mirror of
https://github.com/element-hq/synapse.git
synced 2026-08-17 15:20:12 +00:00
Andrew Morgan
dd49959ed6
Set actions/checkout persist-credentials: false across jobs that only need a read-only working tree. This keeps the repository token out of local git config and prevents it from being carried into later steps or uploaded artifacts. Switch GitHub Actions caches used by untrusted or artifact-producing jobs to lookup-only, and disable setup-go caching where zizmor flagged cache poisoning risk. These jobs still restore dependency state where useful but do not write new cache entries from those runs. Keep an explicit artipacked suppression on the manual lint-fix workflow because its final git-auto-commit step intentionally needs checkout credentials to push the generated fix commit.
83 lines
3.3 KiB
YAML
83 lines
3.3 KiB
YAML
# This task does not run complement tests, see tests.yaml instead.
|
|
# This task does not build docker images for synapse for use on docker hub, see docker.yaml instead
|
|
|
|
name: Store complement-synapse image in ghcr.io
|
|
on:
|
|
push:
|
|
branches: [ "master" ]
|
|
schedule:
|
|
- cron: '0 5 * * *'
|
|
workflow_dispatch:
|
|
inputs:
|
|
branch:
|
|
required: true
|
|
default: 'develop'
|
|
type: choice
|
|
options:
|
|
- develop
|
|
- master
|
|
|
|
# Only run this action once per pull request/branch; restart if a new commit arrives.
|
|
# C.f. https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency
|
|
# and https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions#github-context
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
name: Build and push complement image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout specific branch (debug build)
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
if: github.event_name == 'workflow_dispatch'
|
|
with:
|
|
ref: ${{ inputs.branch }}
|
|
persist-credentials: false
|
|
- name: Checkout clean copy of develop (scheduled build)
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
if: github.event_name == 'schedule'
|
|
with:
|
|
ref: develop
|
|
persist-credentials: false
|
|
- name: Checkout clean copy of master (on-push)
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
if: github.event_name == 'push'
|
|
with:
|
|
ref: master
|
|
persist-credentials: false
|
|
# We use `poetry` in `complement.sh`
|
|
- uses: matrix-org/setup-python-poetry@5bbf6603c5c930615ec8a29f1b5d7d258d905aa4 # v2.0.0
|
|
with:
|
|
poetry-version: "2.4.1"
|
|
- name: Login to registry
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Work out labels for complement image
|
|
id: meta
|
|
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}/complement-synapse
|
|
tags: |
|
|
type=schedule,pattern=nightly,enable=${{ github.event_name == 'schedule'}}
|
|
type=raw,value=develop,enable=${{ github.event_name == 'schedule' || inputs.branch == 'develop' }}
|
|
type=raw,value=latest,enable=${{ github.event_name == 'push' || inputs.branch == 'master' }}
|
|
type=sha,format=long
|
|
- name: Run scripts-dev/complement.sh to generate complement-synapse:latest image.
|
|
run: scripts-dev/complement.sh --build-only
|
|
- name: Tag and push generated image
|
|
run: |
|
|
for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do
|
|
echo "tag and push $TAG"
|
|
# `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
|
|
docker tag localhost/complement-synapse $TAG
|
|
docker push $TAG
|
|
done
|