Skip to content

fix: harden image updates and runtime security #158

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
autunn wants to merge 10 commits into
base: latest
Choose a base branch
from
Open

fix: harden image updates and runtime security #158

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
307408f
fix: harden image updates and runtime security
autunn Aug 24, 2026
0afccee
ci: pin builds to hardened frontend fork
autunn Aug 24, 2026
ece7cac
ci: publish latest image to GHCR
autunn Aug 24, 2026
0043e7d
ci: update GHCR actions and publish package publicly
autunn Aug 24, 2026
7bdcc6c
ci: rely on inherited GHCR visibility
autunn Aug 24, 2026
1c7a1a1
fix: allow user-defined authentication secrets
autunn Aug 24, 2026
b212adc
fix: prevent manager route startup panic
autunn Aug 24, 2026
f95be2c
fix: reduce routine startup log noise
autunn Aug 24, 2026
7c77a6d
fix: quiet successful health and registry fallbacks
autunn Aug 24, 2026
fe9e40a
fix: harden container updates backups and image checks
autunn Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 53 additions & 44 deletions .github/workflows/FNOS.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: FNOS

permissions:
contents: read

on:
workflow_dispatch:
push:
Expand All @@ -13,16 +16,16 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout frontend code
uses: actions/checkout@v3
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
repository: dongshull/Docker-Copilot-React
repository: autunn/Docker-Copilot-React
path: './frontend'
ref: 'master'
ref: 'afc2105211eb1adaa417ce8c125f2a91789c9bf1'

- name: Setup Node.js
uses: actions/setup-node@v3
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: '22'
node-version: '22.23.2'
cache: 'npm'
cache-dependency-path: |
frontend/package-lock.json
Expand All @@ -32,10 +35,11 @@ jobs:
run: |
cd frontend
npm ci
npm run test --if-present
npm run build

- name: Upload Frontend Artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: my-artifact-front-dist
path: frontend/dist
Expand All @@ -48,10 +52,10 @@ jobs:
arch: [ amd64, arm64 ]
steps:
- name: Checkout code back end
uses: actions/checkout@v3
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

- name: Download Frontend Artifacts
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
pattern: my-artifact-front-*
merge-multiple: true
Expand All @@ -64,56 +68,61 @@ jobs:
run: |
echo "version=$(cat fn_version)" >> $GITHUB_ENV

- name: Cache Go Modules
uses: actions/cache@v3
with:
path: ${{ github.workspace }}/msaber-back/pkg/mod
key: go-mod-${{ hashFiles('**/go.sum') }}
restore-keys: |
go-mod-

- name: Set up Go
uses: actions/setup-go@v4
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
with:
go-version: '1.23.4'
cache: false
go-version: '1.25.13'
cache-dependency-path: go.sum

- name: Run backend tests
if: matrix.arch == 'amd64'
run: go test ./...

- name: Build for ${{ matrix.arch }}
run: |
CGO_ENABLED=0 GOOS=linux GOARCH=${{ matrix.arch }} go build -a --trimpath -ldflags="-w -s -X 'github.com/onlyLTY/dockerCopilot/internal/config.Version=${{ env.version }}' -X 'github.com/onlyLTY/dockerCopilot/internal/config.BuildDate=$(date)'" -o dist/linux/${{ matrix.arch }}/dockerCopilot-new .

- name: Compress binary
run: |
tar -czvf dockerCopilot-${{ matrix.arch }}.tar.gz dist/linux/${{ matrix.arch }}/dockerCopilot-new
tar -C dist/linux/${{ matrix.arch }} -czvf dockerCopilot-${{ matrix.arch }}.tar.gz dockerCopilot-new
sha256sum dockerCopilot-${{ matrix.arch }}.tar.gz > dockerCopilot-${{ matrix.arch }}.tar.gz.sha256

- name: List current directory
run: ls -la

- name: Check if release already exists
id: check_release
run: |
exists=$(gh release view ${{ env.version }} 2>&1 | grep "release not found" || true)
if [[ -z "$exists" ]]; then
echo "Release exists"
echo "RELEASE_EXISTS=true" >> $GITHUB_ENV
else
echo "Release does not exist"
echo "RELEASE_EXISTS=false" >> $GITHUB_ENV
fi
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload release assets for ${{ matrix.arch }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: release-assets-${{ matrix.arch }}
path: |
dockerCopilot-${{ matrix.arch }}.tar.gz
dockerCopilot-${{ matrix.arch }}.tar.gz.sha256
if-no-files-found: error

release:
needs: build-backend
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout backend code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

- name: Create GitHub Release if not exists
if: env.RELEASE_EXISTS == 'false'
run: |
gh release create ${{ env.version }} \
--title "${{ env.version }}" \
--notes "Release of version ${{ env.version }}"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Get version from file
run: echo "version=$(cat fn_version)" >> "$GITHUB_ENV"

