Lucas Rayan and Claude Sonnet 5.5
5d4e7147ce
ci: cache what is rebuilt on every run
...
npm and Go module caches, the embedded Postgres binaries, Trivy's database, and
the daemon's own layer cache for image builds. The webmail Next build is no
longer run a second time outside the Dockerfile.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 10:07:21 -03:00
Lucas Rayan and Claude Sonnet 5.5
a28a9bc9d4
ci: run Go tests as a non-root user
...
CI / Lint de idioma (R9) (push) Successful in 22s
CI / TypeScript (auth) (push) Failing after 3m33s
CI / Go (protocols) (push) Successful in 5m6s
CI / Trivy (dependências, segredos e Dockerfiles) (push) Successful in 1m9s
CI / Build (webmail) (push) Successful in 2m6s
CI / Stack completa (push) Skipped
CI / Imagem (rspamd) (push) Successful in 29s
CI / Imagem (storage) (push) Successful in 1m19s
CI / TypeScript (storage) (push) Successful in 17s
CI / Imagem (migrations) (push) Successful in 2m24s
CI / Imagem (auth) (push) Successful in 2m58s
CI / Imagem (protocols) (push) Successful in 1m47s
CI / Imagem (webmail) (push) Successful in 2m35s
initdb, used by the embedded Postgres in the e2e suites, refuses to run as root.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 09:33:43 -03:00
Lucas Rayan and Claude Sonnet 5.5
c30d618b3f
ci: copy files into containers instead of bind-mounting, patch two advisories
...
CI / Lint de idioma (R9) (push) Successful in 9s
CI / Go (protocols) (push) Failing after 2m22s
CI / TypeScript (storage) (push) Successful in 12s
CI / TypeScript (auth) (push) Failing after 3m42s
CI / Imagem (migrations) (push) Successful in 1m45s
CI / Build (webmail) (push) Successful in 1m53s
CI / Stack completa (push) Skipped
CI / Trivy (dependências, segredos e Dockerfiles) (push) Successful in 1m3s
CI / Imagem (auth) (push) Successful in 2m53s
CI / Imagem (rspamd) (push) Successful in 27s
CI / Imagem (protocols) (push) Successful in 2m10s
CI / Imagem (storage) (push) Canceled after 2m9s
CI / Imagem (webmail) (push) Canceled after 1m6s
The job workspace is a volume the DinD daemon cannot see, so migrations and the
Trivy filesystem scan now docker cp their inputs. Trivy's image gate flagged
next 15.5.27 (unauthenticated RCE in image optimisation, fixed in 15.5.28) and
go-jose 4.1.4 (DoS, fixed in 4.1.6); both are patch bumps.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 09:22:42 -03:00
Lucas Rayan and Claude Sonnet 5.5
33fa05b019
ci: run Trivy from its official image and drop the gha cache
...
CI / Imagem (protocols) (push) Failing after 1m29s
CI / Lint de idioma (R9) (push) Successful in 3s
CI / Go (protocols) (push) Failing after 30s
CI / TypeScript (auth) (push) Failing after 36s
CI / TypeScript (storage) (push) Successful in 16s
CI / Trivy (dependências, segredos e Dockerfiles) (push) Successful in 1m14s
CI / Build (webmail) (push) Successful in 1m57s
CI / Stack completa (push) Skipped
CI / Imagem (auth) (push) Successful in 57s
CI / Imagem (migrations) (push) Successful in 39s
CI / Imagem (rspamd) (push) Successful in 30s
CI / Imagem (storage) (push) Successful in 1m20s
CI / Imagem (webmail) (push) Canceled after 2m58s
aquasecurity/trivy-action clones the Trivy repository from the workflow's own
server, which on Gitea is not GitHub. The gha buildx cache has no Gitea
counterpart.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 09:01:45 -03:00
Lucas Rayan and Claude Sonnet 5.5
91c5df433e
ci: build linux/amd64 under QEMU on the arm64 runner
...
CI / Lint de idioma (R9) (push) Successful in 10s
CI / Go (protocols) (push) Failing after 31s
CI / TypeScript (auth) (push) Failing after 37s
CI / TypeScript (storage) (push) Successful in 23s
CI / Build (webmail) (push) Successful in 1m47s
CI / Stack completa (push) Skipped
CI / Trivy (dependências, segredos e Dockerfiles) (push) Failing after 3m8s
CI / Imagem (auth) (push) Canceled after 3m32s
CI / Imagem (migrations) (push) Canceled after 2m4s
CI / Imagem (protocols) (push) Canceled after 48s
CI / Imagem (rspamd) (push) Canceled after 48s
CI / Imagem (storage) (push) Canceled after 0s
CI / Imagem (webmail) (push) Canceled after 0s
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 08:56:34 -03:00
Lucas Rayan and Claude Sonnet 5.5
59363734ff
ci: publish images to the Gitea registry, use the gitea context
...
CI / Lint de idioma (R9) (push) Successful in 4s
CI / Go (protocols) (push) Failing after 5s
CI / TypeScript (auth) (push) Failing after 6s
CI / TypeScript (storage) (push) Successful in 12s
CI / Build (webmail) (push) Successful in 1m38s
CI / Stack completa (push) Skipped
CI / Trivy (dependências, segredos e Dockerfiles) (push) Failing after 1m32s
CI / Imagem (auth) (push) Failing after 11s
CI / Imagem (migrations) (push) Failing after 11s
CI / Imagem (protocols) (push) Failing after 11s
CI / Imagem (rspamd) (push) Failing after 11s
CI / Imagem (storage) (push) Failing after 11s
CI / Imagem (webmail) (push) Failing after 11s
Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each
architecture separately (no artifact upload, no gha cache) and joins them with
imagetools. GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's
own interface and the GITEA_* equivalents are not set.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 08:48:44 -03:00
Lucas Rayan and Claude Sonnet 5.5
9a722bc5ac
ci: publish images to the Gitea registry and move workflows to .gitea
...
CI / Lint de idioma (R9) (push) Successful in 3s
CI / Go (protocols) (push) Failing after 20s
CI / TypeScript (auth) (push) Canceled after 4s
CI / TypeScript (storage) (push) Canceled after 0s
CI / Build (webmail) (push) Canceled after 0s
CI / Trivy (dependências, segredos e Dockerfiles) (push) Canceled after 0s
CI / Imagem (auth) (push) Canceled after 0s
CI / Imagem (migrations) (push) Canceled after 0s
CI / Imagem (protocols) (push) Canceled after 0s
CI / Imagem (rspamd) (push) Canceled after 0s
CI / Imagem (storage) (push) Canceled after 0s
CI / Imagem (webmail) (push) Canceled after 0s
CI / Stack completa (push) Canceled after 0s
Release now pushes to git.lucasrguerra.dev.br instead of ghcr.io, tags each
architecture separately (no artifact upload, no gha cache) and joins them with
imagetools. Workflows live in .gitea/workflows and use the gitea context.
GITHUB_OUTPUT and GITHUB_STEP_SUMMARY stay: they are the runner's own interface.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com >
2026-10-30 08:48:14 -03:00
