del .github folder
This commit is contained in:
parent
68a7ec2e43
commit
1c86aca038
|
|
@ -1,29 +0,0 @@
|
||||||
---
|
|
||||||
name: Bug report
|
|
||||||
about: Create a report to help us improve
|
|
||||||
title: ""
|
|
||||||
type: bug
|
|
||||||
labels:
|
|
||||||
- "waiting-on-developer"
|
|
||||||
assignees: ''
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Describe the bug**
|
|
||||||
A clear and concise description of what the bug is.
|
|
||||||
|
|
||||||
**To Reproduce**
|
|
||||||
Steps to reproduce the behavior:
|
|
||||||
1. Go to '...'
|
|
||||||
2. Click on '....'
|
|
||||||
3. Scroll down to '....'
|
|
||||||
4. See error
|
|
||||||
|
|
||||||
**Expected behavior**
|
|
||||||
A clear and concise description of what you expected to happen.
|
|
||||||
|
|
||||||
**Screenshots**
|
|
||||||
If applicable, add screenshots to help explain your problem.
|
|
||||||
|
|
||||||
**Additional context**
|
|
||||||
Add any other context about the problem here.
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
---
|
|
||||||
name: Feature request
|
|
||||||
about: Suggest an idea for this project
|
|
||||||
title: ''
|
|
||||||
type: feature
|
|
||||||
labels:
|
|
||||||
- "waiting-on-developer"
|
|
||||||
assignees: ''
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Is your feature request related to a problem? Please describe.**
|
|
||||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
|
||||||
|
|
||||||
**Describe the solution you'd like**
|
|
||||||
A clear and concise description of what you want to happen.
|
|
||||||
|
|
||||||
**Describe alternatives you've considered**
|
|
||||||
A clear and concise description of any alternative solutions or features you've considered.
|
|
||||||
|
|
||||||
**Additional context**
|
|
||||||
Add any other context or screenshots about the feature request here.
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
---
|
|
||||||
name: Support request
|
|
||||||
about: Ask for help with OliveTin
|
|
||||||
title: ''
|
|
||||||
labels: ''
|
|
||||||
assignees: ''
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**What is the problem you are having?**
|
|
||||||
|
|
||||||
|
|
||||||
**What OliveTin version are you running?**
|
|
||||||
|
|
||||||
|
|
||||||
**Can you provide Server Diagnostics?**
|
|
||||||
|
|
||||||
Server Diagnostics really helps us to help you, by providing critical information about your install. If you can generate Server Diagnostics, please copy and paste the output here.
|
|
||||||
|
|
||||||
How to generate Server Diagnostics: https://docs.olivetin.app/troubleshooting/server-diagnostics.html
|
|
||||||
|
|
||||||
|
|
||||||
**What is your config.yaml?**
|
|
||||||
|
|
||||||
|
|
||||||
**What are the OliveTin service logs showing?**
|
|
||||||
|
|
||||||
|
|
||||||
**Screenshots (if appropriate)**
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
# PR Introduction
|
|
||||||
|
|
||||||
First of all, thank you for considering to raise a pull request!
|
|
||||||
|
|
||||||
Don’t be afraid to ask for advice before working on a contribution. If you’re thinking about a bigger change, especially that might affect the core working or architecture, it’s almost essential to talk and ask about what you’re planning might affect things. Some of the larger future plans may not be documented well so it’s difficult to understand how your change might affect the general direction and roadmap of this project without asking.
|
|
||||||
|
|
||||||
The preferred way to communicate is probably via Discord or GitHub issues.
|
|
||||||
|
|
||||||
Helpful information to understand the project can be found here: [CONTRIBUTING](https://github.com/OliveTin/OliveTin/blob/main/CONTRIBUTING.adoc)
|
|
||||||
|
|
||||||
^^^ please delete the lines above when raising a PR to keep the request to the bare essentials ^^^
|
|
||||||
|
|
||||||
# Checklist
|
|
||||||
Please put a X in the boxes as evidence of reading through the checklist.
|
|
||||||
|
|
||||||
- [ ] I have read the [CONTRIBUTORS](CONTRIBUTORS.adoc) guide
|
|
||||||
- [ ] I considered the "3 line" suggestion.
|
|
||||||
- [ ] I followed the "1 logical change" rule.
