fix(deps): update dependency react (19.2.7 → 19.2.8) #1365
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Build Dispatch Image | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*" | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE_NAME: ghcr.io/${{ github.repository }} | |
| jobs: | |
| docker: | |
| name: Docker Build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| - name: Build Docker image | |
| id: build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| # BuildKit can't load and push from the same build, so PRs load into | |
| # the local daemon (for the validation step below) and main/tags push | |
| # to GHCR. The validation step picks the right one. | |
| push: ${{ github.event_name != 'pull_request' }} | |
| load: ${{ github.event_name == 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| # Only main/tag builds write the cache. PR builds read it but never | |
| # export — the mode=max export re-uploads every stage's layers | |
| # (~1GB of node_modules) whenever package.json changes, which was | |
| # ~270s of every release-bump and Renovate PR build. | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }} | |
| build-args: | | |
| DATABASE_URL=postgresql://localhost:5432/dispatch | |
| - name: Validate Prisma CLI runtime | |
| env: | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| run: | | |
| set -euo pipefail | |
| # Reuse the image built above. On PRs it was loaded into the local | |
| # daemon; on main/tags it was pushed to GHCR, so pull it first. | |
| IMAGE="$(printf '%s\n' "$TAGS" | head -n1)" | |
| if [ "${{ github.event_name }}" != "pull_request" ]; then | |
| docker pull "$IMAGE" | |
| fi | |
| echo "Validating Prisma CLI in image: $IMAGE" | |
| # Pass DATABASE_URL at runtime so prisma validate can load prisma.config.ts. | |
| # The builder stage ENV is only for npm run build (Next.js static generation). | |
| docker run --rm --env DATABASE_URL=postgresql://localhost:5432/dispatch --entrypoint ./node_modules/.bin/prisma "$IMAGE" --version | |
| docker run --rm --env DATABASE_URL=postgresql://localhost:5432/dispatch --entrypoint ./node_modules/.bin/prisma "$IMAGE" validate | |
| - name: Run Trivy vulnerability scanner | |
| if: github.event_name != 'pull_request' | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| continue-on-error: true | |
| with: | |
| image-ref: ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: CRITICAL,HIGH | |
| # The severity filter is ignored for SARIF output unless this is set. | |
| limit-severities-for-sarif: true | |
| # Skip OS-package CVEs Debian hasn't shipped a fix for — nothing | |
| # actionable, and they drown out alerts we can actually fix. | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - name: Upload Trivy results | |
| if: github.event_name != 'pull_request' && hashFiles('trivy-results.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4 | |
| with: | |
| sarif_file: trivy-results.sarif |