mirrors/p2pool-docker
1
0
Fork 1
mirror of https://github.com/sethforprivacy/p2pool-docker.git synced 2026-06-24 04:34:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

Harden CI workflows: reliability tests, least-privilege, build cache

Browse Source 
Reliability (catch a bad image revision before prod):
- Smoke-test the exact pushed digest in update-image-on-push.yml BEFORE the
  merge job tags it 'latest' (previously the prod artifact was never run).
- Assert the p2pool banner reports the pinned P2POOL_BRANCH tag, and verify
  the container starts and stays up, instead of just sleeping 30s.

Hardening:
- Least-privilege 'permissions:' blocks (default contents: read; packages:
  write only on push/merge jobs; repo default token is currently write-all).
- Concurrency groups (cancel superseded PR builds; serialize prod pushes).
- persist-credentials: false on checkout; timeout-minutes on jobs.

Build cache:
- cache-to registry buildcache (mode=max, per-arch); read buildcache + latest.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Seth For Privacy
2026-06-23 09:16:30 -04:00
parent 46d68375cd
commit 699b578ee7
2 changed files with 95 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
.github/workflows/build-image-on-push.yml vendored
View File

@@ -11,12 +11,25 @@ on:
- 'Dockerfile'
workflow_dispatch:
# Least-privilege default token (this workflow only reads the repo and pulls cache)
permissions:
contents: read
# Cancel superseded runs for the same ref to save CI minutes
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
jobs:
rebuild-container:
name: "Build image with cache"
timeout-minutes: 60
permissions:
contents: read
packages: read
strategy:
fail-fast: false
matrix:
@@ -35,14 +48,13 @@ jobs:
run: |
echo "PLATFORM=linux/amd64" >> $GITHUB_ENV
echo "DIGEST_NAME=amd64" >> $GITHUB_ENV
-
name: Set up Docker Buildx
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4.1.0
-
name: Checkout repository
- name: Checkout repository
uses: actions/checkout@v7
-
name: Test build of image
with:
persist-credentials: false
- name: Test build of image
id: build
uses: docker/build-push-action@v7.2.0
with:
@@ -50,11 +62,25 @@ jobs:
load: true
platforms: ${{ env.PLATFORM }}
tags: p2pool:testing
cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
-
name: Test-run image
cache-from: |
type=registry,ref=${{ env.GHCR_REPO }}:buildcache-${{ env.DIGEST_NAME }}
type=registry,ref=${{ env.GHCR_REPO }}:latest
- name: Verify reported version matches the pinned p2pool tag
run: |
docker run --rm p2pool:testing --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R &
PID=$!
sleep 30
kill -SIGINT $PID # this will return a non-zero exit code if the container dies early on
set -euo pipefail
EXPECTED="$(awk -F= '/^ARG P2POOL_BRANCH=/{print $2; exit}' Dockerfile)"
echo "Expecting p2pool to report: ${EXPECTED}"
OUT="$(docker run --rm p2pool:testing --help 2>&1 || true)"
echo "${OUT}" | head -1
echo "${OUT}" | grep -q "${EXPECTED}" \
|| { echo "::error::p2pool banner does not contain expected tag ${EXPECTED}"; exit 1; }
- name: Verify the container starts and stays up
run: |
set -uo pipefail
CID="$(docker run -d p2pool:testing --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R)"
sleep 20
if [ "$(docker inspect -f '{{.State.Running}}' "$CID" 2>/dev/null || echo false)" != "true" ]; then
echo "::error::container exited early"; docker logs "$CID" 2>&1 || true
docker rm -f "$CID" >/dev/null 2>&1 || true; exit 1
fi
docker rm -f "$CID" >/dev/null 2>&1 || true

66
.github/workflows/update-image-on-push.yml vendored
View File

@@ -8,12 +8,26 @@ on:
- 'Dockerfile'
workflow_dispatch:
# Least-privilege default; jobs that push opt into packages: write below
permissions:
contents: read
# Never run two prod pushes for the same ref concurrently (avoid racing the
# manifest/`latest` tag); do not cancel an in-flight push.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: false
env:
GHCR_REPO: ghcr.io/${{ github.repository_owner }}/p2pool
jobs:
build:
name: "Build container for multiple architectures and push by digest"
timeout-minutes: 60
permissions:
contents: read
packages: write
strategy:
fail-fast: false
matrix:
@@ -38,28 +52,53 @@ jobs:
with:
images: |
${{ env.GHCR_REPO }}
-
name: Set up Docker Buildx
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v4.1.0
-
name: Login to GitHub Container Registry
- name: Login to GitHub Container Registry
uses: docker/login-action@v4.2.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Checkout repository
- name: Checkout repository
uses: actions/checkout@v7
-
name: Build and and push by digest
with:
persist-credentials: false
- name: Build and push by digest
uses: docker/build-push-action@v7.2.0
id: build
with:
outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
platforms: ${{ env.PLATFORM }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=registry,ref=${{ env.GHCR_REPO }}:latest
cache-from: |
type=registry,ref=${{ env.GHCR_REPO }}:buildcache-${{ env.DIGEST_NAME }}
type=registry,ref=${{ env.GHCR_REPO }}:latest
cache-to: type=registry,ref=${{ env.GHCR_REPO }}:buildcache-${{ env.DIGEST_NAME }},mode=max
# Smoke-test the exact artifact that was just pushed, BEFORE the merge job
# tags it `latest`. If this fails, the merge job (needs: build) never runs.
- name: Verify pushed image reports the pinned p2pool tag
run: |
set -euo pipefail
EXPECTED="$(awk -F= '/^ARG P2POOL_BRANCH=/{print $2; exit}' Dockerfile)"
REF="${GHCR_REPO}@${{ steps.build.outputs.digest }}"
echo "Expecting ${EXPECTED} from ${REF}"
OUT="$(docker run --rm "${REF}" --help 2>&1 || true)"
echo "${OUT}" | head -1
echo "${OUT}" | grep -q "${EXPECTED}" \
|| { echo "::error::pushed image banner does not contain expected tag ${EXPECTED}"; exit 1; }
- name: Verify pushed image starts and stays up
run: |
set -uo pipefail
REF="${GHCR_REPO}@${{ steps.build.outputs.digest }}"
CID="$(docker run -d "${REF}" --wallet 468ydghFfthE3UTc53eF5MP9UyrMcUiAHP5kizVYJsej5XGaXBoAAEzUHCcUF7t3E3RrYAX8Rs1ujhBdcvMpZSbH8qkb55R)"
sleep 20
if [ "$(docker inspect -f '{{.State.Running}}' "$CID" 2>/dev/null || echo false)" != "true" ]; then
echo "::error::pushed image exited early"; docker logs "$CID" 2>&1 || true
docker rm -f "$CID" >/dev/null 2>&1 || true; exit 1
fi
docker rm -f "$CID" >/dev/null 2>&1 || true
- name: Export digest
run: |
@@ -76,9 +115,14 @@ jobs:
retention-days: 1
merge:
name: "Merge digests and push with proper tags"
timeout-minutes: 15
runs-on: ubuntu-latest
needs:
- build
permissions:
contents: read
packages: write
steps:
- name: Download digests
uses: actions/download-artifact@v8
@@ -99,7 +143,9 @@ jobs:
- name: Checkout repository
uses: actions/checkout@v7
with:
persist-credentials: false
- name: Get p2pool release tag
run: echo P2POOL_TAG="$(awk -F '=' '/P2POOL_BRANCH=/ {print $2}' Dockerfile)" >> $GITHUB_ENV