luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 16: CI dependency audit & security checks #15

Merged
luckberg merged 40 commits from gsd/phase-16-ci-dependency-audit-and-security-checks into main 2026-06-13 10:01:01 -04:00
Conversation 0 Commits 40 Files Changed 42
+10 -6
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bc00f3e815 - Show all commits
.gitea/workflows/publish.yml
+10 -6
View File
@@ -76,7 +76,7 @@ jobs:
# Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest + # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
# lockfile from the root context; building from apps/api/ would fail to find them. # lockfile from the root context; building from apps/api/ would fail to find them.
- name: Build and push - name: Build production image
run: | run: |
set -euo pipefail set -euo pipefail
docker build --target production \ docker build --target production \
@@ -84,11 +84,15 @@ jobs:
-t ${{ steps.tags.outputs.latest }} \ -t ${{ steps.tags.outputs.latest }} \
-t ${{ steps.tags.outputs.sha_tag }} \ -t ${{ steps.tags.outputs.sha_tag }} \
. .
# Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
# the first failed push, so :latest is only moved after the immutable, # Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
# rollback-traceable tag has landed — a failed second push can never leave # the first failed push, so :latest is only moved after the immutable,
# :latest advanced without a corresponding rollback tag (WR-04). # rollback-traceable tag has landed — a failed second push can never leave
docker push ${{ steps.tags.outputs.sha_tag }} # immutable first # :latest advanced without a corresponding rollback tag (WR-04).
- name: Push image
run: |
set -euo pipefail
docker push ${{ steps.tags.outputs.sha_tag }} # immutable first (WR-04)
docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands
# Always drop the stored credential from the runner after push (defence in depth). # Always drop the stored credential from the runner after push (defence in depth).