lucasrguerra/LambdaMail
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

ci: copy files into containers instead of bind-mounting, patch two advisories
CI / Lint de idioma (R9) (push) Successful in 9s
Details
CI / Go (protocols) (push) Failing after 2m22s
Details
CI / TypeScript (storage) (push) Successful in 12s
Details
CI / TypeScript (auth) (push) Failing after 3m42s
Details
CI / Build (webmail) (push) Successful in 1m53s
Details
CI / Stack completa (push) Skipped
Details
CI / Trivy (dependências, segredos e Dockerfiles) (push) Successful in 1m3s
Details
CI / Imagem (migrations) (push) Successful in 1m45s
Details
CI / Imagem (auth) (push) Successful in 2m53s
Details
CI / Imagem (rspamd) (push) Successful in 27s
Details
CI / Imagem (protocols) (push) Successful in 2m10s
Details
CI / Imagem (storage) (push) Canceled after 2m9s
Details
CI / Imagem (webmail) (push) Canceled after 1m6s
Details

Browse Source 
The job workspace is a volume the DinD daemon cannot see, so migrations and the
Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged
next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and
go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Lucas RayanandClaude Sonnet 5.5 committed 2026-10-30 09:22:42 -03:00
1 parent 248e857b85
commit c30d618b3f
5 files changed
+79 -57
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.gitea/workflows/ci.yml
+34 -12
View File
@@ -57,12 +57,18 @@ jobs:
cache-dependency-path: services/protocols/go.sum cache-dependency-path: services/protocols/go.sum
- name: Run migrations - name: Run migrations
run: | run: |
docker run --rm --network host \ # The job's workspace is a volume of its own, invisible to the Docker
-v "$(pwd)/../../migrations:/migrations" \ # daemon the job talks to, so `-v "$PWD:..."` would mount an empty
migrate/migrate:v4.17.1 \ # directory. Files are copied into the container instead.
cid=$(docker create --network host migrate/migrate:v4.17.1 \
-path=/migrations \ -path=/migrations \
-database "postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable" \ -database "postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable" \
up up)
docker cp "$(pwd)/../../migrations/." "$cid:/migrations"
docker start -a "$cid"
status=$(docker inspect -f '{{.State.ExitCode}}' "$cid")
docker rm "$cid" >/dev/null
exit "$status"
- run: go vet ./... - run: go vet ./...
- run: go test ./... -v - run: go test ./... -v
env: env:
@@ -97,12 +103,18 @@ jobs:
# the database, so a mock would prove nothing. # the database, so a mock would prove nothing.
- name: Run migrations - name: Run migrations
run: | run: |
docker run --rm --network host \ # The job's workspace is a volume of its own, invisible to the Docker
-v "$(pwd)/../../migrations:/migrations" \ # daemon the job talks to, so `-v "$PWD:..."` would mount an empty
migrate/migrate:v4.17.1 \ # directory. Files are copied into the container instead.
cid=$(docker create --network host migrate/migrate:v4.17.1 \
-path=/migrations \ -path=/migrations \
-database "postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable" \ -database "postgres://lambdamail_test:lambdamail_test@localhost:5432/lambdamail_test?sslmode=disable" \
up up)
docker cp "$(pwd)/../../migrations/." "$cid:/migrations"
docker start -a "$cid"
status=$(docker inspect -f '{{.State.ExitCode}}' "$cid")
docker rm "$cid" >/dev/null
exit "$status"
- run: npm install - run: npm install
- run: npm run lint - run: npm run lint
- run: npm test - run: npm test
@@ -154,9 +166,14 @@ jobs:
# which on Gitea is not GitHub. # which on Gitea is not GitHub.
- name: Repositório - name: Repositório
run: | run: |
docker run --rm --network host -v "$PWD:/src" -w /src aquasec/trivy:0.70.0 \ cid=$(docker create --network host -w /src aquasec/trivy:0.70.0 \
fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 \ fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 \
--skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next . --skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next .)
