[pull] main from serverless-dns:main

.github/workflows/cf.yml

@@ -1,5 +1,9 @@
 name: ⛅ CF
 on:
+  # github.com/serverless-dns/blocklists/blob/6021f80f/.github/workflows/createUploadBlocklistFilter.yml#L4-L6
+  # schedule:
+    # at 7:53 on 3rd, 10th, 18th, 26th of every month
+    # - cron: '53 7 3,10,18,26 * *'
   # docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   # docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows#workflow_dispatch
   # docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#onworkflow_dispatchinputs
@@ -48,6 +52,7 @@ on:
 
 env:
   GIT_REF: ${{ github.event.inputs.commit || github.ref }}
+  WRANGLER_VER: '3.56.0'
   # default is 'dev' which is really empty/no env
   WORKERS_ENV: ''
 
@@ -57,8 +62,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3.3.0
+      - name: 🛒 Checkout
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
           fetch-depth: 0
@@ -86,20 +91,33 @@ jobs:
           WENV: 'prod'
           COMMIT_SHA: ${{ github.sha }}
 
+      - name: 🌽 Cron?
+        if: github.event.schedule == '53 7 3,10,18,26 * *'
+        run: |
+          echo "WORKERS_ENV=${WENV}" >> $GITHUB_ENV
+          echo "COMMIT_SHA=${COMMIT_SHA}" >> $GITHUB_ENV
+        shell: bash
+        env:
+          # cron deploys always deploy to prod
+          WENV: 'prod'
+          COMMIT_SHA: ${{ github.sha }}
+
         # npm (and node16) are installed by wrangler-action in a pre-job setup
       - name: 🏗 Get dependencies
         run: npm i
 
       - name: 📚 Wrangler publish
         # github.com/cloudflare/wrangler-action
-        uses: cloudflare/wrangler-action@2.0.0
+        uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           # input overrides env-defaults, regardless
           environment: ${{ env.WORKERS_ENV }}
+          wranglerVersion: ${{ env.WRANGLER_VER }}
+          accountId: ${{ secrets.CF_ACCOUNT_ID }}
         env:
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
-          GIT_COMMIT_ID: ${{ env.GIT_REF }}
+          # setting CLOUDFLARE_ACCOUNT_ID no longer works
+          GIT_COMMIT_ID: ${{ env.COMMIT_SHA }}
 
       - name: 🎤 Notice
         run: |

.github/workflows/deno-deploy.yml

@@ -64,7 +64,7 @@ jobs:
       contents: read
     steps:
       - name: 🚚 Fetch code
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.git-ref || github.ref }}
           fetch-depth: 0
@@ -85,34 +85,36 @@ jobs:
           git reset
           git merge origin/${BUILD_BRANCH} || :
 
-      - name: 🦕 Install Deno @1.29
+      - name: 🦕 Install Deno@2.x
         uses: denoland/setup-deno@main
         with:
-          deno-version: 1.29.3
+          deno-version: 2.x
 
       - name: 📦 Bundle up
         if: ${{ env.DEPLOY_MODE == 'action' }}
         run: |
           echo "::notice::do not forget to set DENO_PROJECT_NAME via github secrets!"
           deno task prepare
-          deno bundle ${IN_FILE} ${OUT_FILE}
+          # todo: deno bundle ${IN_FILE} ${OUT_FILE}
         shell: bash
 
       # github.com/denoland/deployctl/blob/febd898/action.yml
       # step output: www.actionsbyexample.com/outputs.html
       - name: 🤸🏼 Deploy to deno.com
         id: dd
         if: ${{ env.DEPLOY_MODE == 'action' }}
-        uses: denoland/deployctl@1.4.0
+        uses: denoland/deployctl@v1
         with:
           project: ${{ env.PROJECT_NAME }}
-          entrypoint: ${{ env.OUT_FILE }}
+          # todo: if bundling, replace IN_FILE w/ OUT_FILE
+          entrypoint: ${{ env.IN_FILE }}
 
       - name: 🚢 Merge latest code into deploy-branch
         if: ${{ env.DEPLOY_MODE == 'auto' }}
         run: |
           git config --local user.name 'github-actions[bot]'
           git config --local user.email 'github-actions[bot]@users.noreply.github.com'
+          # todo: deno bundle has been deprecated
           git add ${OUT_FILE}
           git commit -m "Update bundle for ${GITHUB_SHA}" && \
             echo "::notice::Pushing to ${BUILD_BRANCH}" || \

.github/workflows/fly.yml

@@ -1,6 +1,10 @@
 name: 🪂 Fly
 
 on:
+  # github.com/serverless-dns/blocklists/blob/6021f80f/.github/workflows/createUploadBlocklistFilter.yml#L4-L6
+  schedule:
+    # at 7:53 on 2nd, 9th, 17th, 25th of every month
+    - cron: '53 7 2,9,17,25 * *'
   push:
     branches:
       - "main"
@@ -77,7 +81,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 🚚 Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
           fetch-depth: 0
@@ -121,6 +125,15 @@ jobs:
         env:
           COMMIT_SHA: ${{ github.sha }}
 
+      - name: 🚨🌽 Prod via cron?
+        if: github.event.schedule == '53 7 2,9,17,25 * *'
+        run: |
+          echo "FLY_APP=${FLY_PROD_APP}" >> $GITHUB_ENV
+          echo "::notice::Deploying PROD / ${GIT_REF} @ ${COMMIT_SHA}"
+        shell: bash
+        env:
+          COMMIT_SHA: ${{ github.sha }}
+
       - name: 🚜👨‍🚒 Onebox via dispatch?
         if: ${{ github.event_name == 'workflow_dispatch' &&
           github.event.inputs.deployment-type == 'onebox' }}

