Merge remote-tracking branch 'upstream/main' #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish debug Docker image | |
| # The secret grabber ships on its own cadence, so this image tracks the extractor's version rather than | |
| # a spotify_monitor release: a change on main publishes it, and a weekly rebuild refreshes the base. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - debug/spotify_monitor_secret_grabber.py | |
| - debug/spotify_monitor_secret_grabber_docker/** | |
| - .github/workflows/publish-debug-docker.yml | |
| schedule: | |
| # Chromium and Debian publish fixes between extractor changes, so the image is rebuilt weekly. | |
| - cron: "41 5 * * 3" | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Optional image tag like 1.4, defaults to the version declared in the extractor | |
| required: false | |
| type: string | |
| push_latest: | |
| description: Also push latest tag | |
| required: false | |
| type: boolean | |
| default: true | |
| env: | |
| IMAGE_NAME: misiektoja/spotify-secrets-grabber | |
| permissions: {} | |
| jobs: | |
| test: | |
| name: Tests and container smoke checks | |
| # A called workflow cannot exceed what the calling job grants, so the checkout in tests.yml needs this. | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/tests.yml | |
| publish-debug-docker: | |
| name: Build and publish multi-architecture debug image to Docker Hub | |
| needs: test | |
| # A fork cannot push to this Docker Hub namespace, so the scheduled rebuild stays with the source repository. | |
| if: github.repository == 'misiektoja/spotify_monitor' | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: docker | |
| url: https://hub.docker.com/r/misiektoja/spotify-secrets-grabber | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Resolve image tags | |
| id: resolve_tags | |
| shell: bash | |
| # Event and input values reach the script through the environment. Interpolating them directly into | |
| # run: would let a crafted input run shell commands in a job already holding the registry token | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| INPUT_TAG: ${{ github.event.inputs.tag }} | |
| INPUT_PUSH_LATEST: ${{ github.event.inputs.push_latest }} | |
| run: | | |
| set -euo pipefail | |
| base_tag="$INPUT_TAG" | |
| push_latest="true" | |
| if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| push_latest="$INPUT_PUSH_LATEST" | |
| fi | |
| if [[ -z "$base_tag" ]]; then | |
| # The extractor declares its own version in its docstring, which is what users see in the tool | |
| base_tag="$(grep -m1 -oE '^v[0-9]+\.[0-9]+(\.[0-9]+)?$' debug/spotify_monitor_secret_grabber.py | cut -c2-)" | |
| fi | |
| if [[ -z "$base_tag" ]]; then | |
| echo "Failed to resolve image tag from the extractor version" >&2 | |
| exit 1 | |
| fi | |
| # A tag becomes part of an image reference, so refuse anything outside the characters a tag may use | |
| if [[ ! "$base_tag" =~ ^[A-Za-z0-9._-]+$ ]]; then | |
| echo "Refusing unsafe image tag: $base_tag" >&2 | |
| exit 1 | |
| fi | |
| tags=("${IMAGE_NAME}:${base_tag}" "${IMAGE_NAME}:${GITHUB_SHA::7}") | |
| if [[ "$push_latest" == "true" ]]; then | |
| tags+=("${IMAGE_NAME}:latest") | |
| fi | |
| { | |
| echo "tags<<EOF" | |
| printf '%s\n' "${tags[@]}" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push multi-architecture image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: ./debug | |
| file: ./debug/spotify_monitor_secret_grabber_docker/Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.resolve_tags.outputs.tags }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |