From b1d279ea7b957a17688d9c7a524d80e976d5c1f2 Mon Sep 17 00:00:00 2001 From: Kili Date: Mon, 23 Feb 2026 09:46:43 +0100 Subject: [PATCH] Sync CI workflows toward upstream gchq setup --- .editorconfig | 4 + .github/workflows/master.yml | 150 +++++++------------------ .github/workflows/pull_requests.yml | 80 +++++++------- .github/workflows/releases.yml | 163 ++++++++++++++++------------ 4 files changed, 183 insertions(+), 214 deletions(-) diff --git a/.editorconfig b/.editorconfig index b50059bb..cef4cab0 100644 --- a/.editorconfig +++ b/.editorconfig @@ -12,3 +12,7 @@ indent_size = 4 [{package.json,.travis.yml,nightwatch.json}] indent_style = space indent_size = 2 + +[.github/**.yml] +indent_style = space +indent_size = 2 diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index f31dc3c9..d4cf35c0 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -2,129 +2,61 @@ name: "Master Build, Test & Deploy" on: workflow_dispatch: - inputs: - nightly: - description: "Tag build as nightly" - required: false - default: "false" push: branches: - - master - schedule: - # Weekly build and publish to keep images fresh - - cron: '0 3 * * 1' + - master -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - PLATFORMS: linux/amd64,linux/arm64 - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - PLATFORMS: linux/amd64,linux/arm64 +permissions: + contents: read jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - name: Set node version - uses: actions/setup-node@v3 - with: - node-version: '18.x' + - name: Set node version + uses: actions/setup-node@v4 + with: + node-version: 18 + registry-url: "https://registry.npmjs.org" - - name: Install - run: | - export DETECT_CHROMEDRIVER_VERSION=true - npm install - npm run setheapsize + - name: Install + run: | + export DETECT_CHROMEDRIVER_VERSION=true + npm install + npm run setheapsize - - name: Lint - run: npx grunt lint + - name: Lint + run: npx grunt lint - - name: Unit Tests - run: | - npm test - npm run testnodeconsumer + - name: Unit Tests + run: | + npm test + npm run testnodeconsumer - - name: Production Build - if: success() - run: npx grunt prod --msg="Version 10 is here! Read about the new features here" + - name: Production Build + if: success() + run: npx grunt prod --msg="" - - name: Generate sitemap - run: npx grunt exec:sitemap + - name: Generate sitemap + run: npx grunt exec:sitemap - - name: UI Tests - if: success() - run: | - sudo apt-get install xvfb - xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui + - name: UI Tests + if: success() + run: | + sudo apt-get install xvfb + xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui - - name: Prepare for GitHub Pages - if: success() - run: npx grunt copy:ghPages + - name: Prepare for GitHub Pages + if: success() + run: npx grunt copy:ghPages - - name: Deploy to GitHub Pages - if: success() && github.ref == 'refs/heads/master' - uses: crazy-max/ghaction-github-pages@v3 - with: - target_branch: gh-pages - build_dir: ./build/prod - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - docker-images: - name: Build & Publish Docker Images - runs-on: ubuntu-latest - needs: main - if: github.ref == 'refs/heads/master' - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@v4 - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set extra tags - run: | - if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.nightly }}" = "true" ]; then - echo "EXTRA_TAGS=type=raw,value=nightly" >> $GITHUB_ENV - else - echo "EXTRA_TAGS=" >> $GITHUB_ENV - fi - - - name: Docker metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=raw,value=latest - type=sha,format=long - ${{ env.EXTRA_TAGS }} - - - name: Build and push multi-arch image - uses: docker/build-push-action@v5 - with: - context: . - file: ./Dockerfile - platforms: ${{ env.PLATFORMS }} - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max + - name: Deploy to GitHub Pages + if: success() && github.ref == 'refs/heads/master' + uses: crazy-max/ghaction-github-pages@v3 + with: + target_branch: gh-pages + build_dir: ./build/prod + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index 296e60b9..12d18ad2 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -1,5 +1,8 @@ name: "Pull Requests" +permissions: + contents: read + on: workflow_dispatch: pull_request: @@ -9,47 +12,50 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - name: Set node version - uses: actions/setup-node@v3 - with: - node-version: '18.x' + - name: Set node version + uses: actions/setup-node@v4 + with: + node-version: 18 + registry-url: "https://registry.npmjs.org" - - name: Install - run: | - export DETECT_CHROMEDRIVER_VERSION=true - npm install - npm run setheapsize + - name: Install + run: | + export DETECT_CHROMEDRIVER_VERSION=true + npm install + npm run setheapsize - - name: Lint - run: npx grunt lint + - name: Lint + run: npx grunt lint - - name: Unit Tests - run: | - npm test - npm run testnodeconsumer + - name: Unit Tests + run: | + npm test + npm run testnodeconsumer - - name: Production Build - if: success() - run: npx grunt prod + - name: Production Build + if: success() + run: npx grunt prod - - name: Production Image Build - if: success() - id: build-image - uses: