chore(deps): consolidate 19 dependabot PRs into one #181
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: validate-compose | |
| # Validates every docker-compose YAML and every meaningful overlay | |
| # combination — without actually building images or booting services. | |
| # Catches syntax errors, missing env vars, malformed Traefik labels, and | |
| # overlay-merge regressions before they hit a developer's `up`. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "infra/compose/**" | |
| - ".github/workflows/infra-compose-validate-compose.yml" | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: infra-compose-validate-compose-${{ github.ref }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| compose-config: | |
| name: docker compose config (all overlay combinations) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| # Build contexts point at monorepo apps (`../../../apps/api` and | |
| # `../../../apps/ui` from infra/compose/compose). | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'infra/compose/**' | |
| - 'scripts/**' | |
| - '.github/workflows/**' | |
| - name: Seed .env | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| cp .env.example .env | |
| # Required for STACK=prod + WITH_GLITCHTIP combinations: | |
| echo "GLITCHTIP_SECRET_KEY=$(openssl rand -base64 50 | tr -d '\n')" >> .env | |
| echo "GLITCHTIP_PUBLIC_HOST=glitchtip.example.com" >> .env | |
| echo "GLITCHTIP_BASIC_AUTH_USERS=user:placeholder" >> .env | |
| - name: Validate — dev (base) | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| --profile dev config --quiet | |
| - name: Validate — prod (base) | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.production-labels.yml \ | |
| --profile prod config --quiet | |
| - name: Validate — dev + observability | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| -f docker-compose.observability.yml \ | |
| --profile dev --profile observability config --quiet | |
| - name: Validate — dev + glitchtip | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| -f docker-compose.glitchtip.yml \ | |
| --profile dev --profile glitchtip-dev config --quiet | |
| - name: Validate — prod + glitchtip (+ prod labels) | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.production-labels.yml \ | |
| -f docker-compose.glitchtip.yml \ | |
| -f docker-compose.glitchtip-prod-labels.yml \ | |
| --profile prod --profile glitchtip-prod config --quiet | |
| - name: Validate — dev + bullmq | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| -f docker-compose.bullmq.yml \ | |
| --profile dev --profile bullmq config --quiet | |
| - name: Validate — dev + wud | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| -f docker-compose.wud.yml \ | |
| --profile dev --profile wud config --quiet | |
| - name: Validate — kitchen-sink (dev + all overlays) | |
| if: steps.filter.outputs.code == 'true' | |
| working-directory: infra/compose/compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.development-labels.yml \ | |
| -f docker-compose.observability.yml \ | |
| -f docker-compose.glitchtip.yml \ | |
| -f docker-compose.bullmq.yml \ | |
| -f docker-compose.wud.yml \ | |
| --profile dev \ | |
| --profile observability \ | |
| --profile glitchtip-dev \ | |
| --profile bullmq \ | |
| --profile wud \ | |
| config --quiet | |
| shellcheck: | |
| name: shellcheck (scripts/) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'infra/compose/**' | |
| - 'scripts/**' | |
| - '.github/workflows/**' | |
| - name: ShellCheck | |
| if: steps.filter.outputs.code == 'true' | |
| run: | | |
| # Strict: error on warnings, follow `source` directives. | |
| shellcheck -x -S warning infra/compose/compose/dev.sh infra/compose/scripts/*.sh | |
| prod-image-build: | |
| name: build prod images (sanity) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| # Cheaper than booting the prod profile end-to-end, but still | |
| # exercises the actual prod Dockerfiles. Catches broken | |
| # multi-stage builds, missing build deps, or registry-auth | |
| # changes before main, instead of leaving the first breakage to | |
| # the post-merge release workflow. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'apps/api/Dockerfile.prod' | |
| - 'apps/api/.dockerignore' | |
| - 'apps/api/package.json' | |
| - 'apps/api/bun.lock' | |
| - 'apps/ui/Dockerfile.prod' | |
| - 'apps/ui/.dockerignore' | |
| - 'apps/ui/package.json' | |
| - 'apps/ui/bun.lock' | |
| - 'infra/compose/**' | |
| - '.github/workflows/infra-compose-validate-compose.yml' | |
| - name: Set up Docker Buildx | |
| if: steps.filter.outputs.code == 'true' | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Build apps/api prod image | |
| if: steps.filter.outputs.code == 'true' | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: apps/api | |
| file: apps/api/Dockerfile.prod | |
| push: false | |
| load: true | |
| tags: boringstack-api:pr-build | |
| cache-from: type=gha,scope=apps-api-prod | |
| cache-to: type=gha,scope=apps-api-prod,mode=max | |
| - name: Build apps/ui prod image | |
| if: steps.filter.outputs.code == 'true' | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: apps/ui | |
| file: apps/ui/Dockerfile.prod | |
| push: false | |
| load: true | |
| tags: boringstack-ui:pr-build | |
| cache-from: type=gha,scope=apps-ui-prod | |
| cache-to: type=gha,scope=apps-ui-prod,mode=max | |
| build-args: | | |
| VITE_API_URL=https://api.example.test | |
| yamllint: | |
| name: yamllint (compose + workflows) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'infra/compose/**' | |
| - 'scripts/**' | |
| - '.github/workflows/**' | |
| - name: yamllint | |
| if: steps.filter.outputs.code == 'true' | |
| run: | | |
| pip install --user yamllint | |
| # Document syntax (line length, indentation, truthy values) but | |
| # don't fail on style nits — only on real syntax errors. | |
| ~/.local/bin/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" \ | |
| infra/compose/compose/ .github/workflows/ | |