This repository was archived by the owner on Jun 18, 2026. It is now read-only.
feat: ASCII/Unicode graph renderer for terminal visualization #284
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| on: | |
| push: | |
| branches: [master] | |
| tags: ["v*.*.*"] | |
| pull_request: | |
| branches: [master] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write # for Trivy SARIF upload | |
| concurrency: | |
| group: docker-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| docker: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=edge,branch=master | |
| type=sha,prefix=sha- | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| id: build | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Load image locally for scanning even on PRs | |
| load: ${{ github.event_name == 'pull_request' }} | |
| - name: Determine scan image | |
| id: scan-image | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| # Use the first tag from metadata (locally loaded) | |
| echo "image=$(echo '${{ steps.meta.outputs.tags }}' | head -1)" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "image=ghcr.io/${{ github.repository }}:sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Trivy vulnerability scan | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| image-ref: ${{ steps.scan-image.outputs.image }} | |
| format: table | |
| exit-code: 0 # warn, don't fail the build | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| - name: Trivy SARIF report | |
| if: github.event_name != 'pull_request' | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| image-ref: ${{ steps.scan-image.outputs.image }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| - name: Upload Trivy SARIF | |
| if: github.event_name != 'pull_request' | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| continue-on-error: true # don't fail if Advanced Security is disabled | |
| - name: Verify image (on push) | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| docker pull ghcr.io/${{ github.repository }}:sha-${GITHUB_SHA::7} | |
| docker run --rm ghcr.io/${{ github.repository }}:sha-${GITHUB_SHA::7} \ | |
| -version 2>&1 | head -5 | |
| echo "✅ Image verified successfully" |