fix(docker): rebuild the libde265 layer for 1.0.15-1+deb13u2 (CVE-202… #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Automatic tests (1.7-DEV) | |
| permissions: read-all | |
| on: | |
| push: | |
| branches: [1.7] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-1.7 | |
| cancel-in-progress: false | |
| jobs: | |
| # Containers | |
| build-containers: | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write # container-build.yml uploads the Trivy SARIF | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: | |
| [bunkerweb, scheduler, bwcli, autoconf, ui, api, worker, all-in-one] | |
| include: | |
| - image: bunkerweb | |
| dockerfile: src/bw/Dockerfile | |
| - image: scheduler | |
| dockerfile: src/scheduler/Dockerfile | |
| - image: bwcli | |
| dockerfile: src/scheduler/Dockerfile | |
| target: bwcli | |
| - image: autoconf | |
| dockerfile: src/autoconf/Dockerfile | |
| - image: ui | |
| dockerfile: src/ui/Dockerfile | |
| - image: api | |
| dockerfile: src/api/Dockerfile | |
| - image: worker | |
| dockerfile: src/worker/Dockerfile | |
| - image: all-in-one | |
| dockerfile: src/all-in-one/Dockerfile | |
| uses: ./.github/workflows/container-build.yml | |
| with: | |
| RELEASE: 1.7 | |
| ARCH: linux/amd64 | |
| CACHE: true | |
| IMAGE: ${{ matrix.image }} | |
| DOCKERFILE: ${{ matrix.dockerfile }} | |
| TARGET: ${{ matrix.target }} | |
| secrets: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }} | |
| # Build Linux packages | |
| build-packages: | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| linux: | |
| [ | |
| ubuntu, | |
| debian-bookworm, | |
| debian-trixie, | |
| fedora-43, | |
| fedora-44, | |
| rhel-8, | |
| rhel-9, | |
| rhel-10, | |
| ubuntu-noble, | |
| ubuntu-jammy, | |
| ] | |
| include: | |
| - linux: ubuntu | |
| package: deb | |
| - linux: ubuntu-noble | |
| package: deb | |
| - linux: ubuntu-jammy | |
| package: deb | |
| - linux: debian-bookworm | |
| package: deb | |
| - linux: debian-trixie | |
| package: deb | |
| - linux: fedora-43 | |
| package: rpm | |
| - linux: fedora-44 | |
| package: rpm | |
| - linux: rhel-8 | |
| package: rpm | |
| - linux: rhel-9 | |
| package: rpm | |
| - linux: rhel-10 | |
| package: rpm | |
| uses: ./.github/workflows/linux-build.yml | |
| with: | |
| RELEASE: 1.7 | |
| LINUX: ${{ matrix.linux }} | |
| PACKAGE: ${{ matrix.package }} | |
| PLATFORMS: linux/amd64 | |
| secrets: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }} | |
| codeql: | |
| uses: ./.github/workflows/codeql.yml | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| # Integration tests — the framework lives in tests/ since the migration from | |
| # bunkerity/bunkerweb-tests, so specs and product are validated at the same SHA. | |
| parse-tests-core: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python 3.13 | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - id: parse_tests | |
| name: Parse core tests | |
| run: | | |
| pip install --require-hashes -r tests/requirements.txt | |
| python3 tests/parse.py "core" --dev | |
| echo "Linux_tests=$(cat /tmp/tests/Linux_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| echo "Docker_tests=$(cat /tmp/tests/Docker_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| echo "Autoconf_tests=$(cat /tmp/tests/Autoconf_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| echo "Kubernetes_tests=$(cat /tmp/tests/Kubernetes_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| echo "All_in_one_tests=$(cat /tmp/tests/All_in_one_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| outputs: | |
| Linux_tests: ${{ steps.parse_tests.outputs.Linux_tests }} | |
| Docker_tests: ${{ steps.parse_tests.outputs.Docker_tests }} | |
| Autoconf_tests: ${{ steps.parse_tests.outputs.Autoconf_tests }} | |
| Kubernetes_tests: ${{ steps.parse_tests.outputs.Kubernetes_tests }} | |
| All_in_one_tests: ${{ steps.parse_tests.outputs.All_in_one_tests }} | |
| parse-tests-api: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python 3.13 | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - id: parse_tests | |
| name: Parse api tests | |
| run: | | |
| pip install --require-hashes -r tests/requirements.txt | |
| python3 tests/parse.py "api" --dev | |
| echo "Docker_tests=$(cat /tmp/tests/Docker_tests.json || echo "[]")" >> $GITHUB_OUTPUT | |
| outputs: | |
| Docker_tests: ${{ steps.parse_tests.outputs.Docker_tests }} | |
| run-Docker-tests-core: | |
| needs: [build-containers, parse-tests-core] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-core.outputs.Docker_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: core | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| run-Autoconf-tests-core: | |
