CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing #34
@@ -185,6 +185,16 @@ jobs:
|
||||
docker push "$IMAGE:$MINOR_TAG"
|
||||
docker push "$IMAGE:$VERSION"
|
||||
|
||||
GHCR_IMAGE=ghcr.io/djeex/lumeex
|
||||
echo "${{ secrets.GH_TOKEN }}" | docker login ghcr.io -u Djeex --password-stdin
|
||||
|
||||
docker tag lumeex:ci "$GHCR_IMAGE:latest"
|
||||
docker tag lumeex:ci "$GHCR_IMAGE:$MINOR_TAG"
|
||||
docker tag lumeex:ci "$GHCR_IMAGE:$VERSION"
|
||||
docker push "$GHCR_IMAGE:latest"
|
||||
docker push "$GHCR_IMAGE:$MINOR_TAG"
|
||||
docker push "$GHCR_IMAGE:$VERSION"
|
||||
|
||||
TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
|
||||
PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
|
||||
|
||||
@@ -244,3 +254,32 @@ jobs:
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$JSON_PAYLOAD" \
|
||||
"https://git.djeex.fr/api/v1/repos/Djeex/lumeex/releases"
|
||||
|
||||
MIRROR_NOTICE="_This github repo is a mirror of https://git.djeex.fr/Djeex/lumeex. You'll find full package, PR, history and release note there._"
|
||||
GH_BODY=$(printf '%s\n\n%s' "$MIRROR_NOTICE" "$BODY")
|
||||
|
||||
GH_JSON_PAYLOAD=$(jq -n \
|
||||
--arg tag "$VERSION" \
|
||||
--arg name "$VERSION" \
|
||||
--arg body "$GH_BODY" \
|
||||
--arg sha "${{ github.sha }}" \
|
||||
'{tag_name: $tag, name: $name, target_commitish: $sha, body: $body}')
|
||||
|
||||
GH_STATUS=0
|
||||
for i in 1 2 3 4 5; do
|
||||
GH_STATUS=$(curl -s -o /tmp/gh_release.json -w "%{http_code}" -X POST \
|
||||
-H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "$GH_JSON_PAYLOAD" \
|
||||
"https://api.github.com/repos/Djeex/lumeex/releases")
|
||||
if [ "$GH_STATUS" = "201" ]; then
|
||||
break
|
||||
fi
|
||||
echo "GitHub Release attempt $i failed (HTTP $GH_STATUS) — mirror may not have synced this commit yet, retrying in 15s..."
|
||||
sleep 15
|
||||
done
|
||||
echo "GitHub Release API response: $GH_STATUS"
|
||||
if [ "$GH_STATUS" != "201" ]; then
|
||||
cat /tmp/gh_release.json 2>/dev/null || true
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user