.github/workflows/ghcr.yml

@@ -0,0 +1,107 @@
+name: 🔄 runc
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  REGISTRY: "ghcr.io"
+  IMAGE_NAME: ${{ github.repository }}
+  IMAGE_NAME_BUN: ${{ github.repository }}-bun
+  GIT_REF: ${{ github.event.inputs.git-ref || github.ref }}
+
+# docs.github.com/en/actions/publishing-packages/publishing-docker-images
+jobs:
+  nodejs:
+    name: 🚀 Node on Alpine
+    runs-on: ubuntu-latest
+    permissions:
+        contents: read
+        packages: write
+        attestations: write
+        id-token: write
+
+    steps:
+      - name: 🚚 Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.GIT_REF }}
+          fetch-depth: 0
+
+      - name: 🔐 Login
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 🏷️ Metadata
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: 🛠 Build 
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          file: ./node.Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: 📕 Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
+  bunjs:
+    name: 🚀 Bun on Alpine
+    runs-on: ubuntu-latest
+    permissions:
+        contents: read
+        packages: write
+        attestations: write
+        id-token: write
+
+    steps:
+      - name: 🚚 Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.GIT_REF }}
+          fetch-depth: 0
+
+      - name: 🔐 Login
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 🏷️ Metadata
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_BUN }}
+
+      - name: 🛠 Build
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          file: ./bun.Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: 📕 Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_BUN }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/pr.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 🚚 Get latest code
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4
         with:
           # Checkout base (target) repo
           ref: ${{ env.GH_REF }}
@@ -89,7 +89,9 @@ jobs:
       - name: 🚢 Push to origin?
         if: ${{ env.BASE_REPO == env.PR_HEAD_REPO }}
         run: |
-          git push origin HEAD:${{ env.PR_HEAD_REF }}
+          git push origin HEAD:$PR_REF
+        env:
+          PR_REF: ${{ env.PR_HEAD_REF }}
 
       # `GITHUB_TOKEN` owned by `github-actions[bot]` has write access to
       # origin in this `PR-target` workflow but not the write access to fork
@@ -99,5 +101,9 @@ jobs:
       - name: 🚢 Push to fork?
         if: ${{ env.BASE_REPO != env.PR_HEAD_REPO }}
         run: |
-          git remote add fork ${{ env.PR_HEAD_REPO }}
-          git push fork HEAD:${{ env.PR_HEAD_REF }}
+          git remote add fork $PR_REPO
+          git push fork HEAD:$PR_REF
+        env:
+          # ref: docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          PR_REF: ${{ env.PR_HEAD_REF }}
+          PR_REPO: ${{ env.PR_HEAD_REPO }}

.github/workflows/profiler.yml

@@ -15,13 +15,14 @@ on:
         default: 'main'
       # docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatchinputs
       js-runtime:
-        description: "proc: deno/node"
+        description: "proc: deno/node/bun"
         required: false
         default: 'node'
         type: choice
         options:
         - node
         - deno
+        - bun
       mode:
         description: "p1 (fetch) / p2 (http2) / p3 (udp/tcp)"
         required: false
@@ -40,8 +41,9 @@ env:
   GIT_REF: ${{ github.event.inputs.git-ref || github.ref }}
   JS_RUNTIME: 'node'
   MAXTIME_SEC: '30s'
-  NODE_VER: '19.x'
-  DENO_VER: '1.29.3'
+  NODE_VER: '22.x'
+  DENO_VER: '2.x'
+  BUN_VER: '1.x'
   MODE: 'p1'
   QDOH: 'q'
 
@@ -52,7 +54,7 @@ jobs:
 
     steps:
       - name: 🍌 Checkout
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@v4
         with:
           ref: ${{ env.GIT_REF }}
           fetch-depth: 0
@@ -66,9 +68,9 @@ jobs:
           JSR: ${{ github.event.inputs.js-runtime || env.JS_RUNTIME }}
 
       # docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs-or-python
-      - name: 🐎 Setup Node @v19
+      - name: 🐎 Setup Node @v22
         if: env.JS_RUNTIME == 'node'
-        uses: actions/setup-node@v3.6.0
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VER }}
 
@@ -80,7 +82,7 @@ jobs:
           npm run build --if-present
 
       # deno.com/blog/deploy-static-files#example-a-statically-generated-site
-      - name: 🦕 Setup Deno @1.29.3
+      - name: 🦕 Setup Deno @2.x
         if: env.JS_RUNTIME == 'deno'
         uses: denoland/setup-deno@main
         with:
@@ -89,8 +91,22 @@ jobs:
       - name: 🥝 Deno deps
         if: env.JS_RUNTIME == 'deno'
         run: |
+          deno task prepare
           deno cache ./src/server-deno.ts
 
+      # bun.sh/docs/cli/install#ci-cd
+      - name: 🐇 Setup Bun @ latest
+        if: env.JS_RUNTIME == 'bun'
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      # github.com/oven-sh/setup-bun
+      - name: 🥕 Bun deps
+        if: env.JS_RUNTIME == 'bun'
+        run: |
+          bun i
+
       # if non-interactive, prefer apt-get: unix.stackexchange.com/a/590703
       # github.com/natesales/repo
       # docs.github.com/en/actions/using-github-hosted-runners/customizing-github-hosted-runners#installing-software-on-ubuntu-runners