Run tests in ci #70
Run tests in ci #70
Conversation
ilopezluna
commented
Jun 6, 2025
ilopezluna
commented
- Fixed test
- Added release workflow
- Updated CI workflow to only build and test
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: 1.24.2 | ||
| cache: true | ||
|
|
||
| - name: Run tests | ||
| run: go test ./... | ||
|
|
||
| build: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the workflow level to define the minimal permissions required. Based on the workflow's operations:
- The
contents: readpermission is needed to check out the repository code. - The
packages: writepermission is required for pushing Docker images to DockerHub.
The permissions block will be added at the top of the workflow, ensuring it applies to all jobs unless overridden.
| @@ -3,2 +3,6 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| on: |
| needs: test | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Format tags | ||
| id: tags | ||
| shell: bash | ||
| run: | | ||
| echo "cpu<<EOF" >> "$GITHUB_OUTPUT" | ||
| echo "docker/model-runner:${{ inputs.releaseTag }}" >> "$GITHUB_OUTPUT" | ||
| if [ "${{ inputs.pushLatest }}" == "true" ]; then | ||
| echo "docker/model-runner:latest" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| echo 'EOF' >> "$GITHUB_OUTPUT" | ||
| echo "cuda<<EOF" >> "$GITHUB_OUTPUT" | ||
| echo "docker/model-runner:${{ inputs.releaseTag }}-cuda" >> "$GITHUB_OUTPUT" | ||
| if [ "${{ inputs.pushLatest }}" == "true" ]; then | ||
| echo "docker/model-runner:latest-cuda" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| echo 'EOF' >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Log in to DockerHub | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| username: "docker" | ||
| password: ${{ secrets.ORG_ACCESS_TOKEN }} | ||
|
|
||
| - name: Set up Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| version: "lab:latest" | ||
| driver: cloud | ||
| endpoint: "docker/make-product-smarter" | ||
| install: true | ||
|
|
||
| - name: Build CPU image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile | ||
| platforms: linux/amd64, linux/arm64 | ||
| build-args: | | ||
| "LLAMA_SERVER_VERSION=latest" | ||
| push: true | ||
| sbom: true | ||
| provenance: mode=max | ||
| tags: ${{ steps.tags.outputs.cpu }} | ||
|
|
||
| - name: Build CUDA image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| file: Dockerfile | ||
| platforms: linux/amd64, linux/arm64 | ||
| build-args: | | ||
| "LLAMA_SERVER_VERSION=latest" | ||
| "LLAMA_SERVER_VARIANT=cuda" | ||
| "BASE_IMAGE=nvidia/cuda:12.9.0-cudnn-runtime-ubuntu24.04" | ||
| push: true | ||
| sbom: true | ||
| provenance: mode=max | ||
| tags: ${{ steps.tags.outputs.cuda }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block to the workflow to explicitly define the least privileges required for the jobs. Based on the operations performed:
- The
testjob only needs to read the repository contents to run tests. - The
buildjob requires additional permissions to push Docker images, so it will needcontents: readandpackages: write.
The permissions block will be added at the job level to ensure each job has only the permissions it needs.
| @@ -19,2 +19,4 @@ | ||
| test: | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| @@ -34,2 +36,5 @@ | ||
| build: | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| needs: test |
| echo 'EOF' >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Log in to DockerHub | ||
| uses: docker/login-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| password: ${{ secrets.ORG_ACCESS_TOKEN }} | ||
|
|
||
| - name: Set up Buildx | ||
| uses: docker/setup-buildx-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| install: true | ||
|
|
||
| - name: Build CPU image | ||
| uses: docker/build-push-action@v5 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| tags: ${{ steps.tags.outputs.cpu }} | ||
|
|
||
| - name: Build CUDA image | ||
| uses: docker/build-push-action@v5 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
