jaredandClaude Opus 4.8
b2c19745eb
Lint / PHP (phpcs PSR-12) (push) Successful in 20s
Lint / JS (eslint) (push) Successful in 11s
Lint / PHP requirements (version + extensions) (push) Successful in 52s
Security / PHP Security (semgrep) (push) Successful in 2m6s
Lint / Deploy (push) Successful in 13s
Lint / Notify on failure (push) Has been skipped
Trusted-proxy hardening (defense-in-depth for Authelia forward-auth): - AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403 and logs an 'untrusted_proxy' security event. Previously anything that could reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin. - New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement off, so this is backward compatible until the allowlist is set on a host. Requirements checks (so a PHP upgrade dropping an extension can't silently break features like avatars again): - config/requirements.php: single source of truth for min PHP version and required extensions (ldap, mysqli, curl, mbstring, fileinfo, json). - scripts/check_requirements.php: CI script that fails the build if the environment doesn't satisfy them. - New 'requirements' CI job installs those extensions and runs the check; deploy now depends on it. - api/health.php: adds php_extensions + php_version checks so production monitoring surfaces the drift (returns 503 if a required extension is gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
111 lines
3.6 KiB
YAML
111 lines
3.6 KiB
YAML
name: Lint
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
|
|
jobs:
|
|
php-lint:
|
|
name: PHP (phpcs PSR-12)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install PHP and phpcs
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y -qq php-cli php-xml
|
|
curl -sL https://squizlabs.github.io/PHP_CodeSniffer/phpcs.phar -o /usr/local/bin/phpcs
|
|
chmod +x /usr/local/bin/phpcs
|
|
|
|
- name: Run phpcs
|
|
run: phpcs --standard=.phpcs.xml .
|
|
|
|
js-lint:
|
|
name: JS (eslint)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install ESLint
|
|
run: npm install --save-dev eslint@8
|
|
|
|
- name: Run ESLint
|
|
run: npx eslint assets/js/
|
|
|
|
requirements:
|
|
name: PHP requirements (version + extensions)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install PHP with required extensions
|
|
run: |
|
|
apt-get update -qq
|
|
# Install the extensions declared in config/requirements.php so the
|
|
# check verifies they are actually installable + loadable, and so this
|
|
# build fails if a required extension can't be provided.
|
|
apt-get install -y -qq php-cli php-ldap php-mysql php-curl php-mbstring
|
|
|
|
- name: Verify runtime requirements
|
|
run: php scripts/check_requirements.php
|
|
|
|
deploy:
|
|
name: Deploy
|
|
runs-on: ubuntu-latest
|
|
needs: [php-lint, js-lint, requirements]
|
|
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/development')
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Trigger webhook
|
|
env:
|
|
WEBHOOK_SECRET: ${{ secrets.WEBHOOK_SECRET }}
|
|
GIT_REF: ${{ github.ref }}
|
|
run: |
|
|
if [ "$GIT_REF" = "refs/heads/main" ]; then
|
|
HOOK_ID="tinker-deploy"
|
|
else
|
|
HOOK_ID="tinker-beta-deploy"
|
|
fi
|
|
PAYLOAD="{\"ref\":\"${GIT_REF}\"}"
|
|
SIG=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')
|
|
curl -sf --connect-timeout 10 \
|
|
-X POST \
|
|
-H "Content-Type: application/json" \
|
|
-H "X-Gitea-Signature: ${SIG}" \
|
|
-d "$PAYLOAD" \
|
|
"http://10.10.10.45:9000/hooks/${HOOK_ID}"
|
|
|
|
- name: Tag deployed commit
|
|
if: github.ref == 'refs/heads/main'
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
TAG="deploy-$(date -u +%Y.%m.%d)-${{ github.run_number }}"
|
|
curl -sf -X POST \
|
|
-H "Authorization: token $GITHUB_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"${TAG}\",\"target\":\"${{ github.sha }}\",\"message\":\"Deployed to production\"}" \
|
|
"https://code.lotusguild.org/api/v1/repos/${{ github.repository }}/tags"
|
|
|
|
notify-failure:
|
|
name: Notify on failure
|
|
runs-on: ubuntu-latest
|
|
needs: [php-lint, js-lint, requirements]
|
|
if: failure() && github.event_name == 'push'
|
|
steps:
|
|
- name: Send Matrix alert
|
|
env:
|
|
MATRIX_WEBHOOK_URL: ${{ secrets.MATRIX_WEBHOOK_URL }}
|
|
REPO: ${{ github.repository }}
|
|
BRANCH: ${{ github.ref_name }}
|
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
run: |
|
|
if [ -z "$MATRIX_WEBHOOK_URL" ] || [ "$MATRIX_WEBHOOK_URL" = "CONFIGURE_ME" ]; then exit 0; fi
|
|
curl -sf -X POST "$MATRIX_WEBHOOK_URL" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"text\":\"CI FAILED: ${REPO} @ ${BRANCH} — ${RUN_URL}\"}"
|