Skip to content

Commit 429ddd5

Browse files
mvdscheemvdschee
authored
Merge pull request #1 from mvdschee/chore/maintenance
Chore/maintenance
2 parents 5787bf1 + 0a01b31 commit 429ddd5

8 files changed

Lines changed: 182 additions & 333 deletions

File tree

‎.docker/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# syntax=docker/dockerfile:1.7
22

33
# Builder: hardened Alpine + dev toolchain
4-
FROM dhi.io/alpine-base:3.23-alpine3.23-dev AS builder
4+
FROM dhi.io/alpine-base:3.24-alpine3.24-dev AS builder
55

66
USER root
77

@@ -24,7 +24,7 @@ RUN apk add --no-cache \
2424
pkgconf \
2525
ca-certificates
2626

27-
ARG RUST_VERSION=1.90.0
27+
ARG RUST_VERSION=1.96.0
2828
ARG TARGETARCH
2929
ENV RUSTUP_HOME=/usr/local/rustup \
3030
CARGO_HOME=/usr/local/cargo \
@@ -99,7 +99,7 @@ EOF
9999

100100
# Runtime: minimal hardened Alpine. Ships only busybox + musl + ca-certs.
101101
# DHI images run as the 'nonroot' user (uid/gid 65532) by default.
102-
FROM dhi.io/alpine-base:3.23
102+
FROM dhi.io/alpine-base:3.24
103103

104104
# Lay down the binary and pre-create mount-point directories with the
105105
# correct ownership. Named volumes inherit this ownership on first use,

‎.github/workflows/ci.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: ci
2+
3+
on:
4+
push:
5+
branches:
6+
- "**"
7+
8+
jobs:
9+
build:
10+
name: build (${{ matrix.platform }})
11+
runs-on: ${{ matrix.runner }}
12+
permissions:
13+
contents: read
14+
strategy:
15+
fail-fast: false
16+
matrix:
17+
include:
18+
- platform: linux/amd64
19+
runner: ubuntu-latest
20+
- platform: linux/arm64
21+
runner: ubuntu-24.04-arm
22+
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v7.0.1
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v4.2.0
29+
30+
# dhi.io is gated: the builder pulls dhi.io/alpine-base:*-dev and
31+
# the runtime stage pulls dhi.io/alpine-base:3.23.
32+
- name: Login to Docker Hub (for dhi.io)
33+
uses: docker/login-action@v4.5.1
34+
with:
35+
registry: dhi.io
36+
username: ${{ secrets.DOCKERHUB_USERNAME }}
37+
password: ${{ secrets.DOCKERHUB_TOKEN }}
38+
39+
- name: Build image (no push)
40+
uses: docker/build-push-action@v7.3.0
41+
with:
42+
context: .
43+
file: .docker/Dockerfile
44+
platforms: ${{ matrix.platform }}
45+
cache-from: type=gha,scope=${{ matrix.platform }}
46+
cache-to: type=gha,scope=${{ matrix.platform }},mode=max
47+
push: false

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ jobs:
2828

2929
steps:
3030
- name: Checkout
31-
uses: actions/checkout@v5
31+
uses: actions/checkout@v7.0.1
3232

3333
- name: Set up Docker Buildx
34-
uses: docker/setup-buildx-action@v4
34+
uses: docker/setup-buildx-action@v4.2.0
3535

3636
# dhi.io is gated: the builder pulls dhi.io/alpine-base:*-dev and
3737
# the runtime stage pulls dhi.io/alpine-base:3.23.
3838
- name: Login to Docker Hub (for dhi.io)
39-
uses: docker/login-action@v4
39+
uses: docker/login-action@v4.5.1
4040
with:
4141
registry: dhi.io
4242
username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -45,21 +45,21 @@ jobs:
4545
# Push login to docker.io (default registry). Same creds as dhi.io,
4646
# but a separate registry endpoint so we can push the public image.
4747
- name: Login to Docker Hub (push)
48-
uses: docker/login-action@v4
48+
uses: docker/login-action@v4.5.1
4949
with:
5050
username: ${{ secrets.DOCKERHUB_USERNAME }}
5151
password: ${{ secrets.DOCKERHUB_TOKEN }}
5252

5353
- name: Login to GHCR
54-
uses: docker/login-action@v4
54+
uses: docker/login-action@v4.5.1
5555
with:
5656
registry: ${{ env.REGISTRY }}
5757
username: ${{ github.actor }}
5858
password: ${{ secrets.GITHUB_TOKEN }}
5959

6060
- name: Extract image metadata
6161
id: meta
62-
uses: docker/metadata-action@v6
62+
uses: docker/metadata-action@v6.2.0
6363
with:
6464
images: |
6565
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -69,7 +69,7 @@ jobs:
6969
# job below stitches the digests into one multi-arch manifest.
7070
- name: Build and push by digest
7171
id: build
72-
uses: docker/build-push-action@v7
72+
uses: docker/build-push-action@v7.3.0
7373
with:
7474
context: .
7575
file: .docker/Dockerfile
@@ -86,7 +86,7 @@ jobs:
8686
touch "/tmp/digests/${digest#sha256:}"
8787
8888
- name: Upload digest
89-
uses: actions/upload-artifact@v7
89+
uses: actions/upload-artifact@v7.0.1
9090
with:
9191
name: digest-${{ strategy.job-index }}
9292
path: /tmp/digests/*
@@ -103,31 +103,31 @@ jobs:
103103

104104
steps:
105105
- name: Download digests
106-
uses: actions/download-artifact@v8
106+
uses: actions/download-artifact@v8.0.1
107107
with:
108108
path: /tmp/digests
109109
pattern: digest-*
110110
merge-multiple: true
111111

112112
- name: Set up Docker Buildx
113-
uses: docker/setup-buildx-action@v4
113+
uses: docker/setup-buildx-action@v4.2.0
114114

115115
- name: Login to GHCR
116-
uses: docker/login-action@v4
116+
uses: docker/login-action@v4.5.1
117117
with:
118118
registry: ${{ env.REGISTRY }}
119119
username: ${{ github.actor }}
120120
password: ${{ secrets.GITHUB_TOKEN }}
121121

122122
- name: Login to Docker Hub (push)
123-
uses: docker/login-action@v4
123+
uses: docker/login-action@v4.5.1
124124
with:
125125
username: ${{ secrets.DOCKERHUB_USERNAME }}
126126
password: ${{ secrets.DOCKERHUB_TOKEN }}
127127

128128
- name: Extract image metadata
129129
id: meta
130-
uses: docker/metadata-action@v6
130+
uses: docker/metadata-action@v6.2.0
131131
with:
132132
images: |
133133
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,6 @@ target/
22
.env
33
.DS_Store
44
.certs/
5+
6+
# used to locally test with real email (acme don't allow fake email)
7+
example/local.toml

0 commit comments

Comments
 (0)