Skip to content

Commit 40f9c5f

Browse files
fylornfylorn
authored
Release 3.2.1 (#88)
See CHANGELOG.md [3.2.1].
1 parent bf3294f commit 40f9c5f

57 files changed

Lines changed: 3878 additions & 2516 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 44 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717

1818
services:
1919
postgres:
20-
image: postgres:18-alpine
20+
image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
2121
env:
2222
POSTGRES_USER: postgres
2323
POSTGRES_PASSWORD: postgres
@@ -30,7 +30,7 @@ jobs:
3030
--health-timeout 5s
3131
--health-retries 5
3232
redis:
33-
image: redis:8-alpine
33+
image: redis:8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
3434
ports:
3535
- 6379:6379
3636
options: >-
@@ -46,7 +46,7 @@ jobs:
4646
ENCRYPTION_KEY: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
4747

4848
steps:
49-
- uses: actions/checkout@v4
49+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5050

5151
# The default ubuntu-latest runner ships with ~14GB free, which
5252
# the workspace compile + 40+ test-binary link step regularly
@@ -59,9 +59,17 @@ jobs:
5959
/opt/hostedtoolcache/CodeQL /usr/local/.ghcup
6060
df -h /
6161
62-
- uses: dtolnay/rust-toolchain@stable
63-
- uses: Swatinem/rust-cache@v2
64-
- uses: taiki-e/install-action@v2
62+
- uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
63+
with:
64+
toolchain: stable
65+
# Save only on pushes (dev, main). A PR can read its own caches, its
66+
# base branch's and the default branch's, never another PR's, so a cache
67+
# saved on a PR serves only a later push to that same PR, while taking as
68+
# much of the repository's 10 GB cache quota as dev's and evicting it.
69+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
70+
with:
71+
save-if: ${{ github.event_name == 'push' }}
72+
- uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
6573
with:
6674
tool: cargo-nextest
6775

@@ -89,7 +97,7 @@ jobs:
8997

9098
services:
9199
postgres:
92-
image: postgres:18-alpine
100+
image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
93101
env:
94102
POSTGRES_USER: postgres
95103
POSTGRES_PASSWORD: postgres
@@ -106,7 +114,7 @@ jobs:
106114
--health-timeout 5s
107115
--health-retries 10
108116
redis:
109-
image: redis:8-alpine
117+
image: redis:8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
110118
ports:
111119
- 6379:6379
112120
options: >-
@@ -115,7 +123,7 @@ jobs:
115123
--health-timeout 5s
116124
--health-retries 10
117125
clickhouse:
118-
image: clickhouse/clickhouse-server:26.3-alpine
126+
image: clickhouse/clickhouse-server:26.8-alpine@sha256:652d6997949183f3493f8ff601149e3df4d476be829f0d02b9861454d040c410
119127
env:
120128
CLICKHOUSE_USER: default
121129
CLICKHOUSE_PASSWORD: chtest
@@ -142,7 +150,7 @@ jobs:
142150
TEST_CLICKHOUSE_PASSWORD: chtest
143151

144152
steps:
145-
- uses: actions/checkout@v4
153+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
146154

147155
# Same disk pressure as the unit job: the server plus 50-odd test
148156
# binaries do not fit in the runner's default free space.
@@ -152,9 +160,14 @@ jobs:
152160
/opt/hostedtoolcache/CodeQL /usr/local/.ghcup
153161
df -h /
154162
155-
- uses: dtolnay/rust-toolchain@stable
156-
- uses: Swatinem/rust-cache@v2
157-
- uses: taiki-e/install-action@v2
163+
- uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
164+
with:
165+
toolchain: stable
166+
- uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
167+
with:
168+
# See the `rust` job.
169+
save-if: ${{ github.event_name == 'push' }}
170+
- uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
158171
with:
159172
tool: cargo-nextest
160173