|
|
||||||
- [ ] I have forked the project, and raised this PR on a feature branch.
|
|
||||||
- [ ] I ran the `pre-commit` hooks, and my commit message was validated.
|
|
||||||
- [ ] I installed the pre-push hook (`pre-commit install --hook-type pre-push`) and integration tests pass on push when relevant files changed.
|
|
||||||
- [ ] `make -wC service compile` runs without any issues.
|
|
||||||
- [ ] `make -wC service codestyle` runs without any issues.
|
|
||||||
- [ ] `make -wC service unittests` runs without any issues.
|
|
||||||
- [ ] `make -wC frontend codestyle` runs without any issues.
|
|
||||||
- [ ] `make -w frontend-unittests` runs without any issues.
|
|
||||||
- [ ] `make -w it` runs without any issues.
|
|
||||||
- [ ] I understand and accept the [AGPL-3.0 license](LICENSE) and [code of conduct](CODE_OF_CONDUCT.md), and my contributions fall under these.
|
|
||||||
|
|
@ -1,116 +0,0 @@
|
||||||
# Security Advisory Duplicates — Maintainer Guide
|
|
||||||
|
|
||||||
This document lists known duplicate security advisory clusters for [OliveTin/OliveTin](https://github.com/OliveTin/OliveTin). When triaging new reports, check here and [open advisories](https://github.com/OliveTin/OliveTin/security/advisories) before accepting.
|
|
||||||
|
|
||||||
**Duplicate policy:** the earliest reporter on the canonical advisory receives primary credit. Later reporters are credited on the canonical advisory when closed as duplicates. See [SECURITY.md](../SECURITY.md).
|
|
||||||
|
|
||||||
## Triage checklist
|
|
||||||
|
|
||||||
1. Search open advisories for the same component and attack path.
|
|
||||||
2. Match against clusters below.
|
|
||||||
3. If duplicate: close the newer advisory, link to canonical, add reporter to canonical credits.
|
|
||||||
4. If unique: accept, patch on a private branch, reassess CVSS with OliveTin context (see SECURITY.md — OliveTin is intentional RCE by design).
|
|
||||||
5. Merge fix to `next`, publish advisory, credit reporters in advisory body (not commit message).
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## shellAfterCompleted command injection
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-vc6p-m6vx-6cwq](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-vc6p-m6vx-6cwq) — reporter **knight-yagami** (2026-03-04)
|
|
||||||
|
|
||||||
Untrusted command output or template variables interpolated into `shellAfterCompleted` and executed via `sh -c`.
|
|
||||||
|
|
||||||
| GHSA | Reporter | Status | Notes |
|
|
||||||
|------|----------|--------|-------|
|
|
||||||
| GHSA-vc6p-m6vx-6cwq | knight-yagami | closed (canonical) | Original report |
|
|
||||||
| GHSA-v5gc-hqpq-227p | 0xkakash1 | closed (duplicate) | Output template variant |
|
|
||||||
| GHSA-m7wr-wj5j-7459 | Ryu7zz | duplicate | Webhook `exec` → output → `shellAfterCompleted` |
|
|
||||||
| GHSA-cjxm-x848-6vmc | Yesuhei | duplicate | Missing shell safety on after-completion |
|
|
||||||
| GHSA-j9p9-36jc-2v8w | anushkavirgaonkar | duplicate | Same root cause |
|
|
||||||
|
|
||||||
**Fix:** shell-quote `output`/`exitCode` before template render; block `shellAfterCompleted` for webhook-tagged actions.
|
|
||||||
|
|
||||||
**CVSS note:** requires admin-configured `shellAfterCompleted` and attacker influence on output — typically PR:H not PR:N.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## OAuth2 state map memory exhaustion (DoS)
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-xpxj-f2fm-rqch](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xpxj-f2fm-rqch) — reporter **knight-yagami** (2026-03-04)
|
|
||||||
|
|
||||||
Unauthenticated `/oauth/login` grows `registeredStates` without TTL or cap.
