Archived
austinandClaude Opus 4.8
166222cd67
build-and-publish / build (pull_request) Successful in 1m53s
Run the workflow on pull_request too, so tests + build + Trivy must pass before main can be merged (branch protection requires this check). Push the image only on a real push to main — never from a PR. Also standardises the workflow across all apps (three had drifted). Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01XXKjx7FNyRVAjU8dgB5KhN
73 lines
3.5 KiB
YAML
73 lines
3.5 KiB
YAML
name: build-and-publish
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
# Files that can't change the image — skip a pointless rebuild + redeploy for a docs/config commit.
|
|
paths-ignore: ["renovate.json", "**.md"]
|
|
# Runs on PRs too so the check below gates the MERGE, not just the image. Branch protection requires it.
|
|
pull_request:
|
|
branches: [main]
|
|
# Lets rebuild-all-apps.sh force a rebuild to roll out an urgent platform fix immediately.
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Tests gate the build AND the merge. They can't run inside `docker build` — Testcontainers needs a
|
|
# Docker daemon and a build has none — so Maven runs as a sibling container, mounting the workspace
|
|
# volume act_runner gave this job (matched on GITHUB_WORKSPACE, since it's mounted at the full repo
|
|
# path, not /workspace) and sharing the host network so published test ports resolve as localhost.
|
|
- name: Test
|
|
run: |
|
|
set -euo pipefail
|
|
VOL=$(docker inspect "$(hostname)" \
|
|
--format "{{range .Mounts}}{{if eq .Destination \"$GITHUB_WORKSPACE\"}}{{.Name}}{{end}}{{end}}")
|
|
if [ -z "$VOL" ]; then
|
|
echo "could not find this job's workspace volume — refusing to skip the tests" >&2
|
|
exit 1
|
|
fi
|
|
docker run --rm --network host \
|
|
-v "$VOL":/w \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-e TESTCONTAINERS_RYUK_DISABLED=true \
|
|
-e MAVEN_USER="${{ secrets.REGISTRY_USER }}" \
|
|
-e MAVEN_TOKEN="${{ secrets.REGISTRY_TOKEN }}" \
|
|
-w /w \
|
|
maven:3.9-eclipse-temurin-25 \
|
|
mvn -B -ntp -s .gitea/ci-settings.xml -DskipFrontend=true verify
|
|
|
|
# Build + Trivy on every run (PRs included), so a broken Dockerfile or a new HIGH/CRITICAL CVE
|
|
# blocks the merge. Only the push is main-only.
|
|
- name: Build image
|
|
env:
|
|
DOCKER_BUILDKIT: "1"
|
|
MAVEN_USER: ${{ secrets.REGISTRY_USER }}
|
|
MAVEN_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
docker build \
|
|
--secret id=maven_user,env=MAVEN_USER \
|
|
--secret id=maven_token,env=MAVEN_TOKEN \
|
|
--build-arg GIT_SHA=${{ github.sha }} \
|
|
-t git.thebennett.net/reformedwitness/confessions-of-grace:latest -t git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }} .
|
|
|
|
- name: Scan image (Trivy)
|
|
run: |
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --no-progress \
|
|
git.thebennett.net/reformedwitness/confessions-of-grace:latest || true
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed \
|
|
--pkg-types library --exit-code 1 --no-progress \
|
|
git.thebennett.net/reformedwitness/confessions-of-grace:latest
|
|
|
|
# Publish only on a real push to main (or manual dispatch) — never from a pull request.
|
|
- name: Push image
|
|
if: github.event_name != 'pull_request'
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thebennett.net -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
docker push git.thebennett.net/reformedwitness/confessions-of-grace:latest
|
|
docker push git.thebennett.net/reformedwitness/confessions-of-grace:${{ github.sha }}
|