@@ -171,13 +184,13 @@ jobs:
171184
run:
172185
working-directory: web
173186
steps:
174-
- uses: actions/checkout@v4
175-
- uses: pnpm/action-setup@v4
187+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
188+
- uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
176189
with:
177190
# Pinned — matches `packageManager` in web/package.json.
178191
# Bump together with that field, never alone.
179-
version: 11.0.0
180-
- uses: actions/setup-node@v4
192+
version: 12.9.1
193+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
181194
with:
182195
node-version: 24
183196
cache: pnpm
@@ -221,30 +234,30 @@ jobs:
221234
matrix:
222235
platform: [linux/amd64, linux/arm64]
223236
steps:
224-
- uses: actions/checkout@v4
237+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
225238

226239
- name: Set image prefix
227240
run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
228241

229242
- name: Docker meta
230243
id: meta
231-
uses: docker/metadata-action@v5
244+
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
232245
with:
233246
images: ${{ env.IMAGE_PREFIX }}/think-watch-server
234247

235248
- name: Log in to GitHub Container Registry
236-
uses: docker/login-action@v3
249+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
237250
with:
238251
registry: ghcr.io
239252
username: ${{ github.actor }}
240253
password: ${{ secrets.GITHUB_TOKEN }}
241254

242255
- name: Set up Docker Buildx
243-
uses: docker/setup-buildx-action@v3
256+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
244257

245258
- name: Build and push by digest
246259
id: build
247-
uses: docker/build-push-action@v6
260+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
248261
with:
249262
context: .
250263
file: deploy/docker/Dockerfile.server
@@ -261,7 +274,7 @@ jobs:
261274
touch "${{ runner.temp }}/digests/${digest#sha256:}"
262275
263276
- name: Upload digest
264-
uses: actions/upload-artifact@v4
277+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
265278
with:
266279
name: server-digest-${{ strategy.job-index }}
267280
path: ${{ runner.temp }}/digests
@@ -281,21 +294,21 @@ jobs:
281294
run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
282295

283296
- name: Download digests
284-
uses: actions/download-artifact@v4
297+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
285298
with:
286299
pattern: server-digest-*
287300
merge-multiple: true
288301
path: ${{ runner.temp }}/digests
289302

290303
- name: Log in to GitHub Container Registry
291-
uses: docker/login-action@v3
304+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
292305
with:
293306
registry: ghcr.io
294307
username: ${{ github.actor }}
295308
password: ${{ secrets.GITHUB_TOKEN }}
296309

297310
- name: Set up Docker Buildx
298-
uses: docker/setup-buildx-action@v3
311+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
299312

300313
# **Tagged by commit SHA only. `:latest` belongs to release.yml.**
301314
#
@@ -337,26 +350,26 @@ jobs:
337350
contents: read
338351
packages: write
339352
steps:
340-
- uses: actions/checkout@v4
353+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
341354

342355
- name: Set image prefix
343356
run: echo "IMAGE_PREFIX=ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
344357

345358
- name: Log in to GitHub Container Registry
346-
uses: docker/login-action@v3
359+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
347360
with:
348361
registry: ghcr.io
349362
username: ${{ github.actor }}
350363
password: ${{ secrets.GITHUB_TOKEN }}
351364

352365
- name: Set up QEMU
353-
uses: docker/setup-qemu-action@v3
366+
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
354367

355368
- name: Set up Docker Buildx
356-
uses: docker/setup-buildx-action@v3
369+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
357370

358371
- name: Build and push web image
359-
uses: docker/build-push-action@v6
372+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
360373
with:
361374
context: .
362375
file: deploy/docker/Dockerfile.web

‎.github/workflows/release.yml‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151
- platform: linux/arm64
5252
runner: ubuntu-24.04-arm
5353
steps:
54-
- uses: actions/checkout@v4
54+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5555

5656
- name: Reclaim runner disk
5757
# `Dockerfile.server` links the entire workspace under LTO +
@@ -63,10 +63,10 @@ jobs:
6363
df -h /
6464
6565
- name: Set up Buildx
66-
uses: docker/setup-buildx-action@v3
66+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
6767

