ci: Bump actions/upload-artifact from 5.0.0 to 7.0.1 #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MIT | |
| # Copyright (c) 2026 Netresearch DTT GmbH | |
| # | |
| # Static checks for the glpi-docker-compose-stack repo. | |
| # | |
| # Splits into: | |
| # - container-lint → delegates Dockerfile (hadolint) + shellcheck on shipped | |
| # scripts to netresearch/.github's reusable | |
| # lint-container.yml on @main. Reusable pins hadolint to | |
| # v2.14.0, which handles Docker 25's HEALTHCHECK | |
| # --start-interval correctly. (Earlier v2.12.0 pin was a | |
| # bug — see netresearch/.github#141 + a4a763e.) | |
| # - compose-validate → stays inline. Validates docker compose config with | |
| # repo-specific .env.example placeholder substitution | |
| # (caller-specific shape that doesn't generalise). | |
| # - overlay-hardening → stays inline. Calls tests/lint/hardening-check.sh | |
| # to enforce security_opt:[no-new-privileges:true] + | |
| # cap_drop:[ALL] on every long-running service that | |
| # an examples/compose.*.yml overlay introduces. | |
| # Background: an overlay can ship a service without | |
| # hardening because compose anchors do not survive | |
| # across separate overlay files — this gate catches it. | |
| # - yamllint → stays inline. The repo has no .yamllint.yml config | |
| # file; rules are passed via config_data here to keep | |
| # the contract local. | |
| # - bats → regression suite for bin/env-set.sh + | |
| # bin/compose-file.sh under tests/bin/. Uses | |
| # bats-core/bats-action to install bats + bats-support | |
| # + bats-assert on the runner; failures block PRs. | |
| name: lint | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| container-lint: | |
| # hadolint (always) + shellcheck (because shell-scandirs is set). | |
| uses: netresearch/.github/.github/workflows/lint-container.yml@main | |
| permissions: | |
| contents: read | |
| with: | |
| shell-scandirs: ./rootfs/usr/local/bin ./bin | |
| compose-validate: | |
| name: docker compose config | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Validate compose.yml | |
| run: | | |
| cp .env.example .env | |
| # supply just-good-enough placeholders so validation passes | |
| # (GLPI's only .env secrets are the DB passwords; its crypt key is | |
| # minted on first boot inside the glpi-config volume) | |
| sed -i \ | |
| -e 's/^GLPI_DB_PASSWORD=$/GLPI_DB_PASSWORD=ci-placeholder/' \ | |
| -e 's/^DB_ROOT_PASSWORD=$/DB_ROOT_PASSWORD=ci-placeholder/' \ | |
| .env | |
| docker compose config --quiet | |
| docker compose -f compose.yml config --quiet | |
| overlay-hardening: | |
| name: overlay hardening | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install yq (mikefarah) | |
| # The ubuntu-latest runner already has docker compose v2; some images | |
| # also ship a yq, but version + flavour (mikefarah vs kislyuk) vary. | |
| # Pin a specific mikefarah release for reproducibility — the script | |
| # only uses portable v4 syntax (// fallback, @tsv, map/any). | |
| run: | | |
| set -eu | |
| YQ_VERSION=v4.53.2 | |
| # SHA256 of yq_linux_amd64 v4.53.2 (verified manually 2026-05-25 | |
| # via sha256sum on the published binary; mikefarah/yq's published | |
| # `checksums` file mixes algorithms in a single column so we can't | |
| # parse it programmatically here). | |
| YQ_SHA256=d56bf5c6819e8e696340c312bd70f849dc1678a7cda9c2ad63eebd906371d56b | |
| tmp=$(mktemp) | |
| curl -fsSL \ | |
| "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \ | |
| -o "$tmp" | |
| actual=$(sha256sum "$tmp" | awk '{print $1}') | |
| if [ "$actual" != "$YQ_SHA256" ]; then | |
| echo "yq checksum mismatch: expected $YQ_SHA256, got $actual" >&2 | |
| exit 1 | |
| fi | |
| sudo install -m 0755 "$tmp" /usr/local/bin/yq | |
| rm -f "$tmp" | |
| yq --version | |
| - name: Check overlay hardening | |
| run: ./tests/lint/hardening-check.sh | |
| yamllint: | |
| name: yamllint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3 | |
| with: | |
| file_or_dir: .github/workflows .hadolint.yaml compose.yml compose.override.yml.example examples/ | |
| config_data: | | |
| extends: default | |
| rules: | |
| line-length: disable | |
| document-start: disable | |
| truthy: | |
| check-keys: false | |
| comments: | |
| min-spaces-from-content: 1 | |
| bats: | |
| name: bats tests/bin | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # Installs bats, bats-support, bats-assert under /usr/lib/bats-*. | |
| # tests/bin/test_helper.bash sources support+assert from that path. | |
| - uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # v4.0.0 | |
| with: | |
| # detik + file are kubernetes/filesystem helpers we don't use. | |
| detik-install: false | |
| file-install: false | |
| - name: Run regression suite | |
| run: bats tests/bin/ |