|
|
||||||
|
|
||||||
| GHSA | Reporter | Status | Notes |
|
|
||||||
|------|----------|--------|-------|
|
|
||||||
| GHSA-xpxj-f2fm-rqch | knight-yagami | closed (canonical) | Original report |
|
|
||||||
| GHSA-cj96-c55v-2f3c | Dredsen | duplicate | Same unbounded map |
|
|
||||||
|
|
||||||
**Fix:** TTL sweep (match 15-minute cookie MaxAge), max map size, cleanup on failed callback.
|
|
||||||
|
|
||||||
**CVSS note:** unauthenticated DoS — reported 7.5 is appropriate.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## URL argument type — unrestricted URI schemes (SSRF / file read)
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-45pc-w4ph-hrq4](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45pc-w4ph-hrq4) — reporter **fg0x0** (2026-03-09)
|
|
||||||
|
|
||||||
`url` type accepts `file://`, `gopher://`, etc. Blocked in `shell:` mode but still validated weakly for `exec:` actions.
|
|
||||||
|
|
||||||
| GHSA | Reporter | Status | Notes |
|
|
||||||
|------|----------|--------|-------|
|
|
||||||
| GHSA-45pc-w4ph-hrq4 | fg0x0 | closed (canonical) | Original report |
|
|
||||||
| GHSA-cchg-25m4-q6rj | anushkavirgaonkar | duplicate | Same scheme validation gap |
|
|
||||||
|
|
||||||
**Fix:** allowlist `http`/`https` in `typeSafetyCheckUrl`.
|
|
||||||
|
|
||||||
**CVSS note:** admin must configure `exec:` action passing URL to external tool — PR:H.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Custom `regex:` argument type in shell actions
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-xc5w-4v5w-7x65](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65) — reporter **Ayantaker** (2026-05-06)
|
|
||||||
|
|
||||||
`regex:` types not in shell denylist; partial `MatchString` allows injection suffixes.
|
|
||||||
|
|
||||||
| GHSA | Reporter | Status | Notes |
|
|
||||||
|------|----------|--------|-------|
|
|
||||||
| GHSA-xc5w-4v5w-7x65 | Ayantaker | canonical | Missing denylist entry |
|
|
||||||
| GHSA-gvxq-7gvp-4ggr | anushkavirgaonkar | duplicate | Unanchored partial match |
|
|
||||||
|
|
||||||
**Fix:** deny `regex:` in shell mode; enforce full-string match for custom regex types.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Shell denylist incomplete (post CVE-2026-27626)
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-c26w-h42g-jfp9](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-c26w-h42g-jfp9) — reporter **sec-reex** (2026-07-03)
|
|
||||||
|
|
||||||
CVE-2026-27626 added `password` to denylist only; `html`, `confirmation`, and choiceless `checkbox` still skip validation and are allowed in `shell:` actions.
|
|
||||||
|
|
||||||
**Fix:** extend `checkShellArgumentSafety` denylist.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## StartActionAndWait logs ACL bypass
|
|
||||||
|
|
||||||
**Canonical:** [GHSA-jm28-2wcr-qf3h](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h) — reporter **offset** (2026-03-12)
|
|
||||||
|
|
||||||
`StartActionAndWait` / `StartActionByGetAndWait` return full log output without `logs` ACL check.
|
|
||||||
|
|
||||||
No known duplicates.
