fix: upgrade libcap2 libsystemd0 libudev1 — CVE fixes #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Deploy Garnet | |
| on: | |
| workflow_dispatch: | |
| push: | |
| tags: | |
| - v* | |
| branches: | |
| - deploy/staging | |
| - deploy/prod | |
| - garnet-privacy-proxy | |
| paths: | |
| - 'backend/privacy_proxy/**' | |
| - 'src/**' | |
| - 'backend/open_webui/**' | |
| - 'Dockerfile' | |
| - 'docker-compose.yml' | |
| - 'version/VERSION' | |
| - '.github/workflows/**' | |
| jobs: | |
| get-meta: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.get_version.outputs.version }} | |
| tag: ${{ steps.get_tag.outputs.name }} | |
| proxy_changed: ${{ steps.changes.outputs.proxy }} | |
| webui_changed: ${{ steps.changes.outputs.webui }} | |
| steps: | |
| - name: Checkout | |
| run: | | |
| git clone --branch ${{ github.ref_name }} \ | |
| https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git . | |
| - name: Get version | |
| id: get_version | |
| run: | | |
| if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then | |
| echo "version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT | |
| else | |
| echo "version=$(cat version/VERSION).nightly" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Get tag | |
| id: get_tag | |
| run: | | |
| case "${GITHUB_REF}" in | |
| refs/heads/deploy/staging) NAME=staging ;; | |
| refs/heads/deploy/prod) NAME=prod ;; | |
| refs/tags/v*) NAME=latest ;; | |
| *) NAME=dev ;; | |
| esac | |
| echo "name=${NAME}" >> $GITHUB_OUTPUT | |
| - name: Check changed files | |
| id: changes | |
| run: | | |
| git diff --name-only HEAD~1 HEAD | grep '^backend/privacy_proxy/' \ | |
| && echo "proxy=true" >> $GITHUB_OUTPUT \ | |
| || echo "proxy=false" >> $GITHUB_OUTPUT | |
| git diff --name-only HEAD~1 HEAD | grep -E '^src/|^backend/open_webui/' \ | |
| && echo "webui=true" >> $GITHUB_OUTPUT \ | |
| || echo "webui=false" >> $GITHUB_OUTPUT | |
| # ── PROXY ───────────────────────────────────────────── | |
| build-proxy: | |
| needs: get-meta | |
| if: needs.get-meta.outputs.proxy_changed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| run: | | |
| git clone --branch ${{ github.ref_name }} \ | |
| https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git . | |
| - name: Free disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache | |
| df -h | |
| - name: Login to Harbor | |
| run: | | |
| echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \ | |
| -u "${{ secrets.HARBOR_USERNAME }}" --password-stdin | |
| - name: Build proxy image | |
| run: | | |
| docker build --no-cache \ | |
| -f backend/privacy_proxy/Dockerfile \ | |
| --build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }} \ | |
| backend/privacy_proxy/ | |
| - name: Scan proxy image | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ | |
| | sh -s -- -b /usr/local/bin | |
| trivy image \ | |
| --exit-code 1 \ | |
| --severity CRITICAL,HIGH \ | |
| --ignore-unfixed \ | |
| --scanners vuln \ | |
| harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }} | |
| - name: Push proxy image | |
| run: | | |
| docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }} | |
| docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }} | |
| docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }} | |
| deploy-proxy: | |
| needs: [get-meta, build-proxy] | |
| if: needs.get-meta.outputs.proxy_changed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Deploy proxy to cVM | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa | |
| chmod 600 ~/.ssh/id_rsa | |
| ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts | |
| ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \ | |
| echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \ | |
| -u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \ | |
| docker compose pull privacy-proxy && \ | |
| docker compose up -d --force-recreate privacy-proxy" | |
| - name: Health check proxy | |
| run: | | |
| sleep 10 | |
| ssh root@${{ secrets.CVM_HOST }} "\ | |
| docker exec garnet-privacy-proxy-1 python3 -c \ | |
| 'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/health\").read())'" | |
| - name: Run proxy tests | |
| run: | | |
| ssh root@${{ secrets.CVM_HOST }} "\ | |
| docker exec -w /service garnet-privacy-proxy-1 python3 app/test_proxy.py" | |
| # ── WEBUI ───────────────────────────────────────────── | |
| build-webui: | |
| needs: get-meta | |
| if: needs.get-meta.outputs.webui_changed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| run: | | |
| git clone --branch ${{ github.ref_name }} \ | |
| https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git . | |
| - name: Free disk space | |
| run: | | |
| sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache | |
| df -h | |
| - name: Login to Harbor | |
| run: | | |
| echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \ | |
| -u "${{ secrets.HARBOR_USERNAME }}" --password-stdin | |
| - name: Build webui image | |
| run: | | |
| docker build --no-cache \ | |
| --build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }} \ | |
| -t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }} \ | |
| . | |
| - name: Scan webui image | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ | |
| | sh -s -- -b /usr/local/bin | |
| trivy image \ | |
| --exit-code 1 \ | |
| --severity CRITICAL,HIGH \ | |
| --ignore-unfixed \ | |
| --scanners vuln \ | |
| harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }} | |
| - name: Push webui image | |
| run: | | |
| docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }} | |
| docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }} | |
| docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }} | |
| deploy-webui: | |
| needs: [get-meta, build-webui] | |
| if: needs.get-meta.outputs.webui_changed == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Deploy webui to cVM | |
| run: | | |
| mkdir -p ~/.ssh | |
| echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa | |
| chmod 600 ~/.ssh/id_rsa | |
| ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts | |
| ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \ | |
| echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \ | |
| -u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \ | |
| docker compose pull open-webui && \ | |
| docker compose up -d --force-recreate open-webui" | |
| - name: Health check webui | |
| run: | | |
| sleep 15 | |
| ssh root@${{ secrets.CVM_HOST }} "\ | |
| docker exec garnet-open-webui-1 python3 -c \ | |
| 'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/\").read()[:50])'" |