steveandClaude Opus 4.8
c59688c2a3
Build image / build-and-push (push) Successful in 1m3s
Workflow:
- Pass untrusted github.ref_name/repository/sha/token via env instead of
inline ${{ }} in run: blocks, closing a branch-name shell-injection vector.
- Check out the exact triggering commit (fetch by SHA, branch fallback) so
the sha-<short> tag matches what was built.
- Guard the tag scheme: a non-main branch named/sanitized to "latest" can't
clobber :latest, and an empty sanitized name falls back to branch-<sha>.
- Build --tag flags as a bash array (no word-splitting), drop the
comma-string round-trip, and check-then-create the buildx builder so a
real failure isn't swallowed.
Dockerfile:
- GOWORK=off in the build stage (matches the Makefile convention).
- npm ci uses a BuildKit cache mount.
- Drop the stale issue-number reference in a comment.
.dockerignore:
- Add .env/.env.*, go.work/go.work.sum, web/.vite; drop nonexistent .github.
Graded all findings in the gadfly store. Deferred/keep-as-is: token-in-clone-URL
(Gitea masks the secret in logs), sanitization collisions across branch names
(the sha-<short> tag is the collision-proof identifier), and registry build
cache (current builds are fast). False positives: alpine ships wget (busybox);
docker login is its own step.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
88 lines
3.4 KiB
YAML
88 lines
3.4 KiB
YAML
name: Build image
|
|
|
|
# Build the single-binary image and push it to the Gitea container registry so
|
|
# it can be deployed with Komodo. Tagging (see README for the canonical table):
|
|
# * main -> :latest
|
|
# * any other branch -> :<branch-name> (sanitized to valid Docker tag chars)
|
|
# * every build also -> :sha-<short> (immutable, handy for pinning)
|
|
#
|
|
# Runs on every branch push (so branch images are always available) and can be
|
|
# triggered manually. A push to a PR branch covers the PR too, so there is no
|
|
# separate pull_request trigger (avoids double builds).
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: build-image-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
# Untrusted values (branch name) go through env, never inline ${{ }}, so a
|
|
# crafted branch name can't inject shell. Check out the exact triggering
|
|
# commit so the sha-<short> tag matches the code that was built.
|
|
env:
|
|
REPO: ${{ github.repository }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
SHA: ${{ github.sha }}
|
|
GIT_TOKEN: ${{ github.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "https://token:${GIT_TOKEN}@gitea.stevedudenhoeffer.com/${REPO}.git"
|
|
git fetch -q --depth=1 origin "$SHA" || git fetch -q --depth=1 origin "$REF_NAME"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Set up Docker Buildx
|
|
# Check first so a genuine create failure surfaces (rather than being
|
|
# hidden behind a swallowed "already exists").
|
|
run: |
|
|
docker buildx inspect pansy-builder >/dev/null 2>&1 \
|
|
|| docker buildx create --name pansy-builder --driver docker-container
|
|
docker buildx use pansy-builder
|
|
|
|
- name: Log in to Gitea registry
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
- name: Build and push (linux/amd64)
|
|
env:
|
|
REF_NAME: ${{ github.ref_name }}
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
SHA_SHORT=$(echo "$SHA" | cut -c1-7)
|
|
|
|
if [ "$REF_NAME" = "main" ]; then
|
|
PRIMARY="latest"
|
|
else
|
|
# Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
|
|
PRIMARY=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^[-.]*//; s/-*$//')
|
|
# A non-main branch must never clobber :latest, and the tag can't be empty.
|
|
[ "$PRIMARY" = "latest" ] && PRIMARY="branch-latest"
|
|
[ -z "$PRIMARY" ] && PRIMARY="branch-${SHA_SHORT}"
|
|
fi
|
|
|
|
# Build the tag flags as an array so no word-splitting/quoting surprises.
|
|
TAGS=(--tag "${IMAGE_NAME}:${PRIMARY}" --tag "${IMAGE_NAME}:sha-${SHA_SHORT}")
|
|
echo "Building ${IMAGE_NAME}:${PRIMARY} and ${IMAGE_NAME}:sha-${SHA_SHORT}"
|
|
|
|
docker buildx build \
|
|
--push \
|
|
--platform linux/amd64 \
|
|
"${TAGS[@]}" \
|
|
--build-arg "BUILD_COMMIT=${SHA}" \
|
|
--build-arg "BUILD_BRANCH=${REF_NAME}" \
|
|
--build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
|
|
--file ./Dockerfile \
|
|
.
|