fix: security and quality audit — 21 findings addressed #718
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Builder | |
| env: | |
| BUILD_ARGS: "--test" | |
| MONITORED_FILES: "build.yaml config.yaml Dockerfile rootfs" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| init: | |
| runs-on: ubuntu-latest | |
| name: Initialize builds | |
| permissions: | |
| contents: read | |
| outputs: | |
| changed_addons: ${{ steps.changed_addons.outputs.addons }} | |
| changed: ${{ steps.changed_addons.outputs.changed }} | |
| steps: | |
| - name: Check out the repository | |
| uses: actions/checkout@v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Get changed files | |
| id: changed_files | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BASE_REF: ${{ github.base_ref }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| CURRENT_SHA: ${{ github.sha }} | |
| run: | | |
| if [[ "$EVENT_NAME" == "pull_request" ]]; then | |
| FILES=$(git diff --name-only "origin/${BASE_REF}...HEAD" | tr '\n' ' ') | |
| else | |
| FILES=$(git diff --name-only "$BEFORE_SHA" "$CURRENT_SHA" | tr '\n' ' ') | |
| fi | |
| echo "all=${FILES}" >> "$GITHUB_OUTPUT" | |
| - name: Find add-on directories | |
| id: addons | |
| uses: home-assistant/actions/helpers/find-addons@master | |
| - name: Get changed add-ons | |
| id: changed_addons | |
| env: | |
| ALL_CHANGED: ${{ steps.changed_files.outputs.all }} | |
| ALL_ADDONS: ${{ steps.addons.outputs.addons }} | |
| run: | | |
| declare -a changed_addons | |
| for addon in $ALL_ADDONS; do | |
| if [[ "$ALL_CHANGED" =~ $addon ]]; then | |
| for file in ${{ env.MONITORED_FILES }}; do | |
| if [[ "$ALL_CHANGED" =~ $addon/$file ]]; then | |
| if [[ ! "${changed_addons[@]}" =~ $addon ]]; then | |
| changed_addons+=("\"${addon}\","); | |
| fi | |
| fi | |
| done | |
| fi | |
| done | |
| changed=$(echo ${changed_addons[@]} | rev | cut -c 2- | rev) | |
| if [[ -n ${changed} ]]; then | |
| echo "Changed add-ons: $changed"; | |
| echo "changed=true" >> $GITHUB_OUTPUT; | |
| echo "addons=[$changed]" >> $GITHUB_OUTPUT; | |
| else | |
| echo "No add-on had any monitored files changed (${{ env.MONITORED_FILES }})"; | |
| fi | |
| build: | |
| needs: init | |
| runs-on: ubuntu-latest | |
| if: needs.init.outputs.changed == 'true' | |
| name: Build ${{ matrix.arch }} ${{ matrix.addon }} add-on | |
| strategy: | |
| matrix: | |
| addon: ${{ fromJson(needs.init.outputs.changed_addons) }} | |
| arch: ["aarch64", "amd64"] | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7.0.0 | |
| - name: Get information | |
| id: info | |
| uses: home-assistant/actions/helpers/info@master | |
| with: | |
| path: "./${{ matrix.addon }}" | |
| - name: Check if add-on should be built | |
| id: check | |
| env: | |
| INFO_IMAGE: ${{ steps.info.outputs.image }} | |
| INFO_ARCHITECTURES: ${{ steps.info.outputs.architectures }} | |
| BUILD_ARCH: ${{ matrix.arch }} | |
| BUILD_ADDON: ${{ matrix.addon }} | |
| HEAD_REF: ${{ github.head_ref }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| if [[ "$INFO_IMAGE" == "null" ]]; then | |
| echo "Image property is not defined, skipping build" | |
| echo "build_arch=false" >> $GITHUB_OUTPUT; | |
| elif [[ "$INFO_ARCHITECTURES" =~ $BUILD_ARCH ]]; then | |
| echo "build_arch=true" >> $GITHUB_OUTPUT; | |
| echo "image=$(echo "$INFO_IMAGE" | cut -d'/' -f3)" >> $GITHUB_OUTPUT; | |
| if [[ -z "$HEAD_REF" ]] && [[ "$EVENT_NAME" == "push" ]]; then | |
| echo "BUILD_ARGS=" >> $GITHUB_ENV; | |
| fi | |
| else | |
| echo "$BUILD_ARCH is not a valid arch for $BUILD_ADDON, skipping build"; | |
| echo "build_arch=false" >> $GITHUB_OUTPUT; | |
| fi | |
| - name: Login to GitHub Container Registry | |
| if: env.BUILD_ARGS != '--test' | |
| uses: docker/login-action@v4.4.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build ${{ matrix.addon }} add-on | |
| if: steps.check.outputs.build_arch == 'true' | |
| uses: home-assistant/builder@2026.03.2 | |
| with: | |
| args: | | |
| ${{ env.BUILD_ARGS }} \ | |
| --${{ matrix.arch }} \ | |
| --target /data/${{ matrix.addon }} \ | |
| --image "${{ steps.check.outputs.image }}" \ | |
| --docker-hub "ghcr.io/${{ github.repository_owner }}" \ | |
| --addon |