docker cp . "$cid:/src"
docker start -a "$cid"
status=$(docker inspect -f '{{.State.ExitCode}}' "$cid")
docker rm "$cid" >/dev/null
exit "$status"
# MEDIUM is reported but does not fail the build. # MEDIUM is reported but does not fail the build.
# #
@@ -170,9 +187,14 @@ jobs:
# scanner something people learn to skip. # scanner something people learn to skip.
- name: Repositório (MEDIUM, informativo) - name: Repositório (MEDIUM, informativo)
run: | run: |
docker run --rm --network host -v "$PWD:/src" -w /src aquasec/trivy:0.70.0 \ cid=$(docker create --network host -w /src aquasec/trivy:0.70.0 \
fs --scanners vuln,secret --severity MEDIUM --exit-code 0 \ fs --scanners vuln,secret --severity MEDIUM --exit-code 0 \
--skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next . --skip-dirs services/auth/node_modules,services/storage/node_modules,services/webmail/node_modules,services/webmail/.next .)
docker cp . "$cid:/src"
docker start -a "$cid"
status=$(docker inspect -f '{{.State.ExitCode}}' "$cid")
docker rm "$cid" >/dev/null
exit "$status"
image: image:
name: Imagem (${{ matrix.service }}) name: Imagem (${{ matrix.service }})
services/protocols/go.mod
+1 -1
View File
@@ -21,7 +21,7 @@ require (
require ( require (
github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-jose/go-jose/v4 v4.1.6 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect
services/protocols/go.sum
+2 -2
View File
@@ -23,8 +23,8 @@ github.com/fergusstrange/embedded-postgres v1.30.0 h1:ewv1e6bBlqOIYtgGgRcEnNDpfG
github.com/fergusstrange/embedded-postgres v1.30.0/go.mod h1:w0YvnCgf19o6tskInrOOACtnqfVlOvluz3hlNLY7tRk= github.com/fergusstrange/embedded-postgres v1.30.0/go.mod h1:w0YvnCgf19o6tskInrOOACtnqfVlOvluz3hlNLY7tRk=
github.com/go-acme/lego/v4 v4.35.2 h1:uVQg+KC/yj9R2g7Q9W5wDqhvQvxV5SMu5eqFVoN5xZU= github.com/go-acme/lego/v4 v4.35.2 h1:uVQg+KC/yj9R2g7Q9W5wDqhvQvxV5SMu5eqFVoN5xZU=
github.com/go-acme/lego/v4 v4.35.2/go.mod h1:pX2jN5n8OphMGY1IaMjYm5DAEzguBaKRt8AvJAgJXpc= github.com/go-acme/lego/v4 v4.35.2/go.mod h1:pX2jN5n8OphMGY1IaMjYm5DAEzguBaKRt8AvJAgJXpc=
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
services/webmail/package-lock.json
Generated
+41 -41
View File
@@ -14,7 +14,7 @@
"framer-motion": "^11.18.2", "framer-motion": "^11.18.2",
"imagetracerjs": "1.2.6", "imagetracerjs": "1.2.6",
"lucide-react": "^0.474.0", "lucide-react": "^0.474.0",
"next": "15.5.27", "next": "15.5.28",
"qrcode-generator": "^2.0.4", "qrcode-generator": "^2.0.4",
"react": "^18.3.1", "react": "^18.3.1",
"react-dom": "^18.3.1", "react-dom": "^18.3.1",
@@ -1334,15 +1334,15 @@
} }
}, },
"node_modules/@next/env": { "node_modules/@next/env": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/env/-/env-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/env/-/env-15.5.28.tgz",
"integrity": "sha512-WC5hvVqiuFOcRyz6gKPeJkiVvSMf3scNeAV49CdWtVqxmUlzh8UKR6YHt9yiNkh8LngtzqSlVz07/Ma3ZAzchA==", "integrity": "sha512-xxW5EBI8fMPuVTPBW7LL980IRbuDXlbkUAwp9DDhtb4Lnich3nJ13uYpvrX4VE74hWPf6AvHHAMmGCidcHjbfg==",
