docs(examples): sync drupal example image tag with pinned base #25

Workflow file for this run

	name: ci

	on:
	push:
	branches: [main, develop]
	pull_request:
	workflow_dispatch:

	# Minimal token: nothing here writes to the repo.
	permissions:
	contents: read

	# Bound runner usage: a newer push/PR update cancels the still-running one.
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	# Every job carries a timeout-minutes cap: a hung step (network fetch, docker
	# build, scan) would otherwise hold the runner for GitHub's 6-hour default.
	lint:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: hadolint
	uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
	with:
	dockerfile: Dockerfile

	# Pin shellcheck to the version used locally so CI mirrors `make lint`.
	# The runner's bundled shellcheck is older and emits false positives that
	# current releases correctly suppress: SC2120/SC2119 on the library's
	# optional-argument functions (called with args only from child hooks
	# shellcheck cannot see) and SC2317 on trap/dispatch-invoked functions.
	# Fetch the official static binary and verify its SHA256, mirroring how the
	# Dockerfile fetches and checks its release assets.
	- name: shellcheck
	env:
	SHELLCHECK_VERSION: v0.11.0
	SHELLCHECK_SHA256: 8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
	run: \|
	set -euo pipefail
	tarball="shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
	curl -fsSL -o "$tarball" \
	"https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/${tarball}"
	echo "${SHELLCHECK_SHA256} ${tarball}" \| sha256sum -c -
	tar -xJf "$tarball"
	"shellcheck-${SHELLCHECK_VERSION}/shellcheck" --version
	"shellcheck-${SHELLCHECK_VERSION}/shellcheck" rootfs/docker-entrypoint-hook.d/.sh test/.sh

	- name: typos
	uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0

	- name: actionlint
	uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0

	# zizmor (workflow security audit) and rumdl (markdown) both ship on PyPI;
	# install them with pipx (preinstalled on the runner) at the same versions
	# used locally so CI mirrors `make lint`. GH_TOKEN lets zizmor run its
	# online audits (known-vulnerable action checks).
	- name: zizmor (workflow security)
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	pipx install zizmor==1.25.2
	zizmor .github/workflows

	- name: rumdl (markdown)
	run: \|
	pipx install rumdl==0.2.9
	rumdl check .

	# Single source of truth for the build matrix: the Makefile's PHP_VERSIONS
	# (and the Dockerfile's PHP_VER default, via the Makefile). Every workflow
	# matrix reads this job's outputs instead of hardcoding the version list, so
	# adding/removing a PHP line is one Makefile edit and cannot drift.
	php-matrix:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	outputs:
	php: ${{ steps.read.outputs.php }}
	default-php: ${{ steps.read.outputs.default-php }}
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: read the php matrix from the Makefile
	id: read
	run: \|
	set -euo pipefail
	{
	echo "php=$(make print-php-matrix)"
	echo "default-php=$(make print-default-php)"
	} >> "$GITHUB_OUTPUT"

	build-test:
	needs: php-matrix
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	contents: read # checkout
	security-events: write # upload the trivy SARIF to code scanning
	strategy:
	fail-fast: false
	matrix:
	php: ${{ fromJSON(needs.php-matrix.outputs.php) }}
	env:
	PHP: ${{ matrix.php }}
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: set up buildx
	uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

	# Builds php<ver> and runs the end-to-end smoke test against it. The
	# Makefile forwards DOCKER_BUILD_EXTRA to `docker build`, so wire buildx's
	# GitHub Actions layer cache here: --load drops the built image into the
	# local daemon (the smoke test and trivy run `docker run`/scan against it),
	# and a per-PHP cache scope keeps the matrix legs from clobbering each
	# other's apt/download layers across runs.
	- name: build + smoke test
	env:
	DOCKER_BUILD_EXTRA: >-
	--load
	--cache-from type=gha,scope=php${{ matrix.php }}
	--cache-to type=gha,mode=max,scope=php${{ matrix.php }}
	run: make test DEFAULT_PHP="$PHP"

	# Report-only CVE scan, reusing the image just built on the default-PHP
	# leg (the base layers are shared, so one representative variant
	# suffices) instead of a separate job that rebuilds from scratch. Emit
	# SARIF and upload it to code scanning so findings land in the Security
	# tab and are tracked over time, instead of scrolling past in the build
	# log. Base-image / sury CVEs are outside this repo's control, so a
	# finding informs (exit-code 0) rather than blocks; tighten to exit-code
	# 1 if desired.
	# Derive the scanned ref from the same source `make test` tags from (the
	# Dockerfile's BASE_TAG ARG), so pinning BASE_TAG doesn't leave trivy
	# scanning a stale/non-existent freeunit-drupal:trixie-php8.4.
	- name: derive built image ref
	if: matrix.php == needs.php-matrix.outputs.default-php
	run: \|
	set -euo pipefail
	base_tag=$(sed -n 's/^ARG BASE_TAG=$[^[:space:]]$./\1/p' Dockerfile)
	: "${base_tag:?could not read ARG BASE_TAG from Dockerfile}"
	echo "SCAN_IMAGE_REF=freeunit-drupal:${base_tag}-php${PHP}" >> "$GITHUB_ENV"

	- name: trivy image scan + SARIF upload
	if: matrix.php == needs.php-matrix.outputs.default-php
	uses: ./.github/actions/trivy-sarif
	with:
	image-ref: ${{ env.SCAN_IMAGE_REF }}
	category: trivy-image

Navigation Menu

docs(examples): sync drupal example image tag with pinned base #25

Workflow file

docs(examples): sync drupal example image tag with pinned base #25

Uh oh!

Workflow file for this run