steveandClaude Opus 4.8
c59688c2a3
Build image / build-and-push (push) Successful in 1m3s
Workflow:
- Pass untrusted github.ref_name/repository/sha/token via env instead of
inline ${{ }} in run: blocks, closing a branch-name shell-injection vector.
- Check out the exact triggering commit (fetch by SHA, branch fallback) so
the sha-<short> tag matches what was built.
- Guard the tag scheme: a non-main branch named/sanitized to "latest" can't
clobber :latest, and an empty sanitized name falls back to branch-<sha>.
- Build --tag flags as a bash array (no word-splitting), drop the
comma-string round-trip, and check-then-create the buildx builder so a
real failure isn't swallowed.
Dockerfile:
- GOWORK=off in the build stage (matches the Makefile convention).
- npm ci uses a BuildKit cache mount.
- Drop the stale issue-number reference in a comment.
.dockerignore:
- Add .env/.env.*, go.work/go.work.sum, web/.vite; drop nonexistent .github.
Graded all findings in the gadfly store. Deferred/keep-as-is: token-in-clone-URL
(Gitea masks the secret in logs), sanitization collisions across branch names
(the sha-<short> tag is the collision-proof identifier), and registry build
cache (current builds are fast). False positives: alpine ships wget (busybox);
docker login is its own step.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
35 lines
658 B
Plaintext
35 lines
658 B
Plaintext
# VCS / editor / docs — not needed in the image build context.
|
|
.git
|
|
.gitea
|
|
.idea
|
|
.vscode
|
|
*.md
|
|
LICENSE
|
|
|
|
# Secrets and env files must never be baked into an image layer.
|
|
.env
|
|
.env.*
|
|
|
|
# Local build outputs and databases.
|
|
/pansy
|
|
*.db
|
|
*.db-wal
|
|
*.db-shm
|
|
|
|
# Go workspace files (pansy builds standalone; GOWORK=off).
|
|
go.work
|
|
go.work.sum
|
|
|
|
# Frontend deps/output are rebuilt inside the image's web stage.
|
|
web/node_modules
|
|
web/dist
|
|
web/.vite
|
|
|
|
# The embedded web build is produced fresh in the image (web stage → embed
|
|
# directory), so never ship stale local contents. dist.go itself is kept.
|
|
internal/webdist/dist
|
|
|
|
# Assorted local scratch.
|
|
.playwright-mcp
|
|
.claude
|