Sync CI workflows toward upstream gchq setup

2026-02-23 09:46:43 +01:00 · 2026-02-23 09:46:43 +01:00 · b1d279ea7b
commit b1d279ea7b
parent fa065912cc
4 changed files with 183 additions and 214 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -12,3 +12,7 @@ indent_size = 4
 [{package.json,.travis.yml,nightwatch.json}]
 indent_style = space
 indent_size = 2
+
+[.github/**.yml]
+indent_style = space
+indent_size = 2
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@ -2,38 +2,24 @@ name: "Master Build, Test & Deploy"

 on:
  workflow_dispatch:
-    inputs:
-      nightly:
-        description: "Tag build as nightly"
-        required: false
-        default: "false"
  push:
    branches:
      - master
-  schedule:
-    # Weekly build and publish to keep images fresh
-    - cron: '0 3 * * 1'

-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  PLATFORMS: linux/amd64,linux/arm64
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  PLATFORMS: linux/amd64,linux/arm64
+permissions:
+  contents: read

 jobs:
  main:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Set node version
-      uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
-        node-version: '18.x'
+          node-version: 18
+          registry-url: "https://registry.npmjs.org"

      - name: Install
        run: |
@ -51,7 +37,7 @@ jobs:

      - name: Production Build
        if: success()
-      run: npx grunt prod --msg="Version 10 is here! Read about the new features <a href='https://github.com/gchq/CyberChef/wiki/Character-encoding,-EOL-separators,-and-editor-features'>here</a>"
+        run: npx grunt prod --msg=""

      - name: Generate sitemap
        run: npx grunt exec:sitemap
@ -74,57 +60,3 @@ jobs:
          build_dir: ./build/prod
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  docker-images:
-    name: Build & Publish Docker Images
-    runs-on: ubuntu-latest
-    needs: main
-    if: github.ref == 'refs/heads/master'
-    permissions:
-      contents: read
-      packages: write
-    steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Set extra tags
-      run: |
-        if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.nightly }}" = "true" ]; then
-          echo "EXTRA_TAGS=type=raw,value=nightly" >> $GITHUB_ENV
-        else
-          echo "EXTRA_TAGS=" >> $GITHUB_ENV
-        fi
-
-    - name: Docker metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-        tags: |
-          type=raw,value=latest
-          type=sha,format=long
-          ${{ env.EXTRA_TAGS }}
-
-    - name: Build and push multi-arch image
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        file: ./Dockerfile
-        platforms: ${{ env.PLATFORMS }}
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
--- a/.github/workflows/pull_requests.yml
+++ b/.github/workflows/pull_requests.yml
@ -1,5 +1,8 @@
 name: "Pull Requests"

+permissions:
+  contents: read
+
 on:
  workflow_dispatch:
  pull_request:
@ -9,12 +12,13 @@ jobs:
  main:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Set node version
-      uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
-        node-version: '18.x'
+          node-version: 18
+          registry-url: "https://registry.npmjs.org"

      - name: Install
        run: |
@ -34,19 +38,21 @@ jobs:
        if: success()
        run: npx grunt prod

+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
      - name: Production Image Build
        if: success()
        id: build-image
-      uses: redhat-actions/buildah-build@v2
+        uses: docker/build-push-action@v6
        with:
-        # Not being uploaded to any registry, use a simple name to allow Buildah to build correctly.
-        image: cyberchef
-        containerfiles: ./Dockerfile
-        platforms: linux/amd64
-        oci: true
-        # Webpack seems to use a lot of open files, increase the max open file limit to accomodate.
-        extra-args: |
-          --ulimit nofile=10000
+          context: .
+          push: false
+          tags: cyberchef:pr
+          platforms: linux/amd64,linux/arm64

      - name: UI Tests
        if: success()
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@ -4,7 +4,10 @@ on:
  workflow_dispatch:
  push:
    tags:
-    - 'v*'
+      - "v*"
+
+permissions:
+  contents: read

 env:
  REGISTRY: ghcr.io
@ -16,12 +19,13 @@ jobs:
  main:
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - name: Set node version
-      uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
-        node-version: '18.x'
+          node-version: 18
+          registry-url: "https://registry.npmjs.org"

      - name: Install
        run: |
@ -45,6 +49,12 @@ jobs:
          sudo apt-get install xvfb
          xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui

+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
      - name: Image Metadata
        id: image-metadata
        uses: docker/metadata-action@v4
@ -55,30 +65,22 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}

-    - name: Production Image Build
-      id: build-image
-      uses: redhat-actions/buildah-build@v2
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
        with:
-        tags: ${{ steps.image-metadata.outputs.tags }}
-        labels: ${{ steps.image-metadata.outputs.labels }}
-        containerfiles: ./Dockerfile
-        platforms: linux/amd64,linux/arm64
-        oci: true
-        # enable build layer caching between platforms
-        layers: true
-        # Webpack seems to use a lot of open files, increase the max open file limit to accomodate.
-        extra-args: |
-          --ulimit nofile=10000
-
-    - name: Publish to GHCR
-      uses: redhat-actions/push-to-registry@v2
-      with:
-        image: ${{ steps.build-image.outputs.image }}
-        tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.REGISTRY }}
          username: ${{ env.REGISTRY_USER }}
          password: ${{ env.REGISTRY_PASSWORD }}

+      - name: Publish to GHCR
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.image-metadata.outputs.tags }}
+          labels: ${{ steps.image-metadata.outputs.labels }}
+          platforms: linux/amd64,linux/arm64
+
      - name: Upload Release Assets
        id: upload-release-assets
        uses: svenstaro/upload-release-action@v2
@ -90,7 +92,32 @@ jobs:
          file_glob: true
          body: "See the [CHANGELOG](https://github.com/gchq/CyberChef/blob/master/CHANGELOG.md) and [commit messages](https://github.com/gchq/CyberChef/commits/master) for details."

-    - name: Publish to NPM
-      uses: JS-DevTools/npm-publish@v1
+  npm-publish:
+    permissions:
+      id-token: write
+      contents: read
+    needs: main
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set node version
+        uses: actions/setup-node@v4
        with:
-        token: ${{ secrets.NPM_TOKEN }}
+          node-version: 18
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install
+        run: npm ci
+
+      - name: Create machine generated files
+        run: npm run node
+
+      - name: Reset node version ready for publish
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.5
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Publish to NPM
+        run: npm publish