|
|
||||||
|
|
||||||
**Fix:** apply `isLogEntryAllowed` before returning `LogEntry`.
|
|
||||||
|
|
||||||
**CVSS note:** requires authenticated user with `exec` but not `logs` — typically 4.3–5.3 not 6.5.
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Easy to confuse (not duplicates)
|
|
||||||
|
|
||||||
| Topic | Advisories | Distinction |
|
|
||||||
|-------|------------|-------------|
|
|
||||||
| OAuth2 state DoS vs OAuth2 auth bypass | GHSA-xpxj vs GHSA-3v7p | DoS fills state map; bypass spoofs `authHttpHeaderUsername` |
|
|
||||||
| `shellAfterCompleted` vs direct `shell` injection | GHSA-vc6p vs GHSA-49gm | Second-order via output vs first-order argument injection |
|
|
||||||
| `ValidateArgumentType` enumeration | GHSA-f637 vs GHSA-x6q3 | Same issue; GHSA-f637 published |
|
|
||||||
|
|
@ -1,271 +0,0 @@
|
||||||
---
|
|
||||||
name: "Build & Release pipeline"
|
|
||||||
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/build-and-release.yml'
|
|
||||||
- '.goreleaser.yml'
|
|
||||||
- 'Dockerfile.multiarches'
|
|
||||||
- 'Dockerfile.singlearch'
|
|
||||||
- 'Makefile'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
- 'var/windows/**'
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
tags:
|
|
||||||
- '*'
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
- next
|
|
||||||
- beta
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/build-and-release.yml'
|
|
||||||
- '.goreleaser.yml'
|
|
||||||
- 'Dockerfile.multiarches'
|
|
||||||
- 'Dockerfile.singlearch'
|
|
||||||
- 'Makefile'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
- 'var/windows/**'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
outputs:
|
|
||||||
new_release_published: ${{ steps.release.outputs.new_release_published }}
|
|
||||||
new_release_git_tag: ${{ steps.release.outputs.new_release_git_tag }}
|
|
||||||
windows_zip_artifact_id: ${{ steps.upload-windows-zip.outputs.artifact-id }}
|
|
||||||
windows_msi_artifact_id: ${{ steps.upload-windows-msi.outputs.artifact-id }}
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v6
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Set up QEMU
|
|
||||||
id: qemu
|
|
||||||
uses: docker/setup-qemu-action@v4
|
|
||||||
with:
|
|
||||||
image: tonistiigi/binfmt:latest
|
|
||||||
platforms: arm64,arm
|
|
||||||
|
|
||||||
- name: Setup node (npm cache)
|
|
||||||
if: github.event_name != 'pull_request'
|
|
||||||
uses: actions/setup-node@v6.4.0
|
|
||||||
with:
|
|
||||||
node-version: '22'
|
|
||||||
cache: 'npm'
|
|
||||||
cache-dependency-path: frontend/package-lock.json
|
|
||||||
|
|
||||||
- name: Setup node
|
|
||||||
if: github.event_name == 'pull_request'
|
|
||||||
uses: actions/setup-node@v6.4.0
|
|
||||||
with:
|
|
||||||
node-version: '22'
|
|
||||||
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@v6
|
|
||||||
with:
|
|
||||||
go-version-file: 'service/go.mod'
|
|
||||||
cache: true
|
|
||||||
cache-dependency-path: 'service/go.mod'
|
|
||||||
|
|
||||||
- name: Print go version
|
|
||||||
run: go version
|
|
||||||
|
|
||||||
- name: Login to Docker Hub
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
uses: docker/login-action@v4
|
|
||||||
with:
|
|
||||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
||||||
password: ${{ secrets.DOCKERHUB_KEY }}
|
|
||||||
|
|
||||||
- name: Login to ghcr
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
uses: docker/login-action@v4
|
|
||||||
with:
|
|
||||||
registry: ghcr.io
|
|
||||||
username: ${{ github.actor }}
|
|
||||||
password: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
|
|
||||||
- name: get date
|
|
||||||
run: |
|
|
||||||
echo "DATE=$(date +'%Y-%m-%d')" >> "$GITHUB_ENV"
|
|
||||||
|
|
||||||
- name: make webui
|
|
||||||
run: make -w webui-dist
|
|
||||||
|
|
||||||
- name: unit tests
|
|
||||||
run: make -w service-unittests
|
|
||||||
|
|
||||||
- name: frontend unit tests
|
|
||||||
run: make -w frontend-unittests
|
|
||||||
|
|
||||||
- name: build service
|
|
||||||
run: make -w service
|
|
||||||
|
|
||||||
- name: integration tests
|
|
||||||
run: cd integration-tests && make -w
|
|
||||||
|
|
||||||
- name: Archive integration tests
|
|
||||||
uses: actions/upload-artifact@v7
|
|
||||||
if: always()
|
|
||||||
with:
|
|
||||||