- name: Upload Asset for ${{ matrix.arch }}
run: |
gh release upload ${{ env.version }} dockerCopilot-${{ matrix.arch }}.tar.gz
- name: Download release assets
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
pattern: release-assets-*
merge-multiple: true
path: release-assets

- name: Create release and upload all assets
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
if ! gh release view "$version" >/dev/null 2>&1; then
gh release create "$version" --title "$version" --notes "Release of version $version"
fi
gh release upload "$version" release-assets/* --clobber
97 changes: 53 additions & 44 deletions .github/workflows/UGREEN.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: UGREEN

permissions:
contents: read

on:
workflow_dispatch:
push:
Expand All @@ -13,16 +16,16 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout frontend code
uses: actions/checkout@v3
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
repository: dongshull/Docker-Copilot-React
repository: autunn/Docker-Copilot-React
path: './frontend'
ref: 'master'
ref: 'afc2105211eb1adaa417ce8c125f2a91789c9bf1'

- name: Setup Node.js
uses: actions/setup-node@v3
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: '22'
node-version: '22.23.2'
cache: 'npm'
cache-dependency-path: |
frontend/package-lock.json
Expand All @@ -32,10 +35,11 @@ jobs:
run: |
cd frontend
npm ci
npm run test --if-present
npm run build

- name: Upload Frontend Artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: my-artifact-front-dist
path: frontend/dist
Expand All @@ -48,10 +52,10 @@ jobs:
arch: [ amd64, arm64 ]
steps:
- name: Checkout code back end
uses: actions/checkout@v3
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

- name: Download Frontend Artifacts
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
pattern: my-artifact-front-*
merge-multiple: true
Expand All @@ -64,56 +68,61 @@ jobs:
run: |
echo "version=$(cat ugreen_version)" >> $GITHUB_ENV

- name: Cache Go Modules
uses: actions/cache@v3
with:
path: ${{ github.workspace }}/msaber-back/pkg/mod
key: go-mod-${{ hashFiles('**/go.sum') }}
restore-keys: |
go-mod-

- name: Set up Go
uses: actions/setup-go@v4
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
with:
go-version: '1.23.4'
cache: false
go-version: '1.25.13'
cache-dependency-path: go.sum

- name: Run backend tests
if: matrix.arch == 'amd64'
run: go test ./...

- name: Build for ${{ matrix.arch }}
run: |
CGO_ENABLED=0 GOOS=linux GOARCH=${{ matrix.arch }} go build -a --trimpath -ldflags="-w -s -X 'github.com/onlyLTY/dockerCopilot/internal/config.Version=${{ env.version }}' -X 'github.com/onlyLTY/dockerCopilot/internal/config.BuildDate=$(date)'" -o dist/linux/${{ matrix.arch }}/dockerCopilot-new .

- name: Compress binary
run: |
tar -czvf dockerCopilot-${{ matrix.arch }}.tar.gz dist/linux/${{ matrix.arch }}/dockerCopilot-new
tar -C dist/linux/${{ matrix.arch }} -czvf dockerCopilot-${{ matrix.arch }}.tar.gz dockerCopilot-new
sha256sum dockerCopilot-${{ matrix.arch }}.tar.gz > dockerCopilot-${{ matrix.arch }}.tar.gz.sha256

- name: List current directory
run: ls -la

- name: Check if release already exists
id: check_release
run: |
exists=$(gh release view ${{ env.version }} 2>&1 | grep "release not found" || true)
if [[ -z "$exists" ]]; then
echo "Release exists"
echo "RELEASE_EXISTS=true" >> $GITHUB_ENV
else
echo "Release does not exist"
echo "RELEASE_EXISTS=false" >> $GITHUB_ENV
fi
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload release assets for ${{ matrix.arch }}
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: release-assets-${{ matrix.arch }}
path: |
dockerCopilot-${{ matrix.arch }}.tar.gz
dockerCopilot-${{ matrix.arch }}.tar.gz.sha256
if-no-files-found: error

release:
needs: build-backend
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout backend code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

- name: Create GitHub Release if not exists
if: env.RELEASE_EXISTS == 'false'
run: |
gh release create ${{ env.version }} \
--title "${{ env.version }}" \
--notes "Release of version ${{ env.version }}"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Get version from file
run: echo "version=$(cat ugreen_version)" >> "$GITHUB_ENV"

- name: Upload Asset for ${{ matrix.arch }}
run: |
gh release upload ${{ env.version }} dockerCopilot-${{ matrix.arch }}.tar.gz
- name: Download release assets
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
with:
pattern: release-assets-*
merge-multiple: true
path: release-assets

- name: Create release and upload all assets
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
if ! gh release view "$version" >/dev/null 2>&1; then
gh release create "$version" --title "$version" --notes "Release of version $version"
fi
gh release upload "$version" release-assets/* --clobber
Loading