"license": "MIT" "license": "MIT"
}, },
"node_modules/@next/swc-darwin-arm64": { "node_modules/@next/swc-darwin-arm64": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.5.28.tgz",
"integrity": "sha512-fBA9QurmK4+uj4wNhmRTuO5zMVRaBHCvp6H93zTG/5i6Yi6TewbvbesXB8YQNj8T99Cwrow87hHiFV6wL/hyMA==", "integrity": "sha512-dPoQYXcfSIqx5o+TOXVXO7kONK5qbtNRDeiTfII0bT3puGIT6VF5e0QwmxNZfEZ5Zety5f3m9P/p4xqwfiLlPg==",
"cpu": [ "cpu": [
"arm64" "arm64"
], ],
@@ -1356,9 +1356,9 @@
} }
}, },
"node_modules/@next/swc-darwin-x64": { "node_modules/@next/swc-darwin-x64": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-15.5.28.tgz",
"integrity": "sha512-FGZwJwry8qZNHxD/nfwrCwCHHrqx6epqItkkxbYcBQEQ2uw5S43bY83fQB5zbAsZE7TELMjoYkbhsQ4oKM7wwg==", "integrity": "sha512-RgCJ7buBivTH+6sddqaVm+/v8kwMHlFkobvdt3DfETutws5HrxnToMIWSN9X3MZ3aAi7BbKrGZZWUDQLEycXqw==",
"cpu": [ "cpu": [
"x64" "x64"
], ],
@@ -1372,9 +1372,9 @@
} }
}, },
"node_modules/@next/swc-linux-arm64-gnu": { "node_modules/@next/swc-linux-arm64-gnu": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.5.28.tgz",
"integrity": "sha512-GQulAaJYNF1RYuatlsw9/uzbKz4if2V7Ic9nVO+P0ljYPm4yBRTFIl6g5YkKTw40lMLbpy9edLoH44g3jSHMYA==", "integrity": "sha512-OHXQe13olE59aKe++zHavGcJPh5SLHXi6Anret3BBeq1+qhSuOJDNAli/EDDfxs6UTqA4Qddo4uyYry2slyjiQ==",
"cpu": [ "cpu": [
"arm64" "arm64"
], ],
@@ -1391,9 +1391,9 @@
} }
}, },
"node_modules/@next/swc-linux-arm64-musl": { "node_modules/@next/swc-linux-arm64-musl": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.5.28.tgz",
"integrity": "sha512-URFFsUmu8Pi0/1qdnUI7tx7keZw1Mt5zHfrIX1RfDG9Nih8DYxK54WZsDJUX2ZTlii1jgotL7qcbwKnSAES6xQ==", "integrity": "sha512-nTB7bB6vfn4ezCJNYP43ukt2o8L3+WxKF/sTcTxepdXsJh3SM9RhlU7wrZYbH7L4HO5M87dqDTwm8587vAkCiw==",
"cpu": [ "cpu": [
"arm64" "arm64"
], ],
@@ -1410,9 +1410,9 @@
} }
}, },
"node_modules/@next/swc-linux-x64-gnu": { "node_modules/@next/swc-linux-x64-gnu": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.5.28.tgz",
"integrity": "sha512-aJp74z7uvU5jQhyH7lyk+4qSRcTdKbKT9NQE3jiO9kWYkoHZjKi0zzHDbCoZ+v2sJDEiJ/z58R0UlWMGWNF3HA==", "integrity": "sha512-WXCfVI32rW3xCusoUX1RpZKtyChWU2Zwe27JUDmM3KrXwcDNc9vV4zEq0GKFAURnuQ/Ouo/XqPvB0yh445XZCg==",
"cpu": [ "cpu": [
"x64" "x64"
], ],
@@ -1429,9 +1429,9 @@
} }
}, },
"node_modules/@next/swc-linux-x64-musl": { "node_modules/@next/swc-linux-x64-musl": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.5.28.tgz",
"integrity": "sha512-ILl2bQ8MbpvyMpY8AXljb3BXs0MJSC8HXZ6QV5AWpVS7ZELqNPtrHvhUk+SNarvjvICXX8bCS287TCi+gUFVYg==", "integrity": "sha512-Miq+NDb/HWsXuxseYxMM6fuEOQXgTziarkKIRpVKCn8W69cEfhQaQr+90pO+u4q2CbJR2wzXmUuCFyZaJs/Nng==",
"cpu": [ "cpu": [
"x64" "x64"
], ],
@@ -1448,9 +1448,9 @@
} }
}, },
"node_modules/@next/swc-win32-arm64-msvc": { "node_modules/@next/swc-win32-arm64-msvc": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.5.28.tgz",
