wangcong/story
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build: bind candidate identity to images
ci / verify (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Codex Local
2026-08-26 06:57:12 +08:00
parent 29bdf4900f
commit e8a6122bd6
8 changed files with 71 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+32 -3
View File
@@ -42,10 +42,27 @@ jobs:
npm run build
- name: Validate compose
run: docker compose config --quiet
- name: Resolve immutable build identity
run: |
openapi_version="$(awk '/^ version:/{print $2; exit}' openapi/openapi.yaml)"
test -n "$openapi_version"
echo "PLATFORM_BUILD_VERSION=${openapi_version}-ci.${GITHUB_RUN_NUMBER}" >> "$GITHUB_ENV"
echo "PLATFORM_BUILD_COMMIT=${GITHUB_SHA}" >> "$GITHUB_ENV"
echo "PLATFORM_BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
- name: Build backend image
run: docker build -f deploy/backend.Dockerfile -t data-terminal-cloud-backend:test .
run: >-
docker build -f deploy/backend.Dockerfile
--build-arg VERSION="$PLATFORM_BUILD_VERSION"
--build-arg COMMIT="$PLATFORM_BUILD_COMMIT"
--build-arg BUILD_TIME="$PLATFORM_BUILD_TIME"
-t data-terminal-cloud-backend:test .
- name: Build web image
run: docker build -f deploy/web.Dockerfile -t data-terminal-cloud-web:test .
run: >-
docker build -f deploy/web.Dockerfile
--build-arg VERSION="$PLATFORM_BUILD_VERSION"
--build-arg COMMIT="$PLATFORM_BUILD_COMMIT"
--build-arg BUILD_TIME="$PLATFORM_BUILD_TIME"
-t data-terminal-cloud-web:test .
- name: Go vulnerability and license policy
run: |
go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
@@ -79,7 +96,19 @@ jobs:
run: |
backend_digest="$(docker image inspect --format='{{.Id}}' data-terminal-cloud-backend:test)"
web_digest="$(docker image inspect --format='{{.Id}}' data-terminal-cloud-web:test)"
jq -n --arg source_commit "$GITHUB_SHA" --arg run_id "$GITHUB_RUN_ID" --arg run_attempt "$GITHUB_RUN_ATTEMPT" --arg backend_digest "$backend_digest" --arg web_digest "$web_digest" '{source_commit:$source_commit,run_id:$run_id,run_attempt:$run_attempt,backend_image_digest:$backend_digest,web_image_digest:$web_digest}' > artifacts/build-metadata.json
backend_version="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.version"}}' data-terminal-cloud-backend:test)"
backend_commit="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.revision"}}' data-terminal-cloud-backend:test)"
backend_time="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.created"}}' data-terminal-cloud-backend:test)"
web_version="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.version"}}' data-terminal-cloud-web:test)"
web_commit="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.revision"}}' data-terminal-cloud-web:test)"
web_time="$(docker image inspect --format='{{index .Config.Labels "org.opencontainers.image.created"}}' data-terminal-cloud-web:test)"
test "$backend_version" = "$PLATFORM_BUILD_VERSION"
test "$web_version" = "$PLATFORM_BUILD_VERSION"
test "$backend_commit" = "$GITHUB_SHA"
test "$web_commit" = "$GITHUB_SHA"
test "$backend_time" = "$PLATFORM_BUILD_TIME"
test "$web_time" = "$PLATFORM_BUILD_TIME"
jq -n --arg candidate_version "$PLATFORM_BUILD_VERSION" --arg source_commit "$GITHUB_SHA" --arg build_time "$PLATFORM_BUILD_TIME" --arg run_id "$GITHUB_RUN_ID" --arg run_attempt "$GITHUB_RUN_ATTEMPT" --arg backend_digest "$backend_digest" --arg web_digest "$web_digest" '{candidate_version:$candidate_version,source_commit:$source_commit,build_time:$build_time,run_id:$run_id,run_attempt:$run_attempt,backend_image_digest:$backend_digest,web_image_digest:$web_digest}' > artifacts/build-metadata.json
- uses: actions/upload-artifact@v4
with:
name: security-and-sbom