#19: silence the CI annotations and stop cancelling a run on every merge
Concurrency. release.yml calls ci.yml, so a push to main started the called workflow and the standalone one, both landing in the concurrency group ci-<ref>. One cancelled the other and every merge left a cancelled run behind. main is now excluded from the push trigger: release.yml is already the entry point there, and pull_request still covers changes before they land. Node 20 deprecation (23 warnings). Every action was pinned to a major that still declares node20. Each replacement was checked by reading the action.yml at the new tag and confirming "using: node24", and the inputs in use were confirmed to still exist there: checkout v4->v7, setup-node v4->v7, setup-go v5->v7, upload-artifact v4->v7, download-artifact v4->v7, setup-buildx-action v3->v4, build-push-action v6->v7, login-action v3->v4, metadata-action v5->v6 download-artifact has a v8, but v7 is also node24 and matches the upload side, so the pair stays on one major. trivy-action is a composite action and has no Node runtime to deprecate. Go cache (1 warning). setup-go looked for go.sum at the repository root and skipped its cache: defaults.run.working-directory applies to run steps, not to actions. cache-dependency-path now points at services/protocols/go.sum. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Lucas RayanandClaude Opus 5 committed
1 parent
a9960d1c7c
commit
43dcea1ade
2 files changed
+37
-27
No files matched your search
+26
-16
@@ -2,9 +2,14 @@ name: CI
|
||||
|
||||
# Runs on every branch and pull request. Publishing lives in release.yml and
|
||||
# only runs once this workflow has passed.
|
||||
#
|
||||
# main is excluded from the push trigger on purpose: release.yml already calls
|
||||
# this workflow there. Running both would put two jobs in the same concurrency
|
||||
# group, and one would cancel the other - which is why every merge used to
|
||||
# leave a cancelled CI run behind.
|
||||
on:
|
||||
push:
|
||||
branches: ['**']
|
||||
branches-ignore: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
workflow_call:
|
||||
@@ -18,7 +23,7 @@ jobs:
|
||||
name: Lint de idioma (R9)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
- run: node scripts/lang-lint.mjs
|
||||
|
||||
go-protocols:
|
||||
@@ -42,9 +47,14 @@ jobs:
|
||||
run:
|
||||
working-directory: services/protocols
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-go@v5
|
||||
with: { go-version-file: services/protocols/go.mod }
|
||||
- uses: actions/checkout@v7
|
||||
- uses: actions/setup-go@v7
|
||||
with:
|
||||
go-version-file: services/protocols/go.mod
|
||||
# defaults.run.working-directory applies to run steps, not to
|
||||
# actions, so setup-go looks for go.sum at the repository root and
|
||||
# silently skips its cache without this.
|
||||
cache-dependency-path: services/protocols/go.sum
|
||||
- name: Run migrations
|
||||
run: |
|
||||
docker run --rm --network host \
|
||||
@@ -65,8 +75,8 @@ jobs:
|
||||
run:
|
||||
working-directory: services/auth
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
- uses: actions/checkout@v7
|
||||
- uses: actions/setup-node@v7
|
||||
with: { node-version: "20" }
|
||||
- run: npm install
|
||||
- run: npm run lint
|
||||
@@ -79,8 +89,8 @@ jobs:
|
||||
run:
|
||||
working-directory: services/storage
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
- uses: actions/checkout@v7
|
||||
- uses: actions/setup-node@v7
|
||||
with: { node-version: "20" }
|
||||
- run: npm install
|
||||
- run: npm run lint
|
||||
@@ -93,8 +103,8 @@ jobs:
|
||||
run:
|
||||
working-directory: services/webmail
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
- uses: actions/checkout@v7
|
||||
- uses: actions/setup-node@v7
|
||||
with: { node-version: "20" }
|
||||
- run: npm install
|
||||
- run: npm run build
|
||||
@@ -103,7 +113,7 @@ jobs:
|
||||
name: Trivy (dependências, segredos e Dockerfiles)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
# A mail server holds credentials for every mailbox it serves, so the
|
||||
# secret scanner matters as much as the vulnerability one here: a DKIM
|
||||
@@ -125,14 +135,14 @@ jobs:
|
||||
matrix:
|
||||
service: [protocols, auth, storage, webmail]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/setup-buildx-action@v4
|
||||
|
||||
# Built but not pushed: this proves each Dockerfile still works on every
|
||||
# branch, while publishing stays in release.yml.
|
||||
- name: Build
|
||||
uses: docker/build-push-action@v6
|
||||
uses: docker/build-push-action@v7
|
||||
with:
|
||||
context: services/${{ matrix.service }}
|
||||
push: false
|
||||
@@ -153,7 +163,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [go-protocols, ts-auth, ts-storage, webmail-build]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
- run: cp .env.example .env
|
||||
# The proxy network is declared external because Coolify owns it on the
|
||||
# deploy host. Nothing creates it here, and without it compose refuses to
|
||||
|
||||
@@ -60,12 +60,12 @@ jobs:
|
||||
runner: ubuntu-24.04-arm
|
||||
arch: arm64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/setup-buildx-action@v4
|
||||
|
||||
- name: Autentica no GHCR
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
@@ -73,7 +73,7 @@ jobs:
|
||||
|
||||
- name: Metadados
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
uses: docker/metadata-action@v6
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}
|
||||
|
||||
@@ -81,7 +81,7 @@ jobs:
|
||||
# architectures exist and can be joined into a single manifest list.
|
||||
- name: Build e push por digest
|
||||
id: build
|
||||
uses: docker/build-push-action@v6
|
||||
uses: docker/build-push-action@v7
|
||||
with:
|
||||
context: services/${{ matrix.service }}
|
||||
platforms: ${{ matrix.platform }}
|
||||
@@ -99,7 +99,7 @@ jobs:
|
||||
touch "/tmp/digests/${digest#sha256:}"
|
||||
|
||||
- name: Guarda o digest
|
||||
uses: actions/upload-artifact@v4
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
# Slashes are not allowed in artifact names, hence the arch alias.
|
||||
name: digest-${{ matrix.service }}-${{ matrix.arch }}
|
||||
@@ -119,19 +119,19 @@ jobs:
|
||||
matrix:
|
||||
service: [protocols, auth, storage, webmail]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/setup-buildx-action@v4
|
||||
|
||||
- name: Autentica no GHCR
|
||||
uses: docker/login-action@v3
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Recupera os digests
|
||||
uses: actions/download-artifact@v4
|
||||
uses: actions/download-artifact@v7
|
||||
with:
|
||||
pattern: digest-${{ matrix.service }}-*
|
||||
merge-multiple: true
|
||||
@@ -142,7 +142,7 @@ jobs:
|
||||
# release; the sha tag does the same for any main build.
|
||||
- name: Metadados
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
uses: docker/metadata-action@v6
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}/${{ matrix.service }}
|
||||
tags: |
|
||||
|
||||
Reference in new issue
Block a user