name: "OliveTin-integration-tests-${{ env.DATE }}-${{ github.sha }}"
|
|
||||||
path: |
|
|
||||||
integration-tests
|
|
||||||
!integration-tests/node_modules
|
|
||||||
|
|
||||||
- name: Install wixl and msitools
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
run: sudo apt-get update && sudo apt-get install -y wixl msitools
|
|
||||||
|
|
||||||
- name: Install goreleaser
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
uses: goreleaser/goreleaser-action@v7
|
|
||||||
with:
|
|
||||||
install-only: true
|
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
uses: docker/setup-buildx-action@v4
|
|
||||||
|
|
||||||
- name: Verify macOS signing certificate chain
|
|
||||||
if: github.ref_type != 'tag' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)
|
|
||||||
env:
|
|
||||||
MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
|
|
||||||
MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
|
|
||||||
run: ./var/macos/verify-macos-sign-p12.sh
|
|
||||||
|
|
||||||
- name: release
|
|
||||||
id: release
|
|
||||||
if: github.ref_type != 'tag' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)
|
|
||||||
uses: cycjimmy/semantic-release-action@v5
|
|
||||||
with:
|
|
||||||
extra_plugins: |
|
|
||||||
@semantic-release/commit-analyzer
|
|
||||||
@semantic-release/exec
|
|
||||||
@semantic-release/git
|
|
||||||
env:
|
|
||||||
GITHUB_TOKEN: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
GH_TOKEN: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
|
|
||||||
MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
|
|
||||||
MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
|
|
||||||
MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
|
|
||||||
MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
|
|
||||||
|
|
||||||
- name: Upload unsigned Windows zip for SignPath
|
|
||||||
id: upload-windows-zip
|
|
||||||
if: steps.release.outputs.new_release_published == 'true'
|
|
||||||
uses: actions/upload-artifact@v7
|
|
||||||
with:
|
|
||||||
# Upload as-is so SignPath receives OliveTin-windows-amd64.zip, not a wrapper zip.
|
|
||||||
# With archive: false, the artifact name is the filename (`name` is ignored).
|
|
||||||
path: dist/OliveTin-windows-amd64.zip
|
|
||||||
archive: false
|
|
||||||
if-no-files-found: error
|
|
||||||
|
|
||||||
- name: Upload unsigned Windows MSI for SignPath
|
|
||||||
id: upload-windows-msi
|
|
||||||
if: steps.release.outputs.new_release_published == 'true'
|
|
||||||
uses: actions/upload-artifact@v7
|
|
||||||
with:
|
|
||||||
path: dist/OliveTin-windows-amd64.msi
|
|
||||||
archive: false
|
|
||||||
if-no-files-found: error
|
|
||||||
|
|
||||||
- name: Archive binaries
|
|
||||||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false
|
|
||||||
uses: actions/upload-artifact@v7
|
|
||||||
with:
|
|
||||||
name: "OliveTin-snapshot-${{ env.DATE }}-${{ github.sha }}"
|
|
||||||
path: dist/OliveTin*.*
|
|
||||||
|
|
||||||
sign-windows:
|
|
||||||
name: Sign Windows artifacts (SignPath)
|
|
||||||
needs: build
|
|
||||||
if: needs.build.outputs.new_release_published == 'true'
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
permissions:
|
|
||||||
actions: read
|
|
||||||
contents: write
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v6
|
|
||||||
with:
|
|
||||||
persist-credentials: false
|
|
||||||
|
|
||||||
- name: Require SignPath configuration
|
|
||||||
env:
|
|
||||||
SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
||||||
SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
||||||
SIGNPATH_PROJECT_SLUG: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
||||||
SIGNPATH_SIGNING_POLICY_SLUG: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
|
|
||||||
run: |
|
|
||||||
missing=0
|
|
||||||
for name in SIGNPATH_API_TOKEN SIGNPATH_ORGANIZATION_ID SIGNPATH_PROJECT_SLUG SIGNPATH_SIGNING_POLICY_SLUG; do
|
|
||||||
if [[ -z "${!name}" ]]; then
|
|
||||||
echo "Missing required SignPath setting: ${name}" >&2
|
|
||||||
missing=1
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
if [[ "${missing}" -ne 0 ]]; then
|
|
||||||
echo "SignPath secrets/vars are required to upload signed Windows assets. Configure them (see docs/modules/dev/pages/signing.adoc)." >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Sign Windows zip
