Build(deps): Bump rq from 2.10.0 to 2.11.0 in /server #46053
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| ######################### | |
| ######################### | |
| ## Deploy Docker Image ## | |
| ######################### | |
| ######################### | |
| # | |
| # Documentation: | |
| # https://help.github.com/en/articles/workflow-syntax-for-github-actions | |
| # | |
| ####################################### | |
| # Start the job on all push to main # | |
| ####################################### | |
| name: "Build & Deploy - DEV" | |
| on: | |
| push: | |
| branches-ignore: | |
| - main | |
| paths-ignore: | |
| - .github/CONTRIBUTING.md | |
| - CHANGELOG.md | |
| - README.md | |
| - .github/workflows/slash-command-dispatch.yml | |
| - .github/workflows/help-command.yml | |
| - .github/workflows/build-command.yml | |
| pull_request: | |
| ############### | |
| # Set the Job # | |
| ############### | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.ref_name }}-${{ github.workflow }} | |
| cancel-in-progress: true | |
| jobs: | |
| ################################################################## | |
| # Producer: build the image, populate GHA buildx cache (no push) # | |
| ################################################################## | |
| build: | |
| name: Build Docker Image - DEV | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # Push the built image to ghcr.io (same-repo branches only) | |
| packages: write | |
| # Prevent duplicate run from happening when a forked push is committed | |
| if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) && !contains(github.event.head_commit.message, 'skip deploy') | |
| timeout-minutes: 90 | |
| outputs: | |
| image-tag: ${{ steps.setup.outputs.image-tag }} | |
| image-version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| dockerfile: ${{ steps.setup.outputs.dockerfile }} | |
| cache-scope: ${{ steps.setup.outputs.cache-scope }} | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| is-quick: ${{ steps.setup.outputs.is-quick }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL # large cache | |
| sudo rm -rf /opt/hostedtoolcache/go # Go toolcache | |
| - name: Docker Metadata action | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| id: meta | |
| with: | |
| images: | | |
| ${{ github.repository }} | |
| - name: Select Dockerfile, cache scope, and build args | |
| id: setup | |
| shell: bash | |
| env: | |
| COMMIT_MSG: ${{ github.event.head_commit.message }} | |
| META_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| META_VERSION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| META_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| META_TAGS: ${{ steps.meta.outputs.tags }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| GH_REPOSITORY: ${{ github.repository }} | |
| GH_SHA: ${{ github.sha }} | |
| run: | | |
| # Image handoff to consumer jobs: | |
| # - push event (same-repo branch): push to ghcr.io and let consumers | |
| # docker pull (parallel layer download, no tarball load) | |
| # - pull_request event (forked PR: GITHUB_TOKEN cannot push packages): | |
| # export a tarball and hand it over as a workflow artifact | |
| if [[ "${EVENT_NAME}" == "push" ]]; then | |
| { | |
| echo "image-tag=ghcr.io/${GH_REPOSITORY}-dev:${GH_SHA}" | |
| echo "docker-outputs=type=image,push=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| else | |
| { | |
| echo "image-tag=${META_TAGS}" | |
| echo "docker-outputs=type=docker,dest=/tmp/megalinter-image.tar,compression=zstd,compression-level=3,force-compression=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| fi | |
| if [[ "${COMMIT_MSG}" == *"quick build"* ]]; then | |
| { | |
| echo "is-quick=true" | |
| echo "dockerfile=Dockerfile-quick" | |
| echo "cache-scope=dev-quick" | |
| echo "build-args<<EOF" | |
| echo "BUILD_DATE=${META_CREATED}" | |
| echo "BUILD_VERSION=${META_VERSION}" | |
| echo "BUILD_REVISION=${META_REVISION}" | |
| echo "MEGALINTER_BASE_IMAGE=ghcr.io/oxsecurity/megalinter:beta" | |
| echo "EOF" | |
| } >> "${GITHUB_OUTPUT}" | |
| else | |
| { | |
| echo "is-quick=false" | |
| echo "dockerfile=Dockerfile" | |
| echo "cache-scope=dev-main" | |
| echo "build-args<<EOF" | |
| echo "BUILD_DATE=${META_CREATED}" | |
| echo "BUILD_VERSION=${META_VERSION}" | |
| echo "BUILD_REVISION=${META_REVISION}" | |
| echo "EOF" | |
| } >> "${GITHUB_OUTPUT}" | |
| fi | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Build once and hand the image over to consumer jobs (see setup step: | |
| # ghcr.io push for same-repo branches, tarball artifact for forked PRs). | |
| # DEV is read-only on the layer cache: it consumes the warm caches | |