| needs: [build-containers, parse-tests-core] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-core.outputs.Autoconf_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: core | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| run-Linux-tests-core: | |
| needs: [build-packages, parse-tests-core] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-core.outputs.Linux_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: core | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| run-Kubernetes-tests-core: | |
| needs: [build-containers, parse-tests-core] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-core.outputs.Kubernetes_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: core | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| run-All-in-one-tests-core: | |
| needs: [build-containers, parse-tests-core] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-core.outputs.All_in_one_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: core | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| run-Docker-tests-api: | |
| needs: [build-containers, parse-tests-api] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: ${{ fromJson(needs.parse-tests-api.outputs.Docker_tests) }} | |
| uses: ./.github/workflows/integration-tests.yml | |
| with: | |
| TYPE: api | |
| TEST: ${{ matrix.test }} | |
| RELEASE: 1.7 | |
| # UI specs (tests/ui/*.yml) stay off until the Selenium matrix is green on | |
| # GitHub-hosted runners — they were commented out upstream too. | |
| # Push with 1.7-dev tag | |
| push-dev: | |
| needs: | |
| [ | |
| build-containers, | |
| run-Docker-tests-core, | |
| run-Autoconf-tests-core, | |
| run-Linux-tests-core, | |
| run-Kubernetes-tests-core, | |
| run-All-in-one-tests-core, | |
| run-Docker-tests-api, | |
| ] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| strategy: | |
| matrix: | |
| image: | |
| - from: bunkerweb | |
| to: bunkerweb | |
| - from: scheduler | |
| to: bunkerweb-scheduler | |
| - from: autoconf | |
| to: bunkerweb-autoconf | |
| - from: ui | |
| to: bunkerweb-ui | |
| - from: api | |
| to: bunkerweb-api | |
| - from: worker | |
| to: bunkerweb-worker | |
| - from: all-in-one | |
| to: bunkerweb-all-in-one | |
| steps: | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_TOKEN }} | |
| - name: Login to ghcr | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Push image | |
| run: docker pull "ghcr.io/bunkerity/${FROM}-tests:1.7" && docker tag "ghcr.io/bunkerity/${FROM}-tests:1.7" "bunkerity/${TO}:1.7-dev" && docker tag "ghcr.io/bunkerity/${FROM}-tests:1.7" "ghcr.io/bunkerity/${TO}:1.7-dev" && docker push "bunkerity/${TO}:1.7-dev" && docker push "ghcr.io/bunkerity/${TO}:1.7-dev" | |
| env: | |
| FROM: ${{ matrix.image.from }} | |
| TO: ${{ matrix.image.to }} | |
| # Push Linux packages | |
| push-packages: | |
| needs: [build-packages] | |
| strategy: | |
| matrix: | |
| linux: | |
| [ | |
| ubuntu, | |
| debian-bookworm, | |
| debian-trixie, | |
| fedora-43, | |
| fedora-44, | |
| el-8, | |
| el-9, | |
| el-10, | |
| ubuntu-noble, | |
| ubuntu-jammy, | |
| ] | |
| arch: [amd64] | |
| include: | |
| - release: 1.7 | |
| repo: bunkerweb | |
| - linux: ubuntu | |
| package_arch: amd64 | |
| separator: _ | |
| suffix: "" | |
| version: resolute | |
| package: deb | |
| - linux: debian-bookworm | |
| package_arch: amd64 | |
| separator: _ | |
| suffix: "" | |
| version: bookworm | |
| package: deb | |
| - linux: debian-trixie | |
| package_arch: amd64 | |
| separator: _ | |
| suffix: "" | |
| version: trixie | |
| package: deb | |
| - linux: fedora-43 | |
| package_arch: x86_64 | |
| separator: "-" | |
| suffix: "1." | |
| version: 43 | |
| package: rpm | |
| - linux: fedora-44 | |
| package_arch: x86_64 | |
| separator: "-" | |
| suffix: "1." | |
| version: 44 | |
| package: rpm | |
| - linux: el-8 | |
| package_arch: x86_64 | |
| separator: "-" | |
| suffix: "1." | |
| version: 8 | |
| package: rpm | |
| - linux: el-9 | |
| package_arch: x86_64 | |
| separator: "-" | |
| suffix: "1." | |
| version: 9 | |
| package: rpm | |
| - linux: el-10 | |
| package_arch: x86_64 | |
| separator: "-" | |
| suffix: "1." | |
| version: 10 | |
| package: rpm | |
| - linux: ubuntu-noble | |
| package_arch: amd64 | |
| separator: _ | |
| suffix: "" | |
| version: noble | |
| package: deb | |
| - linux: ubuntu-jammy | |
| package_arch: amd64 | |
| separator: _ | |
| suffix: "" | |
| version: jammy | |
| package: deb | |
| uses: ./.github/workflows/push-packagecloud.yml | |
| with: | |
| SEPARATOR: ${{ matrix.separator }} | |
| SUFFIX: ${{ matrix.suffix }} | |
| REPO: ${{ matrix.repo }} | |
| LINUX: ${{ matrix.linux }} | |
| VERSION: ${{ matrix.version }} | |
| PACKAGE: ${{ matrix.package }} | |
| BW_VERSION: ${{ matrix.release }} | |
| PACKAGE_ARCH: ${{ matrix.package_arch }} | |
| ARCH: ${{ matrix.arch }} | |
| secrets: | |
| PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }} |