chore(frontend): pin obol-frontend to v0.1.28-rc5 #179
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Publish x402 Images | |
| # Publishes stack-owned pure-Go images via docker bake (Dockerfile.x402): | |
| # one shared builder stage, native cross-compile (no QEMU), shared GHA cache. | |
| # Tags: short SHA (images.Resolve), long SHA (Trivy), latest on main. | |
| # Release gate: .github/scripts/verify-release-images.sh | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - 'v*' | |
| paths: | |
| - 'internal/agentruntime/**' | |
| - 'internal/config/**' | |
| - 'internal/defaults/**' | |
| - 'internal/dns/**' | |
| - 'internal/embed/**' | |
| - 'internal/enclave/**' | |
| - 'internal/erc8004/**' | |
| - 'internal/helmcmd/**' | |
| - 'internal/images/**' | |
| - 'internal/inference/**' | |
| - 'internal/jobbroker/**' | |
| - 'internal/kubectl/**' | |
| - 'internal/model/**' | |
| - 'internal/monetizeapi/**' | |
| - 'internal/openclaw/**' | |
| - 'internal/schemas/**' | |
| - 'internal/serviceoffercontroller/**' | |
| - 'internal/tee/**' | |
| - 'internal/tunnel/**' | |
| - 'internal/ui/**' | |
| - 'internal/version/**' | |
| - 'internal/walletbackup/**' | |
| - 'internal/x402/**' | |
| - 'internal/demo/**' | |
| - 'cmd/x402-verifier/**' | |
| - 'cmd/x402-buyer/**' | |
| - 'cmd/serviceoffer-controller/**' | |
| - 'cmd/demo-server/**' | |
| - 'cmd/job-broker/**' | |
| - 'Dockerfile.x402' | |
| - 'Dockerfile.x402-*' | |
| - 'Dockerfile.serviceoffer-controller' | |
| - 'Dockerfile.demo-server' | |
| - 'Dockerfile.job-broker' | |
| - 'docker-bake.hcl' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - '.dockerignore' | |
| - '.github/workflows/docker-publish-x402.yml' | |
| - '.github/scripts/lib-ghcr.sh' | |
| - '.github/scripts/verify-release-images.sh' | |
| workflow_dispatch: | |
| concurrency: | |
| group: x402-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # One bake job builds all five images for amd64+arm64. Pure-Go cross-compile | |
| # from BUILDPLATFORM means we do NOT need QEMU (the old multi-arch tax). | |
| # --------------------------------------------------------------------------- | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| short_sha: ${{ steps.sha.outputs.short }} | |
| long_sha: ${{ steps.sha.outputs.long }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Resolve SHAs | |
| id: sha | |
| run: | | |
| { | |
| echo "long=$(git rev-parse HEAD)" | |
| echo "short=$(git rev-parse --short=7 HEAD)" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| # No QEMU: Dockerfile.x402 uses FROM --platform=$BUILDPLATFORM and | |
| # GOARCH=$TARGETARCH. Emulation was the dominant cost (~15–25m/job). | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Bake and push all x402 images | |
| uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0 | |
| with: | |
| files: docker-bake.hcl | |
| push: true | |
| provenance: true | |
| sbom: true | |
| vars: | | |
| REGISTRY=ghcr.io/obolnetwork | |
| SHA_SHORT=${{ steps.sha.outputs.short }} | |
| SHA_LONG=${{ steps.sha.outputs.long }} | |
| PUSH_LATEST=${{ github.ref == 'refs/heads/main' }} | |
| # --------------------------------------------------------------------------- | |
| # Trivy still fans out; scans are cheap vs the old multi-arch QEMU builds. | |
| # --------------------------------------------------------------------------- | |
| security-scan: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: | |
| - obolnetwork/x402-verifier | |
| - obolnetwork/x402-buyer | |
| - obolnetwork/serviceoffer-controller | |
| - obolnetwork/demo-server | |
| - obolnetwork/job-broker | |
| steps: | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ matrix.image }}:${{ needs.build.outputs.long_sha }} | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| if: always() |