redhat-actions/buildah-build@v2 - with: - # Not being uploaded to any registry, use a simple name to allow Buildah to build correctly. - image: cyberchef - containerfiles: ./Dockerfile - platforms: linux/amd64 - oci: true - # Webpack seems to use a lot of open files, increase the max open file limit to accomodate. - extra-args: | - --ulimit nofile=10000 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - - name: UI Tests - if: success() - run: | - sudo apt-get install xvfb - xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Production Image Build + if: success() + id: build-image + uses: docker/build-push-action@v6 + with: + context: . + push: false + tags: cyberchef:pr + platforms: linux/amd64,linux/arm64 + + - name: UI Tests + if: success() + run: | + sudo apt-get install xvfb + xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index a77f4984..57cc7211 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -4,7 +4,10 @@ on: workflow_dispatch: push: tags: - - 'v*' + - "v*" + +permissions: + contents: read env: REGISTRY: ghcr.io @@ -16,81 +19,105 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - name: Set node version - uses: actions/setup-node@v3 - with: - node-version: '18.x' + - name: Set node version + uses: actions/setup-node@v4 + with: + node-version: 18 + registry-url: "https://registry.npmjs.org" - - name: Install - run: | - export DETECT_CHROMEDRIVER_VERSION=true - npm ci - npm run setheapsize + - name: Install + run: | + export DETECT_CHROMEDRIVER_VERSION=true + npm ci + npm run setheapsize - - name: Lint - run: npx grunt lint + - name: Lint + run: npx grunt lint - - name: Unit Tests - run: | - npm test - npm run testnodeconsumer + - name: Unit Tests + run: | + npm test + npm run testnodeconsumer - - name: Production Build - run: npx grunt prod + - name: Production Build + run: npx grunt prod - - name: UI Tests - run: | - sudo apt-get install xvfb - xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui + - name: UI Tests + run: | + sudo apt-get install xvfb + xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui - - name: Image Metadata - id: image-metadata - uses: docker/metadata-action@v4 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=semver,pattern={{major}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{version}} + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 - - name: Production Image Build - id: build-image - uses: redhat-actions/buildah-build@v2 - with: - tags: ${{ steps.image-metadata.outputs.tags }} - labels: ${{ steps.image-metadata.outputs.labels }} - containerfiles: ./Dockerfile - platforms: linux/amd64,linux/arm64 - oci: true - # enable build layer caching between platforms - layers: true - # Webpack seems to use a lot of open files, increase the max open file limit to accomodate. - extra-args: | - --ulimit nofile=10000 + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 - - name: Publish to GHCR - uses: redhat-actions/push-to-registry@v2 - with: - image: ${{ steps.build-image.outputs.image }} - tags: ${{ steps.build-image.outputs.tags }} - registry: ${{ env.REGISTRY }} - username: ${{ env.REGISTRY_USER }} - password: ${{ env.REGISTRY_PASSWORD }} + - name: Image Metadata + id: image-metadata + uses: docker/metadata-action@v4 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=semver,pattern={{major}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{version}} - - name: Upload Release Assets - id: upload-release-assets - uses: svenstaro/upload-release-action@v2 - with: - repo_token: ${{ secrets.GITHUB_TOKEN }} - file: build/prod/*.zip - tag: ${{ github.ref }} - overwrite: true - file_glob: true - body: "See the [CHANGELOG](https://github.com/gchq/CyberChef/blob/master/CHANGELOG.md) and [commit messages](https://github.com/gchq/CyberChef/commits/master) for details." + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ env.REGISTRY_USER }} + password: ${{ env.REGISTRY_PASSWORD }} - - name: Publish to NPM - uses: JS-DevTools/npm-publish@v1 - with: - token: ${{ secrets.NPM_TOKEN }} + - name: Publish to GHCR + uses: docker/build-push-action@v6 + with: + context: . + push: true + tags: ${{ steps.image-metadata.outputs.tags }} + labels: ${{ steps.image-metadata.outputs.labels }} + platforms: linux/amd64,linux/arm64 + + - name: Upload Release Assets + id: upload-release-assets + uses: svenstaro/upload-release-action@v2 + with: + repo_token: ${{ secrets.GITHUB_TOKEN }} + file: build/prod/*.zip + tag: ${{ github.ref }} + overwrite: true + file_glob: true + body: "See the [CHANGELOG](https://github.com/gchq/CyberChef/blob/master/CHANGELOG.md) and [commit messages](https://github.com/gchq/CyberChef/commits/master) for details." + + npm-publish: + permissions: + id-token: write + contents: read + needs: main + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Set node version + uses: actions/setup-node@v4 + with: + node-version: 18 + registry-url: "https://registry.npmjs.org" + + - name: Install + run: npm ci + + - name: Create machine generated files + run: npm run node + + - name: Reset node version ready for publish + uses: actions/setup-node@v4 + with: + node-version: 24.5 + registry-url: "https://registry.npmjs.org" + + - name: Publish to NPM + run: npm publish