fix(install): close the four fresh-install-audit findings #321
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Fresh-install smoke test — proves a from-scratch `docker compose up` boots a | |
| # healthy Crumb stack and the first-run flow works (the exact path a new user | |
| # follows). Kept OUT of ci.yml because it builds both Rust images from source and | |
| # boots the full 6-service stack (~10 min), which shouldn't tax every push. | |
| # | |
| # Runs: nightly, on manual dispatch, on pushes to main, AND on pull requests | |
| # that touch the install surface (compose / migrations / services / setup | |
| # script). The PR trigger was added after #249: a compose+config change merged | |
| # green through ci.yml and crash-looped the api on every fresh install; this | |
| # smoke caught it, but only post-merge where nobody was watching. ~10 min on | |
| # the few PRs that touch these paths is the right price for gating that class. | |
| # (The path lists are duplicated because GitHub Actions does not support YAML | |
| # anchors; keep them in sync.) | |
| name: fresh-install-smoke | |
| on: | |
| schedule: | |
| - cron: "0 10 * * *" # ~02:00–03:00 America/Los_Angeles (GitHub cron is UTC) | |
| workflow_dispatch: {} | |
| push: | |
| branches: [main] | |
| paths: | |
| - "docker-compose*.yml" | |
| - "db/migrations/**" | |
| - "services/**" | |
| - "scripts/setup-env.sh" | |
| - "scripts/test/fresh-install-smoke.sh" | |
| - "scripts/test/smoke-testsrc-go2rtc.yaml" | |
| - "caddy/**" | |
| - "go2rtc/**" | |
| - "mosquitto/**" | |
| - "VERSION" | |
| pull_request: | |
| paths: | |
| - "docker-compose*.yml" | |
| - "db/migrations/**" | |
| - "services/**" | |
| - "scripts/setup-env.sh" | |
| - "scripts/test/fresh-install-smoke.sh" | |
| - "scripts/test/smoke-testsrc-go2rtc.yaml" | |
| - "caddy/**" | |
| - "go2rtc/**" | |
| - "mosquitto/**" | |
| - "VERSION" | |
| # One smoke run per ref at a time; newer pushes cancel older in-flight builds. | |
| concurrency: | |
| group: smoke-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| smoke: | |
| name: fresh-install (docker compose up from scratch) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Buildx gives a persistent gha layer cache so the Rust image build is only | |
| # cold on the first run. | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Fresh-install smoke test | |
| run: bash scripts/test/fresh-install-smoke.sh |