deps(go): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 #979
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Build | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| build: | |
| name: Build (${{ matrix.image.short }}/${{ matrix.platform.arch }}) | |
| runs-on: ${{ matrix.platform.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: | |
| - name: windshiftapp/windshift | |
| dockerfile: Dockerfile | |
| short: windshift | |
| - name: windshiftapp/ws-carrier | |
| dockerfile: deploy/coding-agent/Dockerfile | |
| short: ws-carrier | |
| - name: windshiftapp/windshift-runner | |
| dockerfile: deploy/windshift-runner/Dockerfile | |
| short: windshift-runner | |
| platform: | |
| - os: linux/amd64 | |
| runner: ubuntu-latest | |
| arch: amd64 | |
| - os: linux/arm64 | |
| runner: ubuntu-24.04-arm | |
| arch: arm64 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Log in to Container Registry | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ matrix.image.name }} | |
| - name: Compute build metadata | |
| id: build_meta | |
| shell: bash | |
| run: | | |
| version="dev" | |
| if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then | |
| version="$GITHUB_REF_NAME" | |
| fi | |
| echo "version=${version}" >> "$GITHUB_OUTPUT" | |
| echo "commit=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" | |
| echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT" | |
| - name: Build and push per-arch staging tag | |
| id: build | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 | |
| with: | |
| context: . | |
| file: ${{ matrix.image.dockerfile }} | |
| # The platform always matches the runner's native arch, so BuildKit | |
| # never reaches for QEMU — but it MUST be passed explicitly: without | |
| # --platform, TARGETOS/TARGETARCH stay unset and Dockerfile ARG | |
| # defaults decide what the Go cross-compile targets. That once put | |
| # x86_64 binaries inside the arm64 runner image, silently emulated | |
| # via qemu binfmt on the host (WI-394). Each arch is pushed under its | |
| # own per-commit staging TAG; the merge job combines the two into the | |
| # real tags. | |
| platforms: ${{ matrix.platform.os }} | |
| # We push by tag, NOT push-by-digest, on purpose: buildkit's | |
| # default provenance makes even a single-platform build a manifest | |
| # index, and the index digest from steps.build.outputs.digest was not | |
| # resolvable at merge time for the large server image | |
| # (docker/build-push-action#755). A registry tag always resolves, so | |
| # the merge is reliable — and provenance/attestations are preserved. | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.image.short }}-${{ matrix.platform.arch }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.image.short }}-${{ matrix.platform.arch }} | |
| build-args: | | |
| VERSION=${{ steps.build_meta.outputs.version }} | |
| RELEASE_NAME= | |
| COMMIT=${{ steps.build_meta.outputs.commit }} | |
| BUILD_DATE=${{ steps.build_meta.outputs.date }} | |
| tags: ${{ env.REGISTRY }}/${{ matrix.image.name }}:stage-${{ github.sha }}-${{ matrix.platform.arch }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| merge: | |
| name: Merge Manifests (${{ matrix.image.short }}) | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'pull_request' | |
| needs: build | |
| strategy: | |
| # One image's merge hiccup must not cancel the others' publishes. | |
| fail-fast: false | |
| matrix: | |
| image: | |
| - name: windshiftapp/windshift | |
| short: windshift | |
| - name: windshiftapp/ws-carrier | |
| short: ws-carrier | |
| - name: windshiftapp/windshift-runner | |
| short: windshift-runner | |
| steps: | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ matrix.image.name }} | |
| tags: | | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-dev') && !contains(github.ref, '-test') && !contains(github.ref, '-rc') }} | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }} | |
| type=sha,prefix= | |
| - name: Create manifest list from per-arch staging tags | |
| env: | |
| IMG: ${{ env.REGISTRY }}/${{ matrix.image.name }} | |
| STAGE: stage-${{ github.sha }} | |
| run: | | |
| # Combine the two per-arch staging tags into the final tags. Tags | |
| # always resolve in the registry (unlike a by-digest index digest), | |
| # so this is reliable. A short retry covers transient registry blips. | |
| create() { | |
| docker buildx imagetools create \ | |
| $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | |
| "${IMG}:${STAGE}-amd64" "${IMG}:${STAGE}-arm64" | |
| } | |
| for attempt in 1 2 3; do | |
| if create; then | |
| echo "manifest created (attempt ${attempt})" | |
| exit 0 | |
| fi | |
| echo "imagetools create failed (attempt ${attempt}); retrying in 10s..." | |
| sleep 10 | |
| done | |
| echo "imagetools create still failing after retries" | |
| exit 1 | |
| - name: Inspect image | |
| run: | | |
| docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ matrix.image.name }}:${{ steps.meta.outputs.version }} | |
| - name: Prune per-arch staging tags | |
| if: always() | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PKG: ${{ matrix.image.short }} | |
| run: | | |
| # Best-effort cleanup: delete the two ephemeral stage-<sha>-<arch> | |
| # tags now that the real multi-arch manifest is published. Never fails | |
| # the job — leftover staging tags are harmless if this can't run. | |
| for arch in amd64 arm64; do | |
| tag="stage-${{ github.sha }}-${arch}" | |
| vid=$(gh api --paginate "/orgs/windshiftapp/packages/container/${PKG}/versions" \ | |
| --jq ".[] | select(.metadata.container.tags | index(\"${tag}\")) | .id" | head -n1) | |
| if [ -n "$vid" ]; then | |
| gh api --method DELETE "/orgs/windshiftapp/packages/container/${PKG}/versions/${vid}" \ | |
| && echo "pruned ${tag} (version ${vid})" || echo "could not prune ${tag}" | |
| else | |
| echo "no version found for ${tag}" | |
| fi | |
| done |