mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 08:06:19 +00:00
ZyyandCodex
2a7fd08e9e
Share container verification between CI and release image jobs. Validate both native release architectures and publish manifests from the verified digests, eliminating the duplicate release source build. Persist BuildKit Cargo cache mounts across CI runs, refresh release caches per commit, and generate SARIF and vulnerability gate results from one Trivy scan. Validation: actionlint, composite action ShellCheck, embedded shell syntax, Trivy severity and malformed-report checks, and manifest digest validation passed locally. Full GitHub workflow timing remains to be measured. Co-authored-by: Codex <noreply@openai.com>
78 lines
2.8 KiB
YAML
78 lines
2.8 KiB
YAML
name: Reusable Container
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: Exact commit SHA to build and validate
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
|
|
TRIVY_QUIET: 'true'
|
|
TRIVY_SKIP_VERSION_CHECK: 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.ref }}
|
|
|
|
- name: Setup Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
|
|
|
- name: Cache Cargo mounts
|
|
id: cargo-cache
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ runner.temp }}/container-cargo
|
|
key: container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/**/Cargo.toml', 'deploy/Dockerfile') }}-${{ inputs.ref }}
|
|
restore-keys: |
|
|
container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/**/Cargo.toml', 'deploy/Dockerfile') }}-
|
|
container-cargo-v1-${{ runner.os }}-${{ runner.arch }}-
|
|
|
|
# The GHA layer exporter does not persist RUN --mount=type=cache contents.
|
|
# Extraction runs before actions/cache saves its directories in post steps.
|
|
- name: Restore Cargo mounts to BuildKit
|
|
uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
scratch-dir: ${{ runner.temp }}/container-cache-dance
|
|
cache-map: |
|
|
{
|
|
"${{ runner.temp }}/container-cargo/registry": "/usr/local/cargo/registry",
|
|
"${{ runner.temp }}/container-cargo/git": "/usr/local/cargo/git",
|
|
"${{ runner.temp }}/container-cargo/target": "/app/backend/target"
|
|
}
|
|
skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }}
|
|
|
|
- name: Build runtime image
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
file: deploy/Dockerfile
|
|
target: runtime
|
|
load: true
|
|
tags: ${{ env.CPR_IMAGE }}
|
|
no-cache-filters: |
|
|
runtime-base
|
|
runtime
|
|
cache-from: type=gha,scope=runtime-ci
|
|
cache-to: type=gha,mode=max,scope=runtime-ci
|
|
|
|
- name: Verify runtime image
|
|
uses: ./.github/actions/verify-container
|
|
with:
|
|
image: ${{ env.CPR_IMAGE }}
|
|
platform: linux/amd64
|
|
artifact-name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-amd64
|