6868
- name: Log in to GHCR
69-
uses: docker/login-action@v3
69+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
7070
with:
7171
registry: ghcr.io
7272
username: ${{ github.actor }}
@@ -75,7 +75,7 @@ jobs:
7575
- name: Resolve image name + platform pair
7676
id: meta
7777
# `platform_pair` is the platform name munged for use as an
78-
# artifact suffix — `actions/upload-artifact@v4` rejects `/`.
78+
# artifact suffix — `actions/upload-artifact` rejects `/`.
7979
# `image` lowercases the owner because GHCR is case-sensitive
8080
# on path segments and the Helm values default to lowercase.
8181
run: |
@@ -87,7 +87,7 @@ jobs:
8787
8888
- name: Build & push by digest
8989
id: build
90-
uses: docker/build-push-action@v6
90+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
9191
with:
9292
context: .
9393
file: deploy/docker/Dockerfile.${{ matrix.component }}
@@ -104,8 +104,13 @@ jobs:
104104
org.opencontainers.image.version=${{ github.ref_name }}
105105
org.opencontainers.image.revision=${{ github.sha }}
106106
org.opencontainers.image.licenses=BUSL-1.1
107-
cache-from: type=gha,scope=${{ matrix.component }}-${{ steps.meta.outputs.platform_pair }}
108-
cache-to: type=gha,scope=${{ matrix.component }}-${{ steps.meta.outputs.platform_pair }},mode=max
107+
# Read the caches CI saves on main, never write. A tag run can read
108+
# its own caches and the default branch's (main) only, and the tag
109+
# points at a commit whose main push CI has just built from the same
110+
# Dockerfile, so these scopes are CI's (`server-<platform>`, and `web`
111+
# for both platforms). A cache written here would be filed under the
112+
# tag, where no later run can read it.
113+
cache-from: type=gha,scope=${{ matrix.component == 'web' && 'web' || format('server-{0}', matrix.platform) }}
109114

110115
- name: Export digest
111116
run: |
@@ -114,7 +119,7 @@ jobs:
114119
touch "${{ runner.temp }}/digests/${digest#sha256:}"
115120
116121
- name: Upload digest
117-
uses: actions/upload-artifact@v4
122+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
118123
with:
119124
name: digests-${{ matrix.component }}-${{ steps.meta.outputs.platform_pair }}
120125
path: ${{ runner.temp }}/digests/*
@@ -135,17 +140,17 @@ jobs:
135140
component: [server, web]
136141
steps:
137142
- name: Download digests
138-
uses: actions/download-artifact@v4
143+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
139144
with:
140145
path: ${{ runner.temp }}/digests
141146
pattern: digests-${{ matrix.component }}-*
142147
merge-multiple: true
143148

144149
- name: Set up Buildx
145-
uses: docker/setup-buildx-action@v3
150+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
146151

147152
- name: Log in to GHCR
148-
uses: docker/login-action@v3
153+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
149154
with:
150155
registry: ghcr.io
151156
username: ${{ github.actor }}
@@ -201,8 +206,8 @@ jobs:
201206
name: Helm chart
202207
runs-on: ubuntu-latest
203208
steps:
204-
- uses: actions/checkout@v4
205-
- uses: azure/setup-helm@v4
209+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
210+
- uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
206211
with:
207212
version: latest
208213
- name: Resolve version
@@ -220,7 +225,7 @@ jobs:
220225
--app-version "${{ steps.meta.outputs.version }}" \
221226
--destination .
222227
- name: Upload chart artifact
223-
uses: actions/upload-artifact@v4
228+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
224229
with:
225230
name: helm-chart
226231
path: think-watch-*.tgz
@@ -234,9 +239,9 @@ jobs:
234239
needs: [merge-manifests, package-helm]
235240
runs-on: ubuntu-latest
236241
steps:
237-
- uses: actions/checkout@v4
242+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
238243
- name: Download Helm chart artifact
239-
uses: actions/download-artifact@v4
244+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
240245
with:
241246
name: helm-chart
242247
path: .
@@ -290,7 +295,7 @@ jobs:
290295
esac
291296
echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
292297
- name: Create release
293-
uses: softprops/action-gh-release@v2
298+
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
294299
with:
295300
tag_name: ${{ github.ref_name }}
296301
name: ThinkWatch ${{ github.ref_name }}

0 commit comments

Comments
 (0)