fix: bump vulnerable dependencies (#306) #186
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: deploy | |
| on: | |
| push: | |
| branches: | |
| - main # → staging | |
| tags: | |
| - "v*" # → production | |
| paths-ignore: | |
| - "docs/**" | |
| - "**/*.md" | |
| - ".github/ISSUE_TEMPLATE/**" | |
| - ".github/workflows/pr-checklist.yml" | |
| - ".github/workflows/e2e-full.yml" | |
| - ".github/workflows/pr-validate.yml" | |
| - ".husky/**" | |
| - "scripts/__tests__/**" | |
| - "biome.json" | |
| - "commitlint.config.js" | |
| - "vitest.config.ts" | |
| - ".gitignore" | |
| - ".env.example" | |
| - ".gitattributes" | |
| - ".github/PULL_REQUEST_TEMPLATE.md" | |
| - "version.txt" | |
| jobs: | |
| release-prep: | |
| name: Release prep (${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }}) | |
| runs-on: ubuntu-latest | |
| environment: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| outputs: | |
| release-version: ${{ steps.resolve-version.outputs.release-version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4 | |
| with: | |
| version: 9.12.0 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: "22" | |
| cache: "pnpm" | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Preflight Cloudflare deploy prerequisites | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| ZEROLINK_DEPLOY_ENV: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }} | |
| run: pnpm deploy:preflight | |
| - name: Resolve release version | |
| id: resolve-version | |
| shell: bash | |
| run: | | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| else | |
| SHORT_SHA="$(git rev-parse --short HEAD)" | |
| VERSION="0.0.0-dev+${SHORT_SHA}" | |
| fi | |
| echo "release-version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| echo "ZEROLINK_VERSION=${VERSION}" >> "$GITHUB_ENV" | |
| echo "Resolved release version: ${VERSION}" | |
| - name: Build frontend | |
| env: | |
| VITE_RELEASE_VERIFICATION_REQUIRED: "true" | |
| run: pnpm --filter @zerolink/frontend build | |
| - name: Generate manifest | |
| run: pnpm manifest:generate | |
| - name: Sign manifest | |
| env: | |
| MANIFEST_SIGNING_KEY: ${{ secrets.MANIFEST_SIGNING_KEY }} | |
| run: pnpm manifest:sign | |
| - name: Verify manifest | |
| run: pnpm manifest:verify | |
| - name: Prepare self-host web build context | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| mkdir -p deploy/selfhost/release-context/frontend-dist | |
| cp deploy/selfhost/Caddyfile deploy/selfhost/release-context/Caddyfile | |
| cp deploy/selfhost/frontend.Dockerfile deploy/selfhost/release-context/frontend.Dockerfile | |
| cp -R packages/frontend/dist/. deploy/selfhost/release-context/frontend-dist/ | |
| - name: Upload self-host web build context | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: selfhost-web-context-${{ github.sha }} | |
| path: deploy/selfhost/release-context | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Pack frontend dist | |
| run: tar -czf frontend-dist.tar.gz -C packages/frontend dist | |
| - name: Upload frontend dist | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: frontend-dist-${{ github.sha }} | |
| path: frontend-dist.tar.gz | |
| if-no-files-found: error | |
| retention-days: 1 | |
| build-selfhost-api-image: | |
| name: Build self-host API image | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: release-prep | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Build and push self-host API image | |
| env: | |
| ZEROLINK_VERSION: ${{ needs.release-prep.outputs.release-version }} | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: services/selfhost-api | |
| file: deploy/selfhost/api.Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/zerolink-api:latest | |
| ghcr.io/${{ github.repository_owner }}/zerolink-api:${{ env.ZEROLINK_VERSION }} | |
| labels: | | |
| org.opencontainers.image.title=zerolink-api | |
| org.opencontainers.image.description=ZeroLink self-hosted API image | |
| org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.version=${{ env.ZEROLINK_VERSION }} | |
| cache-from: type=gha,scope=zerolink-api | |
| cache-to: type=gha,mode=max,scope=zerolink-api | |
| provenance: mode=max | |
| sbom: true | |
| build-selfhost-web-image: | |
| name: Build self-host web image | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: release-prep | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Download self-host web build context | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: selfhost-web-context-${{ github.sha }} | |
| path: deploy/selfhost/release-context | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| - name: Build and push self-host web image | |
| env: | |
| ZEROLINK_VERSION: ${{ needs.release-prep.outputs.release-version }} | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: deploy/selfhost/release-context | |
| file: deploy/selfhost/release-context/frontend.Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/zerolink-web:latest | |
| ghcr.io/${{ github.repository_owner }}/zerolink-web:${{ env.ZEROLINK_VERSION }} | |
| labels: | | |
| org.opencontainers.image.title=zerolink-web | |
| org.opencontainers.image.description=ZeroLink self-hosted web image | |
| org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.version=${{ env.ZEROLINK_VERSION }} | |
| cache-from: type=gha,scope=zerolink-web | |
| cache-to: type=gha,mode=max,scope=zerolink-web | |
| provenance: mode=max | |
| sbom: true | |
| deploy-production: | |
| name: Deploy (production) | |
| if: startsWith(github.ref, 'refs/tags/') | |
| needs: | |
| - release-prep | |
| - build-selfhost-api-image | |
| - build-selfhost-web-image | |
| runs-on: ubuntu-latest | |
| environment: production | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4 | |
| with: | |
| version: 9.12.0 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: "22" | |
| cache: "pnpm" | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Download frontend dist | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: frontend-dist-${{ github.sha }} | |
| path: . | |
| - name: Restore frontend dist | |
| run: tar -xzf frontend-dist.tar.gz -C packages/frontend && rm frontend-dist.tar.gz | |
| - name: Deploy (production) | |
| working-directory: packages/backend | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| run: npx wrangler deploy | |
| deploy-staging: | |
| name: Deploy (staging) | |
| if: "!startsWith(github.ref, 'refs/tags/')" | |
| needs: release-prep | |
| runs-on: ubuntu-latest | |
| environment: staging | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4 | |
| with: | |
| version: 9.12.0 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 | |
| with: | |
| node-version: "22" | |
| cache: "pnpm" | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Download frontend dist | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: frontend-dist-${{ github.sha }} | |
| path: . | |
| - name: Restore frontend dist | |
| run: tar -xzf frontend-dist.tar.gz -C packages/frontend && rm frontend-dist.tar.gz | |
| - name: Deploy (staging) | |
| working-directory: packages/backend | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | |
| run: npx wrangler deploy --env staging | |
| - name: Install Playwright browsers | |
| working-directory: packages/frontend | |
| run: pnpm exec playwright install --with-deps chromium | |
| - name: Smoke test staging | |
| env: | |
| STAGING_URL: https://staging.zerolink.dev | |
| run: pnpm --filter @zerolink/frontend test:e2e:smoke |