Skip to content

test(smoke): poll the control socket for the certificate check #3

test(smoke): poll the control socket for the certificate check

test(smoke): poll the control socket for the certificate check #3

Workflow file for this run

name: ci
on:
push:
branches: [main, develop]
pull_request:
workflow_dispatch:
# Minimal token: nothing here writes to the repo.
permissions:
contents: read
# Bound runner usage: a newer push/PR update cancels the still-running one.
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: hadolint
uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
with:
dockerfile: Dockerfile
- name: shellcheck
run: shellcheck rootfs/*.sh test/*.sh
- name: typos
uses: crate-ci/typos@685eb3d55be2f85191e8c84acb9f44d7756f84ab # v1.29.4
build-test:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
php: ["8.3", "8.4", "8.5"]
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
# Builds php<ver> and runs the end-to-end smoke test against it.
- name: build + smoke test
run: make test DEFAULT_PHP=${{ matrix.php }}
# Report-only CVE scan, reusing the image just built on the 8.4 leg (the
# base layers are shared, so one representative variant suffices) instead
# of a separate job that rebuilds from scratch. Base-image / sury CVEs are
# outside this repo's control, so a finding informs rather than blocks;
# tighten to exit-code 1 if desired.
- name: trivy image scan
if: matrix.php == '8.4'
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: freeunit-php:trixie-php8.4
severity: HIGH,CRITICAL
exit-code: "0"
format: table