|
|
||||||
uses: signpath/github-action-submit-signing-request@v2
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
||||||
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
||||||
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
||||||
signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
|
|
||||||
artifact-configuration-slug: windows-zip
|
|
||||||
github-artifact-id: ${{ needs.build.outputs.windows_zip_artifact_id }}
|
|
||||||
wait-for-completion: true
|
|
||||||
# Preserve the signed .zip/.msi files; default decompress would unpack the zip.
|
|
||||||
skip-decompress: true
|
|
||||||
output-artifact-directory: signed-windows-zip
|
|
||||||
|
|
||||||
- name: Sign Windows MSI
|
|
||||||
uses: signpath/github-action-submit-signing-request@v2
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
|
||||||
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
|
||||||
project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
|
|
||||||
signing-policy-slug: ${{ vars.SIGNPATH_SIGNING_POLICY_SLUG }}
|
|
||||||
artifact-configuration-slug: windows-msi
|
|
||||||
github-artifact-id: ${{ needs.build.outputs.windows_msi_artifact_id }}
|
|
||||||
wait-for-completion: true
|
|
||||||
skip-decompress: true
|
|
||||||
output-artifact-directory: signed-windows-msi
|
|
||||||
|
|
||||||
- name: Upload signed Windows assets
|
|
||||||
env:
|
|
||||||
GH_TOKEN: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
GITHUB_TOKEN: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
run: |
|
|
||||||
# SignPath may name the signed zip *.zip.zip (one compression level, bad Content-Disposition).
|
|
||||||
if [[ -f signed-windows-zip/OliveTin-windows-amd64.zip.zip ]]; then
|
|
||||||
mv signed-windows-zip/OliveTin-windows-amd64.zip.zip \
|
|
||||||
signed-windows-zip/OliveTin-windows-amd64.zip
|
|
||||||
fi
|
|
||||||
zip_path="$(find signed-windows-zip -type f -name 'OliveTin-windows-amd64.zip' | head -n 1)"
|
|
||||||
msi_path="$(find signed-windows-msi -type f -name 'OliveTin-windows-amd64.msi' | head -n 1)"
|
|
||||||
if [[ -z "${zip_path}" || -z "${msi_path}" ]]; then
|
|
||||||
echo "Signed Windows artifacts not found after SignPath:" >&2
|
|
||||||
find signed-windows-zip signed-windows-msi -type f >&2 || true
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
./var/windows/signpath-publish-signed.sh \
|
|
||||||
"${{ needs.build.outputs.new_release_git_tag }}" \
|
|
||||||
"${zip_path}" \
|
|
||||||
"${msi_path}"
|
|
||||||
|
|
@ -1,34 +0,0 @@
|
||||||
name: Buf CI
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- 'proto/**'
|
|
||||||
|
|
||||||
pull_request:
|
|
||||||
types: [opened, synchronize, reopened, labeled, unlabeled]
|
|
||||||
delete:
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
pull-requests: write
|
|
||||||
jobs:
|
|
||||||
buf:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@v5
|
|
||||||
with:
|
|
||||||
go-version-file: 'service/go.mod'
|
|
||||||
cache: true
|
|
||||||
cache-dependency-path: 'service/go.mod'
|
|
||||||
|
|
||||||
- uses: bufbuild/buf-action@v1.1.0
|
|
||||||
with:
