Merge dev to main: Security improvements and comprehensive test infrastructure #39
@@ -18,18 +18,9 @@ concurrency:
|
|||||||
jobs:
|
jobs:
|
||||||
deploy-claude-dev-dev:
|
deploy-claude-dev-dev:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
container:
|
|
||||||
volumes:
|
|
||||||
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
|
|
||||||
- /volume1/docker/claude-dev:/claude-dev-runtime
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout exact commit
|
- name: Checkout repository
|
||||||
run: |
|
uses: actions/checkout@v4
|
||||||
set -euo pipefail
|
|
||||||
git init .
|
|
||||||
git remote add origin http://gitea:3000/jimmy/nas-tools.git
|
|
||||||
git fetch --depth 1 origin "$GITHUB_SHA"
|
|
||||||
git checkout --detach FETCH_HEAD
|
|
||||||
|
|
||||||
- name: Resolve image tags
|
- name: Resolve image tags
|
||||||
run: |
|
run: |
|
||||||
@@ -89,10 +80,10 @@ jobs:
|
|||||||
- name: Record previous image
|
- name: Record previous image
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
mkdir -p /claude-dev-runtime
|
mkdir -p /volume1/docker/claude-dev
|
||||||
previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
|
previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
|
||||||
if [ -n "$previous_image" ]; then
|
if [ -n "$previous_image" ]; then
|
||||||
printf '%s\n' "$previous_image" > /claude-dev-runtime/previous-image.txt
|
printf '%s\n' "$previous_image" > /volume1/docker/claude-dev/previous-image.txt
|
||||||
echo "Saved previous image: $previous_image"
|
echo "Saved previous image: $previous_image"
|
||||||
else
|
else
|
||||||
echo "No existing claude-dev container found"
|
echo "No existing claude-dev container found"
|
||||||
@@ -101,8 +92,8 @@ jobs:
|
|||||||
- name: Sync compose and target tag
|
- name: Sync compose and target tag
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
cp claude-dev/docker-compose.yml /claude-dev-runtime/docker-compose.yml
|
cp claude-dev/docker-compose.yml /volume1/docker/claude-dev/docker-compose.yml
|
||||||
printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /claude-dev-runtime/target-tag.txt
|
printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /volume1/docker/claude-dev/target-tag.txt
|
||||||
|
|
||||||
- name: Remove stale claude-dev container
|
- name: Remove stale claude-dev container
|
||||||
run: docker rm -f claude-dev || true
|
run: docker rm -f claude-dev || true
|
||||||
@@ -110,7 +101,7 @@ jobs:
|
|||||||
- name: Deploy claude-dev
|
- name: Deploy claude-dev
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /claude-dev-runtime/docker-compose.yml up -d --pull never
|
CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /volume1/docker/claude-dev/docker-compose.yml up -d --pull never
|
||||||
|
|
||||||
- name: Post-deploy runtime checks
|
- name: Post-deploy runtime checks
|
||||||
run: |
|
run: |
|
||||||
|
|||||||
@@ -13,19 +13,9 @@ concurrency:
|
|||||||
jobs:
|
jobs:
|
||||||
deploy-dev:
|
deploy-dev:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
container:
|
|
||||||
options: --pid=host
|
|
||||||
volumes:
|
|
||||||
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
|
|
||||||
- /volume1/docker/nas-dashboard:/nas-dashboard
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout exact commit
|
- name: Checkout repository
|
||||||
run: |
|
uses: actions/checkout@v4
|
||||||
set -euo pipefail
|
|
||||||
git init .
|
|
||||||
git remote add origin http://gitea:3000/jimmy/nas-tools.git
|
|
||||||
git fetch --depth 1 origin "$GITHUB_SHA"
|
|
||||||
git checkout --detach FETCH_HEAD
|
|
||||||
- name: Warm mirror cache for base images
|
- name: Warm mirror cache for base images
|
||||||
run: |
|
run: |
|
||||||
set -u
|
set -u
|
||||||
@@ -61,19 +51,11 @@ jobs:
|
|||||||
export DOCKER_API_VERSION=1.43
|
export DOCKER_API_VERSION=1.43
|
||||||
DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
|
DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
|
||||||
- name: Sync runtime compose file
|
- name: Sync runtime compose file
|
||||||
run: cp dashboard/docker-compose.dev.yml /nas-dashboard/docker-compose.dev.yml
|
run: cp dashboard/docker-compose.dev.yml /volume1/docker/nas-dashboard/docker-compose.dev.yml
|
||||||
- name: Deploy dev
|
- name: Deploy dev
|
||||||
run: |
|
run: |
|
||||||
export DOCKER_API_VERSION=1.43
|
|
||||||
# Write deploy script to mounted volume (accessible from both container and host)
|
|
||||||
cat > /nas-dashboard/deploy.sh << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
export DOCKER_API_VERSION=1.43
|
export DOCKER_API_VERSION=1.43
|
||||||
cd /volume1/docker/nas-dashboard
|
cd /volume1/docker/nas-dashboard
|
||||||
/volume1/@appstore/ContainerManager/usr/bin/docker rm -f nas-dashboard-dev || true
|
docker rm -f nas-dashboard-dev || true
|
||||||
/volume1/@appstore/ContainerManager/usr/bin/docker compose -f docker-compose.dev.yml up -d --pull never
|
docker compose -f docker-compose.dev.yml up -d --pull never
|
||||||
EOF
|
|
||||||
chmod +x /nas-dashboard/deploy.sh
|
|
||||||
# Execute script on host using the host path
|
|
||||||
nsenter -t 1 -m -n /volume1/docker/nas-dashboard/deploy.sh
|
|
||||||
|
|||||||
+11
-14
@@ -15,18 +15,17 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
run: |
|
uses: actions/checkout@v4
|
||||||
git clone http://gitea:3000/jimmy/nas-tools.git .
|
|
||||||
git checkout ${{ github.sha }}
|
|
||||||
|
|
||||||
- name: Install Python
|
- name: Set up Python
|
||||||
run: |
|
uses: actions/setup-python@v5
|
||||||
apt-get update && apt-get install -y python3 python3-pip python3-venv
|
with:
|
||||||
|
python-version: '3.12'
|
||||||
|
|
||||||
- name: Install dependencies
|
- name: Install dependencies
|
||||||
run: |
|
run: |
|
||||||
cd dashboard/backend
|
cd dashboard/backend
|
||||||
python3 -m venv venv
|
python -m venv venv
|
||||||
. venv/bin/activate
|
. venv/bin/activate
|
||||||
pip install -r requirements.txt
|
pip install -r requirements.txt
|
||||||
pip install -r requirements-dev.txt
|
pip install -r requirements-dev.txt
|
||||||
@@ -52,14 +51,12 @@ jobs:
|
|||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
run: |
|
uses: actions/checkout@v4
|
||||||
git clone http://gitea:3000/jimmy/nas-tools.git .
|
|
||||||
git checkout ${{ github.sha }}
|
|
||||||
|
|
||||||
- name: Install Node.js
|
- name: Set up Node.js
|
||||||
run: |
|
uses: actions/setup-node@v4
|
||||||
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
|
with:
|
||||||
apt-get install -y nodejs
|
node-version: '20'
|
||||||
|
|
||||||
- name: Install dependencies
|
- name: Install dependencies
|
||||||
run: |
|
run: |
|
||||||
|
|||||||
Reference in New Issue
Block a user