CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing #34
@@ -185,6 +185,16 @@ jobs:
|
|||||||
docker push "$IMAGE:$MINOR_TAG"
|
docker push "$IMAGE:$MINOR_TAG"
|
||||||
docker push "$IMAGE:$VERSION"
|
docker push "$IMAGE:$VERSION"
|
||||||
|
|
||||||
|
GHCR_IMAGE=ghcr.io/djeex/lumeex
|
||||||
|
echo "${{ secrets.GH_TOKEN }}" | docker login ghcr.io -u Djeex --password-stdin
|
||||||
|
|
||||||
|
docker tag lumeex:ci "$GHCR_IMAGE:latest"
|
||||||
|
docker tag lumeex:ci "$GHCR_IMAGE:$MINOR_TAG"
|
||||||
|
docker tag lumeex:ci "$GHCR_IMAGE:$VERSION"
|
||||||
|
docker push "$GHCR_IMAGE:latest"
|
||||||
|
docker push "$GHCR_IMAGE:$MINOR_TAG"
|
||||||
|
docker push "$GHCR_IMAGE:$VERSION"
|
||||||
|
|
||||||
TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
|
TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
|
||||||
PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
|
PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
|
||||||
|
|
||||||
@@ -244,3 +254,32 @@ jobs:
|
|||||||
-H "Content-Type: application/json" \
|
-H "Content-Type: application/json" \
|
||||||
-d "$JSON_PAYLOAD" \
|
-d "$JSON_PAYLOAD" \
|
||||||
"https://git.djeex.fr/api/v1/repos/Djeex/lumeex/releases"
|
"https://git.djeex.fr/api/v1/repos/Djeex/lumeex/releases"
|
||||||
|
|
||||||
|
MIRROR_NOTICE="_This github repo is a mirror of https://git.djeex.fr/Djeex/lumeex. You'll find full package, PR, history and release note there._"
|
||||||
|
GH_BODY=$(printf '%s\n\n%s' "$MIRROR_NOTICE" "$BODY")
|
||||||
|
|
||||||
|
GH_JSON_PAYLOAD=$(jq -n \
|
||||||
|
--arg tag "$VERSION" \
|
||||||
|
--arg name "$VERSION" \
|
||||||
|
--arg body "$GH_BODY" \
|
||||||
|
--arg sha "${{ github.sha }}" \
|
||||||
|
'{tag_name: $tag, name: $name, target_commitish: $sha, body: $body}')
|
||||||
|
|
||||||
|
GH_STATUS=0
|
||||||
|
for i in 1 2 3 4 5; do
|
||||||
|
GH_STATUS=$(curl -s -o /tmp/gh_release.json -w "%{http_code}" -X POST \
|
||||||
|
-H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
|
||||||
|
-H "Accept: application/vnd.github+json" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d "$GH_JSON_PAYLOAD" \
|
||||||
|
"https://api.github.com/repos/Djeex/lumeex/releases")
|
||||||
|
if [ "$GH_STATUS" = "201" ]; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
echo "GitHub Release attempt $i failed (HTTP $GH_STATUS) — mirror may not have synced this commit yet, retrying in 15s..."
|
||||||
|
sleep 15
|
||||||
|
done
|
||||||
|
echo "GitHub Release API response: $GH_STATUS"
|
||||||
|
if [ "$GH_STATUS" != "201" ]; then
|
||||||
|
cat /tmp/gh_release.json 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
|||||||
Reference in New Issue
Block a user