|
|
||||||
token: ${{ secrets.BUF_TOKEN }}
|
|
||||||
# Change setup_only to true if you only want to set up the Action and not execute other commands.
|
|
||||||
# Otherwise, you can delete this line--the default is false.
|
|
||||||
setup_only: false
|
|
||||||
# Optional GitHub token for API requests. Ensures requests aren't rate limited.
|
|
||||||
github_token: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
|
|
@ -1,75 +0,0 @@
|
||||||
---
|
|
||||||
# For most projects, this workflow file will not need changing; you simply need
|
|
||||||
# to commit it to your repository.
|
|
||||||
#
|
|
||||||
# You may wish to alter this file to override the set of languages analyzed,
|
|
||||||
# or to provide custom queries or build logic.
|
|
||||||
#
|
|
||||||
# ******** NOTE ********
|
|
||||||
# We have attempted to detect the languages in your repository. Please check
|
|
||||||
# the `language` matrix defined below to confirm you have the correct set of
|
|
||||||
# supported CodeQL languages.
|
|
||||||
#
|
|
||||||
name: "CodeQL"
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/codeql-analysis.yml'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
branches: [main]
|
|
||||||
pull_request:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/codeql-analysis.yml'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
branches: [main]
|
|
||||||
schedule:
|
|
||||||
- cron: '25 10 * * 5'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
analyze:
|
|
||||||
name: Analyze
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
permissions:
|
|
||||||
actions: read
|
|
||||||
contents: read
|
|
||||||
security-events: write
|
|
||||||
|
|
||||||
strategy:
|
|
||||||
fail-fast: false
|
|
||||||
matrix:
|
|
||||||
language: ['go', 'javascript']
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@v5
|
|
||||||
with:
|
|
||||||
go-version-file: 'service/go.mod'
|
|
||||||
cache: true
|
|
||||||
cache-dependency-path: 'service/go.mod'
|
|
||||||
|
|
||||||
- name: Setup Node
|
|
||||||
if: matrix.language == 'javascript'
|
|
||||||
uses: actions/setup-node@v4
|
|
||||||
with:
|
|
||||||
node-version: '22'
|
|
||||||
|
|
||||||
# Initializes the CodeQL tools for scanning.
|
|
||||||
- name: Initialize CodeQL
|
|
||||||
uses: github/codeql-action/init@v3
|
|
||||||
with:
|
|
||||||
languages: ${{ matrix.language }}
|
|
||||||
|
|
||||||
- name: Perform CodeQL Analysis
|
|
||||||
uses: github/codeql-action/analyze@v3
|
|
||||||
with:
|
|
||||||
category: "/language:${{matrix.language}}"
|
|
||||||
|
|
@ -1,43 +0,0 @@
|
||||||
---
|
|
||||||
name: "Codestyle checks"
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/codestyle.yml'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
codestyle:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@v5
|
|
||||||
with:
|
|
||||||
go-version-file: 'service/go.mod'
|
|
||||||
cache: true
|
|
||||||
cache-dependency-path: 'service/go.mod'
|
|
||||||
|
|
||||||
- name: Print go version
|
|
||||||
run: go version
|
|
||||||
|
|
||||||
- name: service
|
|
||||||
run: make -wC service codestyle
|
|
||||||
|
|
||||||
- name: Setup Node
|
|
||||||
uses: actions/setup-node@v4
|
|
||||||
with:
|
|
||||||
node-version: '22'
|
|
||||||
|
|
||||||
- name: frontend
|
|
||||||
run: make -wC frontend codestyle
|
|
||||||
|
|
||||||
- name: frontend unit tests
|
|
||||||
run: make -wC frontend unittests
|
|
||||||
|
|
@ -1,54 +0,0 @@
|
||||||
# This workflow uses actions that are not certified by GitHub.
|
|
||||||
# They are provided by a third-party and are governed by
|
|
||||||
# separate terms of service, privacy policy, and support
|
|
||||||
# documentation.
|
|
||||||
|
|
||||||
name: DevSkim
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/devskim.yml'
|
|
||||||
- '.goreleaser.yml'
|
|
||||||
- 'Dockerfile.multiarches'
|
|
||||||
- 'Dockerfile.singlearch'
|
|
||||||
- 'Makefile'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
branches: [ "main" ]
|
|
||||||
pull_request:
|
|
||||||
paths:
|
|
||||||
- '.github/workflows/devskim.yml'
|
|
||||||
- '.goreleaser.yml'
|
|
||||||
- 'Dockerfile.multiarches'
|
|
||||||
- 'Dockerfile.singlearch'
|
|
||||||
- 'Makefile'
|
|
||||||
- 'frontend/**'
|
|
||||||
- 'integration-tests/**'
|
|
||||||
- 'proto/**'
|
|
||||||
- 'service/**'
|
|
||||||
branches: [ "main" ]
|
|
||||||
schedule:
|
|
||||||
- cron: '34 21 * * 2'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
lint:
|
|
||||||
