revaks/yay
1
0 Fork 0
mirror of https://github.com/Jguer/yay.git synced 2026-10-07 12:06:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Lock actions in CI (#2829)

Browse Source 
* update dockerfile

* lock actions

* remove dockerhub

* fix golangci-lint install in ci image
This commit is contained in:
Jo authored and GitHub committed 2026-06-05 09:59:47 +02:00
1 parent ae3b25e98e
commit e03be81baa
7 files changed
+48 -59
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.devcontainer/Dockerfile
+14 -20
View File
@@ -1,4 +1,4 @@
FROM quay.io/gmanka/archlinuxarm:base-devel
FROM --platform=linux/amd64 archlinux@sha256:80ee11bda3cb40c46061bbc91db00e3eb8e6147cb17189b4dc9554e501c791a0
LABEL maintainer="Jguer,docker@jguer.space"
ENV GO111MODULE=on
@@ -6,36 +6,30 @@ WORKDIR /app
COPY go.mod .
# asciidoc, doxygen, meson needed for pacman-git
# Disable pacman's landlock/seccomp sandbox: it doesn't work inside BuildKit.
# asciidoc, doxygen, meson needed for pacman-git.
RUN set -eux; \
pacman-key --init; \
sed -i 's/^#DisableSandboxFilesystem/DisableSandboxFilesystem/' /etc/pacman.conf; \
sed -i 's/^#DisableSandboxSyscalls/DisableSandboxSyscalls/' /etc/pacman.conf; \
pacman -Syu --noconfirm --needed pacman-contrib fish git-delta openssh bat go github-cli archlinux-keyring pacman go git gcc make base-devel sudo asciidoc doxygen meson; \
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.10.1; \
sed -i 's/^#\?DisableSandbox.*/DisableSandbox/' /etc/pacman.conf || true; \
sed -i 's/^#\?DownloadUser.*/#DownloadUser = alpm/' /etc/pacman.conf || true; \
pacman -Syu --noconfirm --needed \
pacman-contrib zsh git-delta openssh bat go github-cli \
archlinux-keyring git gcc make sudo asciidoc doxygen meson curl; \
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.12.2; \
go mod download; \
rm -rf /var/lib/pacman/sync/* /var/cache/pacman/* /tmp/* /var/tmp/*; \
rm -rf /usr/share/man/* /usr/share/doc/* || true; \
yes | pacman -Scc >/dev/null 2>&1 || true
rm -rf /usr/share/man/* /usr/share/doc/* || true
# Non-root user with passwordless sudo
RUN useradd -m -s /bin/bash docker \
&& echo "docker ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/docker
# Create a non-root user first
RUN useradd -m -s /bin/bash docker
# Set passwordless sudo for the docker user
RUN echo "docker ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/docker
# Switch to the docker user
USER docker
# Install xgotext
RUN go install github.com/leonelquinteros/gotext/cli/xgotext@latest
# Add /app/bin to the PATH
ENV PATH="/app/bin:/home/docker/go/bin:$PATH"
# Set the working directory
WORKDIR /workspace
# Command to run when starting the container
CMD ["fish"]
CMD ["zsh"]
.devcontainer/devcontainer.json
+7 -1
View File
@@ -2,8 +2,14 @@
"name": "Existing Dockerfile",
"build": {
"context": "..",
"dockerfile": "../.devcontainer/Dockerfile"
"dockerfile": "../.devcontainer/Dockerfile",
"options": [
"--platform=linux/amd64"
]
},
"runArgs": [
"--platform=linux/amd64"
],
"overrideCommand": true,
"customizations": {
"vscode": {
.github/workflows/builder-image.yml
+11 -11
View File
@@ -23,16 +23,16 @@ jobs:
- linux/arm64
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -40,7 +40,7 @@ jobs:
- name: Extract metadata for Docker
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
with:
images: |
ghcr.io/${{ env.REGISTRY_IMAGE }}
@@ -50,7 +50,7 @@ jobs:
- name: Build and push by digest
id: build
uses: docker/build-push-action@v5
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
file: ci.Dockerfile
@@ -65,7 +65,7 @@ jobs:
echo -n "$digest" > "/tmp/digests/$(echo "${{ matrix.platform }}" | tr '/' '_')"
- name: Upload digest
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || matrix.platform == 'linux/arm/v7' && 'armv7' || 'arm64' }}
path: /tmp/digests/*
@@ -77,17 +77,17 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Download digests
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: digest-*
merge-multiple: true
path: /tmp/digests
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
@@ -95,7 +95,7 @@ jobs:
- name: Extract metadata for Docker
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
with:
images: |
ghcr.io/${{ env.REGISTRY_IMAGE }}
.github/workflows/multiarch-build.yml
+7 -13
View File
@@ -14,21 +14,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Read info
id: tags
@@ -50,7 +44,7 @@ jobs:
make docker-release ARCH=${{ steps.tags.outputs.arch }} VERSION=${{ steps.tags.outputs.version }} PREFIX="/usr"
mv *.tar.gz artifacts
- uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: yay_${{ steps.tags.outputs.arch }}
path: artifacts
@@ -63,7 +57,7 @@ jobs:
contents: write
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
@@ -73,7 +67,7 @@ jobs:
echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: yay_*
merge-multiple: true
@@ -88,6 +82,6 @@ jobs:
./yay_${{ steps.tags.outputs.version }}_*.tar.gz
- name: Release Notary Action
uses: docker://aevea/release-notary:latest
uses: docker://aevea/release-notary@sha256:690915bf87458fd8eb1e1ff0be34b33377f920eda3f38b96c62ecbf897c831f4
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
.github/workflows/testing-git.yml
+4 -9
View File
@@ -14,22 +14,17 @@ jobs:
container:
image: ghcr.io/jguer/yay-builder:latest
steps:
- uses: actions/checkout@v4
- uses: actions/cache@v3
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- uses: actions/cache@v3
with:
path: /home/runner/work/yay/yay/pacman-git
key: ${{ runner.os }}-pacman-${{ hashFiles('/home/runner/work/yay/yay/pacman-git/PKGBUILD') }}
restore-keys: |
${{ runner.os }}-pacman-
- name: checkout pacman-git
run: |
git -C ./pacman-git pull || git clone https://aur.archlinux.org/pacman-git
rm -rf pacman-git
git clone --depth=1 https://aur.archlinux.org/pacman-git
useradd github
echo 'github ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
chmod -R 777 pacman-git
.github/workflows/testing.yml
+3 -3
View File
@@ -9,8 +9,8 @@ jobs:
container:
image: ghcr.io/jguer/yay-builder:latest
steps:
- uses: actions/checkout@v4
- uses: actions/cache@v3
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -36,7 +36,7 @@ jobs:
GOFLAGS: -buildvcs=false -tags=next
run: make
- name: Upload yay Artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: yay
path: ./yay
ci.Dockerfile
+2 -2
View File
@@ -1,4 +1,4 @@
FROM quay.io/gmanka/archlinuxarm:base-devel
FROM quay.io/gmanka/archlinuxarm:base-devel@sha256:1f2eccbd8730a0e199e86808ea9728a2c29efb290401cfb8dcd12da849d93e1f
LABEL maintainer="Jguer,docker@jguer.space"
ENV GO111MODULE=on
@@ -12,7 +12,7 @@ RUN set -eux; \
sed -i 's/^#DisableSandboxFilesystem/DisableSandboxFilesystem/' /etc/pacman.conf; \
sed -i 's/^#DisableSandboxSyscalls/DisableSandboxSyscalls/' /etc/pacman.conf; \
pacman -Syu --noconfirm --needed archlinux-keyring pacman go git gcc make base-devel sudo asciidoc doxygen meson; \
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v2.10.1; \
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.12.2; \
go mod download; \
rm -rf /var/lib/pacman/sync/* /var/cache/pacman/* /tmp/* /var/tmp/*; \
rm -rf /usr/share/man/* /usr/share/doc/* || true; \