ci: bump actions/checkout from 4.4.0 to 7.0.1 #286
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## | |
| # Baseline CI — known-good reference point. | |
| # | |
| # Builds the Docker image straight from the upstream source (unchanged) and | |
| # proves the resulting container boots and serves. This is intentionally | |
| # minimal: it does NOT push to any registry. Publishing a signed image, SBOM | |
| # and vulnerability scanning are a later increment (see README roadmap). | |
| # | |
| # The fast gate on PRs and non-main branches: build the image, run the smoke | |
| # test (health endpoints + a real ffsend upload/download round-trip), and | |
| # report a vulnerability scan. Publishing signed images lives in publish.yml. | |
| ## | |
| name: ci-build | |
| on: | |
| push: | |
| branches-ignore: [main] # main is covered by publish.yml (build + smoke + publish) | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-build-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Lint, backend and frontend suites live in tests.yml so publish.yml can | |
| # require the same jobs before it signs anything. | |
| tests: | |
| uses: ./.github/workflows/tests.yml | |
| build-and-smoke: | |
| name: Build image + smoke test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Build image (linux/amd64) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| tags: send:ci | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Set up Playwright (chromium) | |
| run: | | |
| npm i --no-save playwright@1.48.2 | |
| npx playwright install --with-deps chromium | |
| - name: Smoke test (health + E2EE round-trip + browser render) | |
| run: bash .github/scripts/smoke.sh | |
| # Gates on PRs too, deliberately. Gating only at publish would mean | |
| # finding out after a merge, with main red. The cost is that a newly | |
| # disclosed CVE can block an unrelated PR, which is the correct signal: | |
| # that code should not ship either. --ignore-unfixed keeps it to | |
| # findings someone can actually act on. | |
| - name: Trivy vulnerability scan (gate) | |
| run: | | |
| set -euo pipefail | |
| # Scan a saved tarball, not the live daemon. The old form mounted | |
| # /var/run/docker.sock into aquasec/trivy:latest, which is an | |
| # unpinned third-party image given root-equivalent control of the | |
| # runner one step after it logged in to GHCR. --input needs neither | |
| # the socket nor a registry pull. Trivy is pinned by digest (0.58.0) | |
| # for the same reason the socket is gone: nothing unaudited runs here. | |
| docker save send:ci -o /tmp/send-ci-image.tar | |
| docker run --rm \ | |
| -v /tmp/send-ci-image.tar:/scan/image.tar:ro \ | |
| aquasec/trivy@sha256:b88012e2a0a309d6a8a00463d4e63e5e513377fb74eccbc8f9b0f8f81940ebeb \ | |
| image \ | |
| --scanners vuln --ignore-unfixed --no-progress \ | |
| --severity HIGH,CRITICAL --exit-code 1 \ | |
| --input /scan/image.tar | tee trivy-report.txt | |
| - name: Upload Trivy report | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: trivy-report | |
| path: trivy-report.txt | |
| if-no-files-found: warn | |
| - name: Dump container logs on failure | |
| if: failure() | |
| run: | | |
| echo "=== send logs ==="; docker logs send || true | |
| echo "=== redis logs ==="; docker logs redis || true |