mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 16:06:08 +00:00
ZyyandCodex
dc45aee5da
Validate Cargo mount snapshots before saving, group cache tooling in a local action, and decouple image builds from release packaging. Use prebuilt security tooling and narrow unrelated CI triggers. Co-authored-by: Codex <noreply@openai.com>
93 lines
3.4 KiB
YAML
93 lines
3.4 KiB
YAML
name: Container
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: Exact commit SHA to build and validate
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
|
|
TRIVY_QUIET: 'true'
|
|
TRIVY_SKIP_VERSION_CHECK: 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.ref }}
|
|
|
|
- name: Setup Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- name: Restore Cargo snapshot
|
|
id: cargo-cache
|
|
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ runner.temp }}/container-cargo
|
|
# 同一平台和依赖复用快照，源码变化由 Cargo 指纹判定是否重编译
|
|
key: container-cargo-v3-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile', '.github/actions/cargo-cache/Dockerfile') }}
|
|
restore-keys: |
|
|
container-cargo-v3-${{ runner.os }}-${{ runner.arch }}-
|
|
container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-
|
|
|
|
- name: Restore Cargo mounts to BuildKit
|
|
id: cargo-restore
|
|
uses: ./.github/actions/cargo-cache
|
|
with:
|
|
operation: restore
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
path: ${{ runner.temp }}/container-cargo
|
|
architecture: amd64
|
|
|
|
- name: Build runtime image
|
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
file: deploy/Dockerfile
|
|
target: runtime
|
|
load: true
|
|
tags: ${{ env.CPR_IMAGE }}
|
|
no-cache-filters: |
|
|
runtime-base
|
|
runtime
|
|
cache-from: type=gha,scope=runtime-ci
|
|
cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=gha,mode=max,scope=runtime-ci' || '' }}
|
|
|
|
- name: Verify runtime image
|
|
uses: ./.github/actions/verify-container
|
|
with:
|
|
image: ${{ env.CPR_IMAGE }}
|
|
platform: linux/amd64
|
|
artifact-name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-amd64
|
|
|
|
# 构建层命中时 mount 仍可能为空，只有实际检查过内容的快照才允许保存。
|
|
- name: Export Cargo snapshot
|
|
if: >-
|
|
github.event_name == 'push' && github.ref == 'refs/heads/main' &&
|
|
(steps.cargo-cache.outputs.cache-hit != 'true' || steps.cargo-restore.outputs.usable != 'true')
|
|
id: cargo-snapshot
|
|
uses: ./.github/actions/cargo-cache
|
|
with:
|
|
operation: snapshot
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
path: ${{ runner.temp }}/container-cargo
|
|
architecture: amd64
|
|
|
|
- name: Save Cargo snapshot
|
|
if: steps.cargo-snapshot.outputs.usable == 'true' && steps.cargo-cache.outputs.cache-hit != 'true'
|
|
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ runner.temp }}/container-cargo
|
|
key: ${{ steps.cargo-cache.outputs.cache-primary-key }}
|