release: v0.10.6 — Restores background-daemon mode in the pre-built b… #108
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker e2e | |
| # End-to-end checks that don't require a HermitStash server: | |
| # 1. codebase patterns — file-walk grep gates over bin/ + lib/, runs first | |
| # so a JS convention violation fails fast before the docker build. | |
| # 2. docker packaging — build against the latest published release and | |
| # verify metadata, non-root identity, volumes, entrypoint error path, | |
| # binary-reaches-enrollment. | |
| # Full sync-against-real-server e2e runs locally via tests/test-docker-e2e.js | |
| # under `node tests/run-all.js`. | |
| on: | |
| pull_request: | |
| paths: | |
| - 'bin/**' | |
| - 'lib/**' | |
| - 'Dockerfile' | |
| - 'docker/**' | |
| - 'scripts/verify-release.js' | |
| - 'scripts/standalone-verifier.js' | |
| - 'scripts/test-codebase-patterns.js' | |
| - '.github/workflows/docker-e2e.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'bin/**' | |
| - 'lib/**' | |
| - 'Dockerfile' | |
| - 'docker/**' | |
| - 'scripts/verify-release.js' | |
| - 'scripts/standalone-verifier.js' | |
| - 'scripts/test-codebase-patterns.js' | |
| - '.github/workflows/docker-e2e.yml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| IMAGE: hermitstash-sync-e2e:ci | |
| jobs: | |
| smoke: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| # zizmor: ignore[cache-poisoning] this smoke job builds with load:true | |
| # (no push) and setup-node sets no cache input, so there is no cached | |
| # toolchain or published image for a poisoned cache to reach. | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '>=24.18.0' | |
| # ── Codebase patterns ────────────────────────────────────── | |
| # File-walk grep gates over bin/ + lib/ — bug-class drift detectors | |
| # plus the require-binding-consistency rule. Pure static analysis, | |
| # no Docker / server dependency, so it runs BEFORE the buildx step | |
| # to fail fast when a JS-source convention is violated. | |
| - name: Run codebase patterns | |
| run: node --test scripts/test-codebase-patterns.js | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Resolve latest published release tag | |
| id: version | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION=$(gh release view --repo "${{ github.repository }}" --json tagName --jq '.tagName' | sed 's/^v//') | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "Latest released version: v${VERSION}" | |
| - name: Build image (amd64 only for CI speed) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| load: true | |
| tags: ${{ env.IMAGE }} | |
| build-args: | | |
| VERSION=${{ steps.version.outputs.version }} | |
| # --- Packaging checks (shared with docker-publish smoke-test) --- | |
| - name: Run packaging smoke checks | |
| shell: bash | |
| run: bash scripts/docker-smoke.sh "$IMAGE" | |
| - name: Summary | |
| if: always() | |
| env: | |
| VERSION_OUTPUT: ${{ steps.version.outputs.version }} | |
| run: | | |
| { | |
| echo "### Docker e2e smoke" | |
| echo "" | |
| echo "Image: \`$IMAGE\` (linux/amd64)" | |
| echo "Release base: v${VERSION_OUTPUT}" | |
| echo "" | |
| echo "- Codebase patterns (23 grep gates)" | |
| echo "- OCI labels present" | |
| echo "- Non-root user: hermit" | |
| echo "- Volumes: /config, /data" | |
| echo "- Env defaults correct" | |
| echo "- Missing-env entrypoint errors cleanly" | |
| echo "- Binary runs to enrollment step" | |
| echo "- Status command invokable" | |
| } >> "$GITHUB_STEP_SUMMARY" |