| # produced by the BETA workflow on main and never writes back. Writing | |
| # a fresh cache for a throwaway PR branch costs ~14 min of cache export | |
| # per build that nobody else reads, so we skip `cache-to` entirely here. | |
| - name: Build MegaLinter Docker Image | |
| id: docker_build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| continue-on-error: true | |
| with: | |
| context: . | |
| file: ${{ steps.setup.outputs.dockerfile }} | |
| platforms: linux/amd64 | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| secrets: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} | |
| tags: ${{ steps.setup.outputs.image-tag }} | |
| cache-from: type=gha,scope=beta-main,ignore-error=true | |
| outputs: ${{ steps.setup.outputs.docker-outputs }} | |
| timeout-minutes: 90 | |
| # Fallback: if the cached build above failed (e.g. GHA cache returned a | |
| # stale manifest pointing to an evicted blob — buildx surfaces this as | |
| # 'ERROR: blob sha256:...: not found'), rebuild from scratch with no | |
| # cache-from. Slower but never blocks on cache corruption. | |
| - name: Build MegaLinter Docker Image (no-cache fallback) | |
| if: steps.docker_build.outcome == 'failure' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| file: ${{ steps.setup.outputs.dockerfile }} | |
| platforms: linux/amd64 | |
| build-args: ${{ steps.setup.outputs.build-args }} | |
| secrets: | | |
| GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} | |
| tags: ${{ steps.setup.outputs.image-tag }} | |
| outputs: ${{ steps.setup.outputs.docker-outputs }} | |
| timeout-minutes: 90 | |
| - name: Upload image artifact | |
| if: github.event_name != 'push' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: megalinter-image | |
| path: /tmp/megalinter-image.tar | |
| retention-days: 1 | |
| if-no-files-found: error | |
| compression-level: 0 | |
| ############################################################### | |
| # Consumer: Run linter test cases against the cached image # | |
| ############################################################### | |
| test-cases: | |
| name: Run Test Cases - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Require writing security events to upload SARIF file to security tab | |
| security-events: write | |
| timeout-minutes: 120 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull Docker image from ghcr.io | |
| if: github.event_name == 'push' | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: | | |
| set -euo pipefail | |
| docker pull "${DOCKER_IMAGE}" | |
| docker image ls | |
| - name: Download image artifact (forked PR) | |
| if: github.event_name != 'push' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image (forked PR) | |
| if: github.event_name != 'push' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run Test Cases | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} | |
| GH_REPOSITORY: ${{ github.repository }} | |
| HEAD_REF: ${{ github.head_ref }} | |
| REF_NAME: ${{ github.ref_name }} | |
| COMMIT_MSG: ${{ github.event.head_commit.message }} | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| GH_SHA: ${{ github.sha }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| GITHUB_REPOSITORY=$([ "$EVENT_NAME" == "pull_request" ] && echo "$PR_HEAD_REPO" || echo "$GH_REPOSITORY") | |
| GITHUB_BRANCH=$([ "$EVENT_NAME" == "pull_request" ] && echo "$HEAD_REF" || echo "$REF_NAME") | |
| CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS" | |
| export CI_ENV | |
| TEST_KEYWORDS_TO_USE="" | |
| if [[ "${COMMIT_MSG}" == *"TEST_KEYWORDS="* ]]; then | |
| TEST_KEYWORDS_TO_USE=${COMMIT_MSG#*TEST_KEYWORDS=} | |
| echo "Run only tests with keywords ${TEST_KEYWORDS_TO_USE}" | |
| if [[ "${TEST_KEYWORDS_TO_USE}" =~ $'\r' ]]; then | |
| echo "Problem while parsing test keywords: switch back to all tests" | |
| TEST_KEYWORDS_TO_USE="" | |
| fi | |
| fi | |
| docker image ls | |
| # shellcheck disable=SC2086 | |
| docker run $CI_ENV -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER="${GH_SHA}" -e OUTPUT_DETAIL=detailed -e GITHUB_SHA="${GH_SHA}" -e GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" -e GITHUB_BRANCH="${GITHUB_BRANCH}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}" | |
| timeout-minutes: 120 | |
| - name: Archive production artifacts (test-cases) | |
| if: success() || failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: MegaLinter reports (test-cases) | |
| include-hidden-files: "true" | |
| path: | | |
| megalinter-reports | |
| mega-linter.log | |
| linter-helps.json | |
| linter-versions.json | |
| ############################################################### | |
