chore!: consume graycode-router instead of eyrie #242
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Daemon image | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "Dockerfile.daemon" | |
| - "packaging/systemd/graycode-daemon.service" | |
| - "internal/**" | |
| - "cmd/**" | |
| - "go.mod" | |
| - "go.sum" | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: graycodeai/graycode-daemon | |
| jobs: | |
| build: | |
| name: build + scan + publish (daemon) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build daemon image for scan | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: . | |
| file: Dockerfile.daemon | |
| platforms: linux/amd64 | |
| push: false | |
| load: true | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan | |
| cache-from: type=gha,scope=graycode-daemon | |
| cache-to: type=gha,mode=max,scope=graycode-daemon | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| BUILD_DATE=${{ github.event.head_commit.timestamp }} | |
| - name: Scan daemon image with Trivy | |
| uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 | |
| with: | |
| version: v0.70.0 | |
| cache: true | |
| - name: Run Trivy daemon scan (sarif) | |
| shell: bash | |
| run: | | |
| # Go reachability is enforced separately by govulncheck in CI. The | |
| # binary also carries the full workspace module graph, including | |
| # non-reachable packages that Trivy reports as binary findings. | |
| # CVE-2026-14456 (OpenSSL) is ignored via .trivyignore — the fixed | |
| # libcrypto 3.5.8-r0 is not yet published in Alpine 3.23. | |
| trivy image \ | |
| --severity CRITICAL,HIGH \ | |
| --ignore-unfixed \ | |
| --ignorefile "${GITHUB_WORKSPACE}/.trivyignore" \ | |
| --vuln-type os \ | |
| --format sarif \ | |
| --output trivy-daemon-image.sarif \ | |
| --exit-code 1 \ | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan | |
| - name: Generate image metadata | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha-,format=long | |
| # The PR already exercised the daemon Dockerfile in the scan build above. | |
| # Skip the redundant multi-arch publish build on pull requests so CI can | |
| # finish as soon as the security gate passes. | |
| - name: Build and publish daemon image | |
| if: github.event_name != 'pull_request' | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 | |
| with: | |
| context: . | |
| file: Dockerfile.daemon | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=graycode-daemon | |
| cache-to: type=gha,mode=max,scope=graycode-daemon | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| BUILD_DATE=${{ github.event.head_commit.timestamp }} | |
| # Publish the daemon scan to GitHub code scanning. The PR still runs the | |
| # scan, but it skips the redundant publish build and release artifacts. | |
| - name: Upload daemon image scan results | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: trivy-daemon-image.sarif |