ITQ/movienight-backend
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

ci: added basic CI #36

Merged
devitq merged 10 commits from ci/build-pipeline into develop 2026-05-03 10:21:14 +00:00
Conversation 2 Commits 10 Files Changed 6
+59 -19
1 changed files with 59 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1795064710 - Show all commits
.github/workflows/ci.yaml
+59 -19
View File
@@ -1,19 +1,59 @@
- name: Send Telegram notification
env:
TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
VERSION: ${{ inputs.version }}
REPO: ${{ github.repository }}
DIGEST: ${{ inputs.image-digest }}
run: |
RELEASE_URL="https://github.com/${REPO}/releases/tag/${VERSION}"
MSG="*${REPO}* - released *${VERSION}*"
MSG="${MSG}%0A🔗 [Release notes](${RELEASE_URL})"
if [ -n "${DIGEST}" ]; then
MSG="${MSG}%0AImage: \`ghcr.io/${REPO}@${DIGEST}\`"
fi
curl -sf -X POST \
"https://api.telegram.org/bot${TOKEN}/sendMessage" \
-d "chat_id=${CHAT_ID}" \
-d "parse_mode=Markdown" \
-d "text=${MSG}"
name: CI
run-name: "${{ github.ref_name }} - ${{ github.event_name }} by @${{ github.actor }}"
on:
push:
branches: [develop, main]
tags: ["v*"]
pull_request:
branches: [develop, main]
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
build:
name: Build & Test
uses: ./.github/workflows/build.yaml
permissions:
contents: read
docker:
name: Docker
needs: build
uses: ./.github/workflows/docker.yaml
permissions:
contents: read
copilot-pull-request-reviewer[bot] commented 2026-05-03 10:24:00 +00:00 (Migrated from github.com)
Review
Copy Link
Copy Source

Using trufflesecurity/trufflehog@main makes CI depend on a moving branch tip, which is a supply-chain risk and can break builds unexpectedly. Pin this to a released tag or a specific commit SHA so scans are reproducible.

Using `trufflesecurity/trufflehog@main` makes CI depend on a moving branch tip, which is a supply-chain risk and can break builds unexpectedly. Pin this to a released tag or a specific commit SHA so scans are reproducible.
packages: write
with:
push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
secrets: inherit
telegram-notify:
name: Send Telegram Notification
needs: docker
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Send Telegram notification
env:
TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
VERSION: ${{ github.ref_name }}
REPO: ${{ github.repository }}
copilot-pull-request-reviewer[bot] commented 2026-05-03 10:24:00 +00:00 (Migrated from github.com)
Review
Copy Link
Copy Source

secrets: inherit is enabled for the docker reusable workflow even on pull_request runs (where push is false). This unnecessarily exposes repository secrets to PR workflows; remove secrets: inherit here or split the job so secrets are only provided for main/tag pushes.

`secrets: inherit` is enabled for the `docker` reusable workflow even on pull_request runs (where `push` is false). This unnecessarily exposes repository secrets to PR workflows; remove `secrets: inherit` here or split the job so secrets are only provided for main/tag pushes.
DIGEST: ${{ needs.docker.outputs.image-digest }}
run: |
RELEASE_URL="https://github.com/${REPO}/releases/tag/${VERSION}"
MSG="*${REPO}* - released *${VERSION}*"
MSG="${MSG}%0A🔗 [Release notes](${RELEASE_URL})"
if [ -n "${DIGEST}" ]; then
MSG="${MSG}%0AImage: \`ghcr.io/${REPO}@${DIGEST}\`"
fi
curl -sf -X POST \
"https://api.telegram.org/bot${TOKEN}/sendMessage" \
-d "chat_id=${CHAT_ID}" \
-d "parse_mode=Markdown" \
-d "text=${MSG}"