Seth For Privacy
699b578ee7
Harden CI workflows: reliability tests, least-privilege, build cache
...
Reliability (catch a bad image revision before prod):
- Smoke-test the exact pushed digest in update-image-on-push.yml BEFORE the
merge job tags it 'latest' (previously the prod artifact was never run).
- Assert the p2pool banner reports the pinned P2POOL_BRANCH tag, and verify
the container starts and stays up, instead of just sleeping 30s.
Hardening:
- Least-privilege 'permissions:' blocks (default contents: read; packages:
write only on push/merge jobs; repo default token is currently write-all).
- Concurrency groups (cancel superseded PR builds; serialize prod pushes).
- persist-credentials: false on checkout; timeout-minutes on jobs.
Build cache:
- cache-to registry buildcache (mode=max, per-arch); read buildcache + latest.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-23 09:16:30 -04:00
renovate[bot]
a0610a6215
Update actions/checkout action to v7
2026-06-18 19:52:11 +00:00
renovate[bot]
599c70f413
Update docker/setup-buildx-action action to v4.1.0
2026-05-23 20:20:53 +00:00
renovate[bot]
f96e9166dc
Update docker/build-push-action action to v7.2.0
2026-05-23 15:50:03 +00:00
renovate[bot]
d30e72c868
Update docker/build-push-action action to v7.1.0
2026-04-10 14:04:03 +00:00
dependabot[bot]
46a1067577
Bump the dependency-updates group across 1 directory with 2 updates
...
Bumps the dependency-updates group with 2 updates in the / directory: [docker/build-push-action](https://github.com/docker/build-push-action ) and [docker/metadata-action](https://github.com/docker/metadata-action ).
Updates `docker/build-push-action` from 6.19.2 to 7.0.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6.19.2...v7.0.0 )
Updates `docker/metadata-action` from 5 to 6
- [Release notes](https://github.com/docker/metadata-action/releases )
- [Commits](https://github.com/docker/metadata-action/compare/v5...v6 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: dependency-updates
- dependency-name: docker/metadata-action
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: dependency-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-06 20:42:38 +00:00
renovate[bot]
e883973c01
Update docker/setup-buildx-action action to v4
2026-03-05 09:47:12 +00:00
renovate[bot]
cc76d47cc4
Update docker/build-push-action action to v6.19.2
2026-02-12 09:39:31 +00:00
renovate[bot]
366802894c
Update docker/build-push-action action to v6.19.0
2026-02-11 13:13:59 +00:00
renovate[bot]
6d4f11403b
Update docker/setup-buildx-action action to v3.12.0
2025-12-19 14:11:24 +00:00
renovate[bot]
dae74873c4
Update actions/checkout action to v6
2025-11-20 17:46:57 +00:00
dependabot[bot]
f2a46b8a21
Bump the dependency-updates group across 1 directory with 2 updates
...
Bumps the dependency-updates group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ) and [actions/download-artifact](https://github.com/actions/download-artifact ).
Updates `actions/checkout` from 4 to 5
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v5 )
Updates `actions/download-artifact` from 4 to 5
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: dependency-updates
- dependency-name: actions/download-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: dependency-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-08-12 04:39:58 +00:00
renovate[bot]
031bd91913
Update docker/setup-buildx-action action to v3.11.1
2025-06-18 11:01:02 +00:00
renovate[bot]
b77b8d9d7c
Update docker/setup-buildx-action action to v3.11.0
2025-06-16 17:41:06 +00:00
dependabot[bot]
6945b17b5d
Bump docker/build-push-action in the dependency-updates group
...
Bumps the dependency-updates group with 1 update: [docker/build-push-action](https://github.com/docker/build-push-action ).
Updates `docker/build-push-action` from 6.17.0 to 6.18.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: 6.18.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: dependency-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-05-27 20:53:03 +00:00
renovate[bot]
9d6980c6d2
Update docker/build-push-action action to v6.17.0
2025-05-15 13:37:56 +00:00
renovate[bot]
9925a8d336
Update docker/build-push-action action to v6.16.0
2025-04-24 14:49:14 +00:00
dependabot[bot]
76b1d9164c
Bump the dependency-updates group with 2 updates
...
Bumps the dependency-updates group with 2 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) and [docker/build-push-action](https://github.com/docker/build-push-action ).
Updates `docker/setup-buildx-action` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3.9.0...v3.10.0 )
Updates `docker/build-push-action` from 6.14.0 to 6.15.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6.14.0...v6.15.0 )
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: dependency-updates
- dependency-name: docker/build-push-action
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: dependency-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-02-26 20:30:43 +00:00
dependabot[bot]
ba800e4da7
Bump docker/build-push-action in the dependency-updates group
...
Bumps the dependency-updates group with 1 update: [docker/build-push-action](https://github.com/docker/build-push-action ).
Updates `docker/build-push-action` from 6.13.0 to 6.14.0
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](https://github.com/docker/build-push-action/compare/v6.13.0...v6.14.0 )
---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: dependency-updates
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-02-19 20:02:59 +00:00
Seth For Privacy
00fe0b7e4d
Fix test run of images
2025-02-07 12:02:33 -05:00
Seth For Privacy
38772276a6
Migrate to native architecture runners for Github Actions builds and add test build workflow for PRs
2025-02-07 11:32:30 -05:00