fix(payments): track vendored Apple CA + harden voucher admin (review) #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: bridge-image | |
| # Build and publish the payments-bridge container to GHCR, and run its checks | |
| # on every PR that touches it. The bridge is OPERATOR infrastructure — it is | |
| # deployed by hand (docker pull + env file), never via a Flux app spec, | |
| # because it holds the treasury key and payment-provider secrets. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'bridge/**' | |
| - '.github/workflows/bridge-image.yml' | |
| tags: | |
| - 'bridge-v*' | |
| pull_request: | |
| paths: | |
| - 'bridge/**' | |
| - '.github/workflows/bridge-image.yml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| IMAGE: ghcr.io/runonflux/cumulusvpn-bridge | |
| jobs: | |
| checks: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: bridge | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - run: corepack enable | |
| - run: yarn install --immutable | |
| - run: yarn typecheck | |
| - run: yarn lint | |
| - run: yarn format:check | |
| - run: yarn test | |
| - run: yarn build | |
| image: | |
| needs: checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compute tags & labels | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=sha,prefix=sha- | |
| type=match,pattern=bridge-v(\d+\.\d+\.\d+),group=1 | |
| - name: Build and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: bridge | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} |