mirror of
https://github.com/okxlin/release-factory.git
synced 2026-09-21 16:02:12 +00:00
okxlin
e058ba3f73
Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers. Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations. Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification. Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: Build Gemini Skill Browser Image (linuxserver)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
browser_base_tag:
|
|
description: "Optional base tag; empty follows the maintained component channel"
|
|
default: ""
|
|
type: string
|
|
image_tag:
|
|
description: "Optional published tag; empty follows the resolved browser tag"
|
|
default: ""
|
|
type: string
|
|
gemini_skill_ref:
|
|
description: "Optional source ref; empty uses the tested commit in components.json"
|
|
default: ""
|
|
type: string
|
|
push_latest:
|
|
description: "Also publish latest-linuxserver"
|
|
default: false
|
|
type: boolean
|
|
schedule:
|
|
- cron: '43 4 * * 0'
|
|
pull_request:
|
|
paths:
|
|
- 'gemini-skill-browser-linuxserver-builder/**'
|
|
- 'gemini-skill-browser-builder/configs/**'
|
|
- 'gemini-skill-browser-builder/image/runtime/**'
|
|
- 'gemini-skill-browser-builder/scripts/**'
|
|
- '.github/workflows/build-gemini-skill-browser-linuxserver.yml'
|
|
- '.github/workflows/release-gemini-browser.yml'
|
|
- 'scripts/smoke-gemini-browser.py'
|
|
- 'scripts/trivy-image-gate.sh'
|
|
- 'scripts/evaluate-trivy-policy.py'
|
|
- 'scripts/test-evaluate-trivy-policy.py'
|
|
- 'scripts/publish-tested-image.py'
|
|
- 'scripts/test-publish-tested-image.py'
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
concurrency:
|
|
group: build-gemini-linuxserver-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
release:
|
|
uses: ./.github/workflows/release-gemini-browser.yml
|
|
with:
|
|
variant: linuxserver
|
|
browser_base_tag: ${{ inputs.browser_base_tag || '' }}
|
|
image_tag: ${{ inputs.image_tag || '' }}
|
|
gemini_skill_ref: ${{ inputs.gemini_skill_ref || '' }}
|
|
push_latest: ${{ github.event_name == 'schedule' || inputs.push_latest == true }}
|
|
publish: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
|