From b8703845db7e427287bd84593bc8e0c22edf80a9 Mon Sep 17 00:00:00 2001 From: Anton Date: Wed, 11 Mar 2026 18:34:08 +0000 Subject: [PATCH] Split into two workflows: build (push/PR/dispatch) and scheduled-update (daily version check) --- .github/workflows/build.yaml | 52 ++------ .github/workflows/scheduled-update.yaml | 160 ++++++++++++++++++++++++ 2 files changed, 173 insertions(+), 39 deletions(-) create mode 100644 .github/workflows/scheduled-update.yaml diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 8d6aadd..f7427f6 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -9,47 +9,27 @@ on: paths: - .github/workflows/build.yaml - build/* - schedule: - - cron: '0 6 * * *' workflow_dispatch: env: GHCR_REPO: ghcr.io/trent-maetzold/protonmail-bridge - PLATFORMS: linux/amd64,linux/arm64/v8,linux/arm/v7,linux/riscv64 jobs: - version-check: + resolve-version: runs-on: ubuntu-latest outputs: - version: ${{ steps.check.outputs.version }} - build_needed: ${{ steps.check.outputs.build_needed }} + version: ${{ steps.resolve.outputs.version }} steps: - name: Get latest upstream release - id: check + id: resolve run: | latest=$(curl -s https://api.github.com/repos/ProtonMail/proton-bridge/releases/latest | jq -r '.tag_name') - echo "Latest upstream: $latest" echo "version=$latest" >> $GITHUB_OUTPUT - if [[ "${{ github.event_name }}" == "schedule" ]]; then - # Check if we already have this version in GHCR - token=$(curl -s "https://ghcr.io/token?scope=repository:trent-maetzold/protonmail-bridge:pull" | jq -r '.token') - tags=$(curl -s -H "Authorization: Bearer $token" "https://ghcr.io/v2/trent-maetzold/protonmail-bridge/tags/list" | jq -r '.tags[]?' 2>/dev/null || echo "") - if echo "$tags" | grep -qx "${latest}-build"; then - echo "Version ${latest} already built" - echo "build_needed=false" >> $GITHUB_OUTPUT - else - echo "New version ${latest} detected" - echo "build_needed=true" >> $GITHUB_OUTPUT - fi - else - echo "build_needed=true" >> $GITHUB_OUTPUT - fi - test: runs-on: ubuntu-latest - needs: version-check - if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref != 'refs/heads/master') + needs: resolve-version + if: github.event_name == 'pull_request' steps: - name: Checkout uses: actions/checkout@v4 @@ -81,7 +61,7 @@ jobs: tags: "${{ env.GHCR_REPO }}:dev-${{ github.ref_name }}" push: true build-args: | - version=${{ needs.version-check.outputs.version }} + version=${{ needs.resolve-version.outputs.version }} - name: Run Trivy vulnerability scan uses: aquasecurity/trivy-action@0.30.0 @@ -99,14 +79,8 @@ jobs: build: runs-on: ubuntu-latest - needs: version-check - if: | - (github.event_name != 'pull_request') && - ( - (github.event_name == 'push' && github.ref == 'refs/heads/master') || - (github.event_name == 'workflow_dispatch') || - (github.event_name == 'schedule' && needs.version-check.outputs.build_needed == 'true') - ) + needs: resolve-version + if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' strategy: fail-fast: false matrix: @@ -155,7 +129,7 @@ jobs: provenance: false sbom: false build-args: | - version=${{ needs.version-check.outputs.version }} + version=${{ needs.resolve-version.outputs.version }} - name: Export digest run: | @@ -174,7 +148,7 @@ jobs: merge: runs-on: ubuntu-latest needs: - - version-check + - resolve-version - build steps: - name: Download digests @@ -202,7 +176,7 @@ jobs: with: images: ${{ env.GHCR_REPO }} tags: | - type=raw,enable=true,value=${{ needs.version-check.outputs.version }}-build + type=raw,enable=true,value=${{ needs.resolve-version.outputs.version }}-build type=raw,enable=true,value=build type=raw,enable=true,value=latest @@ -215,7 +189,7 @@ jobs: - name: Run Trivy vulnerability scan uses: aquasecurity/trivy-action@0.30.0 with: - image-ref: "${{ env.GHCR_REPO }}:${{ needs.version-check.outputs.version }}-build" + image-ref: "${{ env.GHCR_REPO }}:${{ needs.resolve-version.outputs.version }}-build" format: 'sarif' exit-code: 0 severity: 'CRITICAL,HIGH' @@ -228,4 +202,4 @@ jobs: - name: Inspect image run: | - docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ needs.version-check.outputs.version }}-build + docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ needs.resolve-version.outputs.version }}-build diff --git a/.github/workflows/scheduled-update.yaml b/.github/workflows/scheduled-update.yaml new file mode 100644 index 0000000..de493ff --- /dev/null +++ b/.github/workflows/scheduled-update.yaml @@ -0,0 +1,160 @@ +name: scheduled version check + +on: + schedule: + - cron: '0 6 * * *' + +env: + GHCR_REPO: ghcr.io/trent-maetzold/protonmail-bridge + +jobs: + check: + runs-on: ubuntu-latest + outputs: + version: ${{ steps.check.outputs.version }} + build_needed: ${{ steps.check.outputs.build_needed }} + steps: + - name: Check for new upstream version + id: check + run: | + latest=$(curl -s https://api.github.com/repos/ProtonMail/proton-bridge/releases/latest | jq -r '.tag_name') + echo "Latest upstream: $latest" + echo "version=$latest" >> $GITHUB_OUTPUT + + token=$(curl -s "https://ghcr.io/token?scope=repository:trent-maetzold/protonmail-bridge:pull" | jq -r '.token') + tags=$(curl -s -H "Authorization: Bearer $token" "https://ghcr.io/v2/trent-maetzold/protonmail-bridge/tags/list" | jq -r '.tags[]?' 2>/dev/null || echo "") + + if echo "$tags" | grep -qx "${latest}-build"; then + echo "Version ${latest} already built" + echo "build_needed=false" >> $GITHUB_OUTPUT + else + echo "New version ${latest} detected" + echo "build_needed=true" >> $GITHUB_OUTPUT + fi + + build: + needs: check + if: needs.check.outputs.build_needed == 'true' + strategy: + fail-fast: false + matrix: + platform: + - linux/amd64 + - linux/arm64/v8 + - linux/arm/v7 + - linux/riscv64 + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Prepare + run: | + platform=${{ matrix.platform }} + echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.GHCR_REPO }} + + - name: Login to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push by digest + id: build + uses: docker/build-push-action@v6 + with: + platforms: ${{ matrix.platform }} + labels: ${{ steps.meta.outputs.labels }} + outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true + context: ./build + file: ./build/Dockerfile + provenance: false + sbom: false + build-args: | + version=${{ needs.check.outputs.version }} + + - name: Export digest + run: | + mkdir -p ${{ runner.temp }}/digests + digest="${{ steps.build.outputs.digest }}" + touch "${{ runner.temp }}/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@v4 + with: + name: digests-${{ env.PLATFORM_PAIR }} + path: ${{ runner.temp }}/digests/* + if-no-files-found: error + retention-days: 1 + + merge: + runs-on: ubuntu-latest + needs: + - check + - build + steps: + - name: Download digests + uses: actions/download-artifact@v4 + with: + path: ${{ runner.temp }}/digests + pattern: digests-* + merge-multiple: true + + - name: Login to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.repository_owner }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + with: + driver-opts: network=host + + - name: Docker meta + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.GHCR_REPO }} + tags: | + type=raw,enable=true,value=${{ needs.check.outputs.version }}-build + type=raw,enable=true,value=build + type=raw,enable=true,value=latest + + - name: Create manifest list and push + working-directory: ${{ runner.temp }}/digests + run: | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ + $(printf '${{ env.GHCR_REPO }}@sha256:%s ' *) + + - name: Run Trivy vulnerability scan + uses: aquasecurity/trivy-action@0.30.0 + with: + image-ref: "${{ env.GHCR_REPO }}:${{ needs.check.outputs.version }}-build" + format: 'sarif' + exit-code: 0 + severity: 'CRITICAL,HIGH' + output: 'trivy-results.sarif' + + - name: Upload Trivy scan SARIF report + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: 'trivy-results.sarif' + + - name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ needs.check.outputs.version }}-build