| # Consumer: Run megalinter against the entire code base # | |
| ############################################################### | |
| run-all-code: | |
| name: Run against all code base - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| if: needs.build.outputs.is-quick != 'true' | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull Docker image from ghcr.io | |
| if: github.event_name == 'push' | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: | | |
| set -euo pipefail | |
| docker pull "${DOCKER_IMAGE}" | |
| docker image ls | |
| - name: Download image artifact (forked PR) | |
| if: github.event_name != 'push' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image (forked PR) | |
| if: github.event_name != 'push' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run against all code base | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| GH_REPOSITORY: ${{ github.repository }} | |
| GH_SHA: ${{ github.sha }} | |
| GH_TOKEN_VALUE: ${{ github.token }} | |
| GH_RUN_ID: ${{ github.run_id }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: docker run -e GITHUB_REPOSITORY="${GH_REPOSITORY}" -e GITHUB_SHA="${GH_SHA}" -e GITHUB_TOKEN="${GH_TOKEN_VALUE}" -e GITHUB_RUN_ID="${GH_RUN_ID}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}" | |
| timeout-minutes: 15 | |
| - name: Archive production artifacts (run-all-code) | |
| if: success() || failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: MegaLinter reports (run-all-code) | |
| include-hidden-files: "true" | |
| path: | | |
| megalinter-reports | |
| mega-linter.log | |
| linter-helps.json | |
| linter-versions.json | |
| ############################################################### | |
| # Consumer: mega-linter-runner tests against the cached image # | |
| ############################################################### | |
| runner-tests: | |
| name: mega-linter-runner tests - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| if: needs.build.outputs.is-quick != 'true' | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull Docker image from ghcr.io | |
| if: github.event_name == 'push' | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: | | |
| set -euo pipefail | |
| docker pull "${DOCKER_IMAGE}" | |
| docker image ls | |
| - name: Download image artifact (forked PR) | |
| if: github.event_name != 'push' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image (forked PR) | |
| if: github.event_name != 'push' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24.x" | |
| - name: Install NPM dependencies | |
| run: cd mega-linter-runner && yarn install --frozen-lockfile && npm link | |
| - name: Run mega-linter-runner tests | |
| env: | |
| MEGALINTER_RELEASE: ${{ needs.build.outputs.image-version }} | |
| MEGALINTER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: cd mega-linter-runner && MEGALINTER_RELEASE="${MEGALINTER_RELEASE}" MEGALINTER_IMAGE="${MEGALINTER_IMAGE}" MEGALINTER_NO_DOCKER_PULL=true npm run test | |
| ############################################################### | |
| # Consumer: Trivy vulnerability scan # | |
| ############################################################### | |
| trivy: | |
| name: Trivy scan - DEV | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| sudo rm -rf /opt/hostedtoolcache/CodeQL | |
| sudo rm -rf /opt/hostedtoolcache/go | |
| - name: Login to GitHub Container Registry | |
| if: github.event_name == 'push' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull Docker image from ghcr.io | |
| if: github.event_name == 'push' | |
| shell: bash | |
| env: | |
| DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }} | |
| run: | | |
| set -euo pipefail | |
| docker pull "${DOCKER_IMAGE}" | |
| docker image ls | |
| - name: Download image artifact (forked PR) | |
| if: github.event_name != 'push' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: megalinter-image | |
| path: /tmp | |
| - name: Load Docker image (forked PR) | |
| if: github.event_name != 'push' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| docker load -i /tmp/megalinter-image.tar | |
| rm -f /tmp/megalinter-image.tar | |
| docker image ls | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| # renovate: datasource=github-releases depName=aquasecurity/trivy | |
| version: "v0.74.0" | |
| image-ref: "${{ needs.build.outputs.image-tag }}" | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| scanners: vuln | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| timeout: 15m0s | |
| # - name: Run OSV-Scanner vulnerability scanner | |
| # uses: google/osv-scanner-action/osv-scanner-action@v2.3.5 | |
| # with: | |
| # scan-args: |- | |
| # --docker ${{ needs.build.outputs.image-tag }} |