mirror of
https://github.com/okxlin/release-factory.git
synced 2026-09-21 16:02:12 +00:00
okxlin
e058ba3f73
Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers. Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations. Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification. Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
name: Build OpenCode Workstation Image
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
image_tag:
|
|
description: "Published image tag; leave empty for the default release tag"
|
|
default: ""
|
|
type: string
|
|
platforms:
|
|
description: "Comma-separated target platforms"
|
|
default: linux/amd64,linux/arm64
|
|
type: string
|
|
push_latest:
|
|
description: "Also publish latest"
|
|
default: false
|
|
type: boolean
|
|
schedule:
|
|
- cron: "11 4 * * 0"
|
|
pull_request:
|
|
paths:
|
|
- 'opencode-workstation-builder/**'
|
|
- '.github/workflows/build-opencode-workstation.yml'
|
|
- '.github/workflows/release-workstations.yml'
|
|
- 'scripts/smoke-opencode-workstation.py'
|
|
- 'scripts/trivy-image-gate.sh'
|
|
- 'scripts/evaluate-trivy-policy.py'
|
|
- 'scripts/test-evaluate-trivy-policy.py'
|
|
- 'scripts/publish-tested-image.py'
|
|
- 'scripts/test-publish-tested-image.py'
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
concurrency:
|
|
group: build-opencode-workstation-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
release:
|
|
uses: ./.github/workflows/release-workstations.yml
|
|
with:
|
|
variant: opencode
|
|
image_tag: ${{ inputs.image_tag || '' }}
|
|
platforms: ${{ inputs.platforms || 'linux/amd64,linux/arm64' }}
|
|
push_latest: ${{ github.event_name == 'schedule' || inputs.push_latest == true }}
|
|
publish: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
|