_SUMMARY"
|
|
}
|
|
if [ "$TAKEN" = success ] && [ -f "$fetched" ]; then
|
|
cp "$fetched" "$target"
|
|
report "$VERSION registers in dialect $(dialect_id "$target"), written by the issuer for it." ""
|
|
exit 0
|
|
fi
|
|
id="$(dialect_id "$target")"
|
|
created="$(sed -n "s/^ createdAt: '\(.*\)',$/\1/p" "$target")"
|
|
left=""
|
|
if [ -n "$id" ] && [ "$id" != 0 ] && made="$(date -u -d "$created" +%s 2>/dev/null)"; then
|
|
left=$(( (made + 180 * 86400 - $(date -u +%s)) / 86400 ))
|
|
fi
|
|
if [ -n "$left" ] && [ "$left" -ge 90 ]; then
|
|
report "$VERSION ships without a dialect of its own and registers in dialect $id from $created, which the issuer takes for new installations for $left more days at least. Its operator can write one by hand for the next patch." "::warning::"
|
|
exit 0
|
|
fi
|
|
if [ "$id" = 0 ]; then
|
|
what="the original registration, which the issuer accepts only until the end of its transition period"
|
|
elif [ -n "$left" ]; then
|
|
what="dialect $id from $created, which has $left days left"
|
|
else
|
|
what="a dialect whose id or date cannot be read from $target"
|
|
fi
|
|
if [ "$ALLOW_STALE" = true ]; then
|
|
report "$VERSION ships without a dialect of its own and registers in $what, as allow_stale_dialect asked." "::warning::"
|
|
exit 0
|
|
fi
|
|
report "$VERSION got no dialect of its own and would register in $what. Nothing was committed or pushed. Make sure the issuer runs with its dialect seed and release token and that TREK_DIALECT_TOKEN is set, then run the release again, or tick allow_stale_dialect to ship anyway." "::error::"
|
|
exit 1
|
|
|
|
- name: Update the version, commit, tag and push
|
|
id: commit
|
|
env:
|
|
NEW_VERSION: ${{ needs.version.outputs.version }}
|
|
run: |
|
|
set -eu
|
|
|
|
# Update all workspace + root package.json files and the root lockfile in one shot
|
|
npm version "$NEW_VERSION" --workspaces --include-workspace-root --no-git-tag-version
|
|
sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
|
|
sed -i "s/^appVersion: .*/appVersion: \"$NEW_VERSION\"/" charts/trek/Chart.yaml
|
|
|
|
# Commit and tag. The push fast-forwards main from the commit ci-ok
|
|
# was checked on, so it fails rather than release past anything that
|
|
# landed on main in the meantime.
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add package.json package-lock.json server/package.json client/package.json shared/package.json \
|
|
charts/trek/Chart.yaml server/src/nest/service-identity/registration-dialect.ts
|
|
git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
|
|
git tag -a "v$NEW_VERSION" -m "v$NEW_VERSION"
|
|
git push origin HEAD:main --follow-tags
|
|
|
|
# build, merge and release-helm check out exactly this commit.
|
|
echo "SHA=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
runs-on: ${{ matrix.runner }}
|
|
timeout-minutes: 120
|
|
needs: [version, version-bump]
|
|
# version-bump may run after a failed dialect job; that alone must not skip what follows it.
|
|
if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: linux/amd64
|
|
runner: ubuntu-24.04
|
|
- platform: linux/arm64
|
|
runner: ubuntu-24.04-arm
|
|
steps:
|
|
- name: Prepare platform tag-safe name
|
|
env:
|
|
PLATFORM: ${{ matrix.platform }}
|
|
run: echo "PLATFORM_PAIR=${PLATFORM//\//-}" >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ needs.version-bump.outputs.sha }}
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Image metadata
|
|
id: meta
|
|
run: |
|
|
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build and push by digest
|
|
id: build
|
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
platforms: ${{ matrix.platform }}
|
|
outputs: type=image,name=mauriceboe/trek,push-by-digest=true,name-canonical=true,push=true
|
|
no-cache: true
|
|
build-args: |
|
|
APP_VERSION=${{ needs.version.outputs.version }}
|
|
labels: |
|
|
org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
|
|
org.opencontainers.image.created=${{ steps.meta.outputs.created }}
|
|
|
|
- name: Export digest
|
|
run: |
|
|
mkdir -p /tmp/digests
|
|
digest="${{ steps.build.outputs.digest }}"
|
|
touch "/tmp/digests/${digest#sha256:}"
|
|
|
|
- name: Upload digest artifact
|
|
uses: actions/upload-artifact@v6
|
|
with:
|
|
name: digests-${{ env.PLATFORM_PAIR }}
|
|
path: /tmp/digests/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
merge:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 120
|
|
needs: [version, version-bump, build]
|
|
if: ${{ !cancelled() && needs.build.result == 'success' }}
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ needs.version-bump.outputs.sha }}
|
|
|
|
- name: Download build digests
|
|
uses: actions/download-artifact@v7
|
|
with:
|
|
path: /tmp/digests
|
|
pattern: digests-*
|
|
# Deliberately NOT merged: the per-platform folder names are what lets
|
|
# the manifest below be assembled in a fixed order.
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Create and push multi-arch manifest
|
|
working-directory: /tmp/digests
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${{ needs.version.outputs.version }}"
|
|
MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
|
|
# :MAJOR.MINOR takes the patches of one minor line and nothing else,
|
|
# the conservative pin for an install that wants to wait out a
|
|
# release that migrates.
|
|
MINOR_TAG="$(echo "$VERSION" | cut -d. -f1-2)"
|
|
# amd64 first, always. This used to be a glob over hash-named files, so
|
|
# the order changed from one release to the next: 3.4.1 listed amd64
|
|
# first and 4.0.0 listed arm64 first. Clients that read the first entry
|
|
# of the index rather than matching their own platform then compare the
|
|
# wrong digest and report "no update" — which is what Unraid users hit
|
|
# on :latest after 4.0.0 shipped. The image was fine; the order was not.
|
|
digests=()
|
|
for platform in linux-amd64 linux-arm64; do
|
|
dir="digests-$platform"
|
|
[ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
|
|
for f in "$dir"/*; do
|
|
[ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
|
|
digests+=("mauriceboe/trek@sha256:$(basename "$f")")
|
|
done
|
|
done
|
|
# The labels live on each platform image; the index gets the ones a
|
|
# client reads before it picks a platform (#1498).
|
|
docker buildx imagetools create \
|
|
--annotation "index:org.opencontainers.image.source=https://github.com/liketrek/TREK" \
|
|
--annotation "index:org.opencontainers.image.version=$VERSION" \
|
|
--annotation "index:org.opencontainers.image.licenses=AGPL-3.0-only" \
|
|
-t "mauriceboe/trek:latest" \
|
|
-t "mauriceboe/trek:$MAJOR_TAG" \
|
|
-t "mauriceboe/trek:$MINOR_TAG" \
|
|
-t "mauriceboe/trek:$VERSION" \
|
|
"${digests[@]}"
|
|
|
|
- name: Inspect manifest
|
|
run: docker buildx imagetools inspect mauriceboe/trek:latest
|
|
|
|
release-helm:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 120
|
|
needs: version-bump
|
|
if: ${{ !cancelled() && needs.version-bump.result == 'success' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ needs.version-bump.outputs.sha }}
|
|
|
|
- name: Publish Helm chart
|
|
uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
charts_dir: charts
|
|
charts_url: https://chart.liketrek.com
|