"integrity": "sha512-1MB9Rh5y8TOPN2x7naNTJNkCZQav9c70AI7EBYXxsEewwOffC4DjjwBwKf20NBvcA+u+5jDv7nVmHxunlP2d7Q==", "integrity": "sha512-5LR79lemgDlgxvG7MQJ+zHCkVcrUoQuO7CiIvq3I58vNW4goSOE2b+19Z6FujRWMouvni4gvudYFuFuNxolGWA==",
"cpu": [ "cpu": [
"arm64" "arm64"
], ],
@@ -1464,9 +1464,9 @@
} }
}, },
"node_modules/@next/swc-win32-x64-msvc": { "node_modules/@next/swc-win32-x64-msvc": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.5.27.tgz", "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.5.28.tgz",
"integrity": "sha512-XtYgpGOswgnyBWXzOEG6q9RhvnSw0CEZ0MbWqCsl5PISgt9EzvJvNW5mU5n1PsphX/lnamzxjgQXH2GUJL8nqg==", "integrity": "sha512-GNipvXUYROSTf4PXEyH95FrWImIB5zdaK6uEOg0RP1/X2drnvoMwiBkJ0VWdzX7w3iiBm3y5g2TxkKDGVTOQcg==",
"cpu": [ "cpu": [
"x64" "x64"
], ],
@@ -3016,12 +3016,12 @@
} }
}, },
"node_modules/next": { "node_modules/next": {
"version": "15.5.27", "version": "15.5.28",
"resolved": "https://registry.npmjs.org/next/-/next-15.5.27.tgz", "resolved": "https://registry.npmjs.org/next/-/next-15.5.28.tgz",
"integrity": "sha512-F82CrlPZ8GRxBH9RIIoR3qU1t5RT3dv1K8moe8SjlDEquiFipvEI13R1Om90TaUOEwShkWCMlg8+gvTNzfMhvg==", "integrity": "sha512-JjhLBBY1PNnuwPtcZ7t8yxVeJVYvD2Jyp633J+gRCNbzSt7N0E+xqCf6uQiff3+3qmUkwcF/ksfSsK1xsZ76Tw==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"@next/env": "15.5.27", "@next/env": "15.5.28",
"@swc/helpers": "0.5.15", "@swc/helpers": "0.5.15",
"caniuse-lite": "^1.0.30001579", "caniuse-lite": "^1.0.30001579",
"postcss": "8.4.31", "postcss": "8.4.31",
@@ -3034,15 +3034,15 @@
"node": "^18.18.0 || ^19.8.0 || >= 20.0.0" "node": "^18.18.0 || ^19.8.0 || >= 20.0.0"
}, },
"optionalDependencies": { "optionalDependencies": {
"@next/swc-darwin-arm64": "15.5.27", "@next/swc-darwin-arm64": "15.5.28",
"@next/swc-darwin-x64": "15.5.27", "@next/swc-darwin-x64": "15.5.28",
"@next/swc-linux-arm64-gnu": "15.5.27", "@next/swc-linux-arm64-gnu": "15.5.28",
"@next/swc-linux-arm64-musl": "15.5.27", "@next/swc-linux-arm64-musl": "15.5.28",
"@next/swc-linux-x64-gnu": "15.5.27", "@next/swc-linux-x64-gnu": "15.5.28",
"@next/swc-linux-x64-musl": "15.5.27", "@next/swc-linux-x64-musl": "15.5.28",
"@next/swc-win32-arm64-msvc": "15.5.27", "@next/swc-win32-arm64-msvc": "15.5.28",
"@next/swc-win32-x64-msvc": "15.5.27", "@next/swc-win32-x64-msvc": "15.5.28",
"sharp": "^0.34.3 || ^0.35.4" "sharp": "^0.34.3 || ^0.35.5"
}, },
"peerDependencies": { "peerDependencies": {
"@opentelemetry/api": "^1.1.0", "@opentelemetry/api": "^1.1.0",
services/webmail/package.json
+1 -1
View File
@@ -16,7 +16,7 @@
"framer-motion": "^11.18.2", "framer-motion": "^11.18.2",
"imagetracerjs": "1.2.6", "imagetracerjs": "1.2.6",
"lucide-react": "^0.474.0", "lucide-react": "^0.474.0",
"next": "15.5.27", "next": "15.5.28",
"qrcode-generator": "^2.0.4", "qrcode-generator": "^2.0.4",
"react": "^18.3.1", "react": "^18.3.1",
"react-dom": "^18.3.1", "react-dom": "^18.3.1",