mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-24 21:04:48 -06:00
Patrick Buckley
a9898fdd6c
The publish and docker workflows trigger on workflow_run of CI, which fires for every CI completion — including CI runs for pull requests from forks — and always executes with this repo's secrets, tokens, and the pypi environment. The only gate was CI success, so fork-PR CI runs spawned publish jobs in the upstream context; actions/checkout v7's fork-checkout refusal was the only thing that stopped one on 2026-06-30. A fork PR whose head is an upstream-tagged commit would have passed the tag check and reached the upload with valid OIDC. Both workflows now require the triggering CI run to be a push event, from this repository, with head_branch starting with 'v' — CI's push trigger only matches main/stable/* branches and v* tags, so that is necessarily a tag run (verified: tag-push runs report the tag name as head_branch). Checkouts no longer persist the token while the tree's build backend executes, and publishes are no longer cancellable mid-upload (a half-uploaded release cannot be re-run cleanly because PyPI rejects duplicate files). vendor-js hardening in the same pass: gate on the immutable PR author instead of github.actor, require a same-repo head before pushing to the PR branch with contents:write, and pass github.head_ref through env instead of interpolating it into the script body.
93 lines
3.1 KiB
YAML
93 lines
3.1 KiB
YAML
name: Publish Docker Image
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["CI"]
|
|
types: [completed]
|
|
|
|
concurrency:
|
|
group: docker-${{ github.event.workflow_run.head_sha }}
|
|
# Never cancel mid-push: an interrupted multi-tag push can leave the
|
|
# registry with a partial tag set (e.g. :latest moved, :stable not).
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
jobs:
|
|
docker:
|
|
# Same gate as publish.yml: workflow_run fires for every CI completion
|
|
# (including fork and same-repo PR runs) with this repo's token and
|
|
# packages:write. Only same-repo tag pushes may publish images; CI's
|
|
# push trigger matches main/stable/* and v* tags, so a head_branch
|
|
# starting with "v" is necessarily a tag run.
|
|
if: >-
|
|
github.event.workflow_run.conclusion == 'success' &&
|
|
github.event.workflow_run.event == 'push' &&
|
|
github.event.workflow_run.head_repository.full_name == github.repository &&
|
|
startsWith(github.event.workflow_run.head_branch, 'v')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
with:
|
|
ref: ${{ github.event.workflow_run.head_sha }}
|
|
fetch-depth: 0
|
|
# The docker build only reads the tree; keep the token out of it.
|
|
persist-credentials: false
|
|
|
|
- name: Resolve release tag
|
|
id: tag
|
|
run: |
|
|
TAG=$(git tag --points-at HEAD | grep '^v' | head -1)
|
|
if [ -z "$TAG" ]; then
|
|
echo "No v* tag at HEAD — skipping publish"
|
|
echo "skip=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
|
|
echo "skip=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Log in to GHCR
|
|
if: steps.tag.outputs.skip == 'false'
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Compute Docker tags
|
|
if: steps.tag.outputs.skip == 'false'
|
|
id: tags
|
|
env:
|
|
REF: ${{ steps.tag.outputs.tag }}
|
|
run: |
|
|
VERSION="${REF#v}"
|
|
FULL="${REGISTRY}/${IMAGE_NAME}"
|
|
FULL="${FULL,,}"
|
|
|
|
if echo "$VERSION" | grep -qE '(a|b|rc)[0-9]+$'; then
|
|
TAGS="${FULL}:${VERSION},${FULL}:experimental"
|
|
else
|
|
MINOR="${VERSION%.*}"
|
|
TAGS="${FULL}:${VERSION},${FULL}:${MINOR},${FULL}:stable,${FULL}:latest"
|
|
fi
|
|
echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
|
|
|
|
- uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
|
|
if: steps.tag.outputs.skip == 'false'
|
|
|
|
- name: Build and push
|
|
if: steps.tag.outputs.skip == 'false'
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.tags.outputs.tags }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|