mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 08:06:19 +00:00
ZyyandCodex
8fb42300c1
Reuse test binaries and frontend builds, reduce redundant cache writes, and overlap release preparation with quality checks. Protect skills, contribution rules, and GitHub configuration, and simplify workflow names. Co-authored-by: Codex <noreply@openai.com>
87 lines
3.6 KiB
YAML
87 lines
3.6 KiB
YAML
name: Container
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: Exact commit SHA to build and validate
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
|
|
TRIVY_QUIET: 'true'
|
|
TRIVY_SKIP_VERSION_CHECK: 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.ref }}
|
|
|
|
- name: Setup Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- name: Cache Cargo mounts
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
id: cargo-cache
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ runner.temp }}/container-cargo
|
|
# 同一平台和依赖复用快照，源码变化由 Cargo 指纹判定是否重编译
|
|
key: container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile') }}
|
|
restore-keys: |
|
|
container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-
|
|
|
|
- name: Restore Cargo mounts for pull requests
|
|
if: github.event_name != 'push' || github.ref != 'refs/heads/main'
|
|
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ${{ runner.temp }}/container-cargo
|
|
key: container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile') }}
|
|
restore-keys: |
|
|
container-cargo-v2-${{ runner.os }}-${{ runner.arch }}-
|
|
|
|
# GHA 层缓存不含 cache mount，只有主分支缺少当前快照时才回收并保存
|
|
- name: Restore Cargo mounts to BuildKit
|
|
uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0
|
|
with:
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
scratch-dir: ${{ runner.temp }}/container-cache-dance
|
|
cache-map: |
|
|
{
|
|
"${{ runner.temp }}/container-cargo/registry": "/usr/local/cargo/registry",
|
|
"${{ runner.temp }}/container-cargo/git": "/usr/local/cargo/git",
|
|
"${{ runner.temp }}/container-cargo/target": "/app/backend/target"
|
|
}
|
|
skip-extraction: ${{ github.event_name != 'push' || github.ref != 'refs/heads/main' || steps.cargo-cache.outputs.cache-hit == 'true' }}
|
|
|
|
- name: Build runtime image
|
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
file: deploy/Dockerfile
|
|
target: runtime
|
|
load: true
|
|
tags: ${{ env.CPR_IMAGE }}
|
|
no-cache-filters: |
|
|
runtime-base
|
|
runtime
|
|
cache-from: type=gha,scope=runtime-ci
|
|
cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=gha,mode=max,scope=runtime-ci' || '' }}
|
|
|
|
- name: Verify runtime image
|
|
uses: ./.github/actions/verify-container
|
|
with:
|
|
image: ${{ env.CPR_IMAGE }}
|
|
platform: linux/amd64
|
|
artifact-name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-amd64
|