mat
13f49305da
ha-build.yml runs on self-hosted k3s runners. Having pull_request as a trigger allows any internet user to open a PR against this public repo and execute arbitrary code on cluster nodes (GitHub does block secret injection on fork PRs, but runner filesystem and cluster network access remain). Removed pull_request trigger. Build-on-push-to-main is sufficient. CI test feedback on PRs is covered by ci-tests.yml which uses GitHub-hosted (ubuntu-latest) runners only.
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
name: HA Build & Push to ECR
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
- main
|
|
- "feat/ha-*"
|
|
- "feat/phase*"
|
|
- "copilot/*"
|
|
# pull_request intentionally removed: this workflow runs on self-hosted k3s
|
|
# runners. Allowing pull_request events from a public repo would let any
|
|
# internet user execute arbitrary code inside the cluster network.
|
|
# CI build feedback on PRs is provided by ci-tests.yml (GitHub-hosted runners).
|
|
|
|
# Cancel in-progress runs when a new push arrives on the same branch.
|
|
concurrency:
|
|
group: ha-build-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: [self-hosted, k3s, linux, amd64]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
|
|
with:
|
|
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
aws-region: ${{ secrets.AWS_REGION }}
|
|
|
|
- name: Login to Amazon ECR
|
|
id: ecr-login
|
|
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
|
|
|
|
- name: Set image metadata
|
|
id: meta
|
|
run: |
|
|
REPO="${{ steps.ecr-login.outputs.registry }}/${{ secrets.ECR_REPOSITORY }}"
|
|
SHORT_SHA="${GITHUB_SHA::7}"
|
|
echo "image_repo=${REPO}" >> "$GITHUB_OUTPUT"
|
|
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Install .NET SDK
|
|
# Build on the runner host filesystem (native I/O) to avoid DinD
|
|
# overlay-on-overlay throttling which makes dotnet publish ~20x slower.
|
|
run: |
|
|
DOTNET_INSTALL_DIR="$HOME/.dotnet"
|
|
mkdir -p "$DOTNET_INSTALL_DIR"
|
|
if ! "$DOTNET_INSTALL_DIR/dotnet" --version 2>/dev/null | grep -q "^10\\."; then
|
|
curl -fsSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 10.0 --install-dir "$DOTNET_INSTALL_DIR"
|
|
fi
|
|
echo "DOTNET_ROOT=$DOTNET_INSTALL_DIR" >> "$GITHUB_ENV"
|
|
echo "PATH=$DOTNET_INSTALL_DIR:$PATH" >> "$GITHUB_ENV"
|
|
|
|
- name: Restore NuGet packages
|
|
run: |
|
|
export PATH="$HOME/.dotnet:$PATH"
|
|
dotnet restore Jellyfin.Server/Jellyfin.Server.csproj --runtime linux-x64
|
|
|
|
- name: Publish Jellyfin server
|
|
run: |
|
|
export PATH="$HOME/.dotnet:$PATH"
|
|
dotnet publish Jellyfin.Server/Jellyfin.Server.csproj \
|
|
--configuration Release \
|
|
--runtime linux-x64 \
|
|
--self-contained false \
|
|
--no-restore \
|
|
-p:TreatWarningsAsErrors=false \
|
|
--output ./publish-output
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: Dockerfile.runtime
|
|
platforms: linux/amd64
|
|
# Only push the image on direct branch pushes, not on pull_request events.
|
|
push: ${{ github.event_name == 'push' }}
|
|
provenance: false
|
|
tags: |
|
|
${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.short_sha }}
|
|
${{ steps.meta.outputs.image_repo }}:latest
|