refactor: harden build provenance and releases #18
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "api/**" | |
| - "admin-ui/**" | |
| - "server/**" | |
| - "libs/**" | |
| - "go.mod" | |
| - "go.work" | |
| - "go.work.sum" | |
| - "docker/**" | |
| - ".dockerignore" | |
| - "Dockerfile" | |
| - "docker-compose.yml" | |
| - "docker-compose.yaml" | |
| - "compose.yml" | |
| - "compose.yaml" | |
| - ".github/workflows/**" | |
| pull_request: | |
| paths: | |
| - "api/**" | |
| - "admin-ui/**" | |
| - "server/**" | |
| - "libs/**" | |
| - "go.mod" | |
| - "go.work" | |
| - "go.work.sum" | |
| - "docker/**" | |
| - ".dockerignore" | |
| - "Dockerfile" | |
| - "docker-compose.yml" | |
| - "docker-compose.yaml" | |
| - "compose.yml" | |
| - "compose.yaml" | |
| - ".github/workflows/**" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| go: | |
| name: Go checks | |
| runs-on: ubuntu-24.04 | |
| defaults: | |
| run: | |
| working-directory: api | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: api/go.mod | |
| cache: true | |
| cache-dependency-path: | | |
| api/go.sum | |
| go.work.sum | |
| - run: go test ./... | |
| - run: go vet ./... | |
| - run: go build -o /tmp/deskforge-apimain ./cmd/apimain.go | |
| admin-ui: | |
| name: Admin UI build | |
| runs-on: ubuntu-24.04 | |
| defaults: | |
| run: | |
| working-directory: admin-ui | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 20 | |
| - run: npm ci | |
| - run: npm run build | |
| rust: | |
| name: Rust checks | |
| runs-on: ubuntu-24.04 | |
| env: | |
| DATABASE_URL: sqlite:///tmp/deskforge-sqlx.sqlite3 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: rustup toolchain install 1.92.0 --profile minimal --component rustfmt | |
| - run: cargo +1.92.0 fmt --all -- --check | |
| working-directory: server | |
| - run: cargo +1.92.0 fmt --all -- --check | |
| working-directory: libs/hbb_common | |
| - name: Prepare SQLx SQLite schema | |
| run: | | |
| python3 - <<'PY' | |
| import sqlite3 | |
| with sqlite3.connect("/tmp/deskforge-sqlx.sqlite3") as connection: | |
| connection.executescript( | |
| """ | |
| create table if not exists peer ( | |
| guid blob primary key not null, | |
| id varchar(100) not null, | |
| uuid blob not null, | |
| pk blob not null, | |
| created_at datetime not null default(current_timestamp), | |
| user blob, | |
| status tinyint, | |
| note varchar(300), | |
| info text not null | |
| ) without rowid; | |
| create unique index if not exists index_peer_id on peer (id); | |
| create index if not exists index_peer_user on peer (user); | |
| create index if not exists index_peer_created_at on peer (created_at); | |
| create index if not exists index_peer_status on peer (status); | |
| """ | |
| ) | |
| - run: cargo +1.92.0 check --locked | |
| working-directory: server | |
| - run: cargo +1.92.0 test --locked | |
| working-directory: server | |
| docker: | |
| name: Docker build | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: docker build -f docker/Dockerfile -t deskforge:ci . |