chore(deps): update ghcr.io/tankdonut/tools:latest docker digest to c… #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OpenCode Harness - CI/CD Pipeline | |
| # Builds and tests the container on every push and pull request | |
| name: CI | |
| on: | |
| push: | |
| branches: [main, master] | |
| paths: | |
| - 'build/**' | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - '.github/workflows/ci.yml' | |
| - '.pre-commit-config.yaml' | |
| pull_request: | |
| branches: [main, master] | |
| paths: | |
| - 'build/**' | |
| - 'scripts/**' | |
| - 'tests/**' | |
| - '.github/workflows/ci.yml' | |
| - '.pre-commit-config.yaml' | |
| workflow_dispatch: | |
| env: | |
| IMAGE_NAME: opencode-harness | |
| IMAGE_TAG: ${{ github.sha }} | |
| jobs: | |
| # Lint and validate before building | |
| validate: | |
| name: Validate Configuration | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| - name: Install validation tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y jq | |
| pip install pre-commit | |
| # Install hadolint for Containerfile linting | |
| HADOLINT_VERSION="2.14.0" | |
| curl -fsSL "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64" \ | |
| -o /usr/local/bin/hadolint | |
| chmod +x /usr/local/bin/hadolint | |
| - name: Run validation suite | |
| run: ./scripts/validate.sh | |
| - name: Run pre-commit hooks | |
| run: pre-commit run --all-files | |
| # Build and test container | |
| build-and-test: | |
| name: Build & Test Container | |
| runs-on: ubuntu-latest | |
| needs: validate | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Set container runtime | |
| run: | | |
| echo "Using Docker (pre-installed on GitHub runners)" | |
| echo "CONTAINER_CMD=docker" >> $GITHUB_ENV | |
| - name: Resolve OpenCode version | |
| run: | | |
| OPENCODE_VERSION=$(cat build/.opencode-version | tr -d '[:space:]') | |
| echo "OPENCODE_VERSION=${OPENCODE_VERSION}" >> $GITHUB_ENV | |
| echo "OpenCode version: ${OPENCODE_VERSION}" | |
| - name: Build container image | |
| run: | | |
| ./scripts/build.sh \ | |
| --runtime docker \ | |
| --no-cache \ | |
| --tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} | |
| - name: Tag image | |
| run: | | |
| ${{ env.CONTAINER_CMD }} tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} ${{ env.IMAGE_NAME }}:${{ env.OPENCODE_VERSION }} | |
| ${{ env.CONTAINER_CMD }} tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} ${{ env.IMAGE_NAME }}:latest | |
| echo "✓ Image tagged: ${{ env.IMAGE_TAG }}, ${{ env.OPENCODE_VERSION }}, latest" | |
| - name: Run container tests | |
| run: | | |
| ./scripts/container-test.sh ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} ${{ env.CONTAINER_CMD }} | |
| - name: Scan image for vulnerabilities (optional) | |
| continue-on-error: true | |
| run: | | |
| echo "Scanning image for vulnerabilities..." | |
| if command -v podman &> /dev/null; then | |
| podman image scan ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} || true | |
| else | |
| echo "Image scanning not available with Docker, skipping..." | |
| fi | |
| - name: Push to GitHub Container Registry | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | ${{ env.CONTAINER_CMD }} login ghcr.io -u ${{ github.actor }} --password-stdin | |
| ${{ env.CONTAINER_CMD }} tag ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} ghcr.io/${{ github.repository_owner }}/opencode-harness:${{ env.IMAGE_TAG }} | |
| ${{ env.CONTAINER_CMD }} tag ${{ env.IMAGE_NAME }}:${{ env.OPENCODE_VERSION }} ghcr.io/${{ github.repository_owner }}/opencode-harness:${{ env.OPENCODE_VERSION }} | |
| ${{ env.CONTAINER_CMD }} tag ${{ env.IMAGE_NAME }}:latest ghcr.io/${{ github.repository_owner }}/opencode-harness:latest | |
| ${{ env.CONTAINER_CMD }} push ghcr.io/${{ github.repository_owner }}/opencode-harness:${{ env.IMAGE_TAG }} | |
| ${{ env.CONTAINER_CMD }} push ghcr.io/${{ github.repository_owner }}/opencode-harness:${{ env.OPENCODE_VERSION }} | |
| ${{ env.CONTAINER_CMD }} push ghcr.io/${{ github.repository_owner }}/opencode-harness:latest | |
| echo "✓ Image pushed to GitHub Container Registry with tags: ${{ env.IMAGE_TAG }}, ${{ env.OPENCODE_VERSION }}, latest" | |
| # Summary job | |
| ci-status: | |
| name: CI Status | |
| runs-on: ubuntu-latest | |
| needs: [validate, build-and-test] | |
| if: always() | |
| steps: | |
| - name: Check overall status | |
| run: | | |
| if [[ "${{ needs.validate.result }}" == "success" && "${{ needs.build-and-test.result }}" == "success" ]]; then | |
| echo "✅ All CI checks passed!" | |
| exit 0 | |
| else | |
| echo "❌ CI checks failed" | |
| echo "Validate: ${{ needs.validate.result }}" | |
| echo "Build & Test: ${{ needs.build-and-test.result }}" | |
| exit 1 | |
| fi |