name: DevSkim
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
permissions:
|
|
||||||
actions: read
|
|
||||||
contents: read
|
|
||||||
security-events: write
|
|
||||||
steps:
|
|
||||||
- name: Checkout code
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Run DevSkim scanner
|
|
||||||
uses: microsoft/DevSkim-Action@v1
|
|
||||||
|
|
||||||
- name: Upload DevSkim scan results to GitHub Security tab
|
|
||||||
uses: github/codeql-action/upload-sarif@v3
|
|
||||||
with:
|
|
||||||
sarif_file: devskim-results.sarif
|
|
||||||
|
|
@ -1,44 +0,0 @@
|
||||||
name: Antora docs
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
paths:
|
|
||||||
- 'docs/**'
|
|
||||||
- 'local-antora-playbook.yml'
|
|
||||||
- 'local-antora-playbook-ci.yml'
|
|
||||||
- '.github/workflows/docs-antora.yml'
|
|
||||||
pull_request:
|
|
||||||
paths:
|
|
||||||
- 'docs/**'
|
|
||||||
- 'local-antora-playbook.yml'
|
|
||||||
- 'local-antora-playbook-ci.yml'
|
|
||||||
- '.github/workflows/docs-antora.yml'
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
antora:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Install Node.js
|
|
||||||
uses: actions/setup-node@v4
|
|
||||||
with:
|
|
||||||
node-version: '22'
|
|
||||||
|
|
||||||
- name: Install Antora toolchain
|
|
||||||
run: npm i antora@3.1.14 asciidoctor-kroki@0.18.1 @asciidoctor/tabs@1.0.0-beta.6
|
|
||||||
|
|
||||||
- name: Generate docs site (smoke)
|
|
||||||
run: npx antora local-antora-playbook-ci.yml --log-level info
|
|
||||||
|
|
||||||
trigger-docs-publish:
|
|
||||||
needs: antora
|
|
||||||
if: github.event_name == 'push' && github.ref == 'refs/heads/next'
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Trigger docs.olivetin.app publish
|
|
||||||
env:
|
|
||||||
GH_TOKEN: ${{ secrets.CONTAINER_TOKEN }}
|
|
||||||
run: gh workflow run asciidoc.yml --repo OliveTin/docs.olivetin.app --ref main
|
|
||||||
|
|
@ -1,73 +0,0 @@
|
||||||
---
|
|
||||||
name: Issue Responsibility
|
|
||||||
|
|
||||||
on:
|
|
||||||
issue_comment:
|
|
||||||
types: [created]
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
update-responsibility-labels:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Update responsibility labels
|
|
||||||
uses: actions/github-script@v7
|
|
||||||
with:
|
|
||||||
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
script: |
|
|
||||||
const commentAuthor = context.payload.comment.user.login;
|
|
||||||
const issueNumber = context.payload.issue.number;
|
|
||||||
const owner = context.repo.owner;
|
|
||||||
const repo = context.repo.repo;
|
|
||||||
|
|
||||||
const skipAction = context.payload.comment.body.includes("/skip-responsibility");
|
|
||||||
|
|
||||||
if (skipAction) {
|
|
||||||
core.info("Skipping responsibility label update");
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
const developers = ["jamesread"]
|
|
||||||
const commenterIsDeveloper = developers.includes(commentAuthor);
|
|
||||||
const commenterIsUser = !commenterIsDeveloper;
|
|
||||||
|
|
||||||
const issueLabels = context.payload.issue.labels.map(label => label.name);
|
|
||||||
|
|
||||||
if (issueLabels.includes("waiting-on-developer")) {
|
|
||||||
if (commenterIsDeveloper) {
|
|
||||||
await github.rest.issues.removeLabel({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: issueNumber,
|
|
||||||
name: "waiting-on-developer",
|
|
||||||
});
|
|
||||||
|
|
||||||
await github.rest.issues.addLabels({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: issueNumber,
|
|
||||||
labels: ["waiting-on-requestor"],
|
|
||||||
});
|
|
||||||
|
|
||||||
core.info(`Switched responsibility to user for issue #${issueNumber}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (issueLabels.includes("waiting-on-requestor")) {
|
|
||||||
if (commenterIsUser) {
|
|
||||||
await github.rest.issues.removeLabel({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: issueNumber,
|
|
||||||
name: "waiting-on-requestor",
|
|
||||||
});
|
|
||||||
|
|
||||||
await github.rest.issues.addLabels({
|
|
||||||
owner,
|
|
||||||
repo,
|
|
||||||
issue_number: issueNumber,
|
|
||||||
labels: ["waiting-on-developer"],
|
|
||||||
});
|
|
||||||
|
|
||||||
core.info(`Switched responsibility to developer for issue #${issueNumber}`);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -29,3 +29,4 @@ docs/build/
|
||||||
build/
|
build/
|
||||||
Binary/
|
Binary/
|
||||||
.cursor
|
.cursor
|
||||||
|
.idea
|
||||||
Loading…
Reference in New Issue