-
Notifications
You must be signed in to change notification settings - Fork 0
Refactor 2025 #9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
KingPin
wants to merge
21
commits into
main
Choose a base branch
from
refac-2025
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
21 commits
Select commit
Hold shift + click to select a range
5831167
Enhance Doxygen Docker images with non-root user, health checks, and …
f6b5ca2
Update README.md with enhanced usage instructions, container registri…
c0559ef
Update Trivy vulnerability scanner action to version 0.30.0
17f6475
Update Docker publish workflow to use secrets for Quay credentials
289078c
Add timestamp generation for image creation in Docker publish workflow
8c93b13
Update Dockerfiles to use latest Alpine and Debian images, enhance di…
86ff53f
Refactor Dockerfiles to improve readability by organizing package ins…
4a5e8b3
Enhance Docker publish workflow by adding a hash generation step for …
78225cb
Consolidate Dockerfiles into a single Dockerfile with multi-architect…
2bc787f
Refactor Docker publish workflow to streamline build arguments for mu…
be262c8
Re-declare DISTRO ARG in Dockerfile to ensure availability after FROM…
16ead7d
Improve user creation logic in Dockerfile to support multiple distrib…
b12b62f
Update Docker publish workflow to use a single Dockerfile for all dis…
c365476
Fix entry point command in Dockerfile to reference the correct Doxyge…
78accbb
Refactor Dockerfile and add entrypoint script to improve user permiss…
d486b57
Enhance Doxygen version extraction and entrypoint script for improved…
7304342
Update README.md for improved clarity and structure, including enhanc…
e34dbba
Update Doxygen logo in README.md to use the SVG version for better qu…
f790fe7
Remove Doxygen logo from README.md for a cleaner presentation, and no…
d852d60
Add disclaimer and support section to README.md for clarity on commun…
cb9067b
Remove version specification from Docker Compose example for flexibility
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -4,190 +4,196 @@ on: | |||||
| schedule: | ||||||
| - cron: '31 16 * * 1' | ||||||
| workflow_dispatch: | ||||||
| push: | ||||||
| branches: [main] | ||||||
| paths: | ||||||
| - 'Dockerfile' | ||||||
| - '.github/workflows/docker-publish.yml' | ||||||
| pull_request: | ||||||
| branches: [main] | ||||||
| paths: | ||||||
| - 'Dockerfile' | ||||||
| - '.github/workflows/docker-publish.yml' | ||||||
|
|
||||||
| jobs: | ||||||
| Alpine: | ||||||
| concurrency: | ||||||
| group: ${{ github.workflow }}-${{ github.ref }} | ||||||
| cancel-in-progress: true | ||||||
|
|
||||||
| jobs: | ||||||
| build: | ||||||
| runs-on: ubuntu-latest | ||||||
| strategy: | ||||||
| matrix: | ||||||
| distro: [alpine, debian] | ||||||
| include: | ||||||
| - distro: alpine | ||||||
| is_latest: true | ||||||
| distro_version: 'latest' | ||||||
| - distro: debian | ||||||
| is_latest: false | ||||||
| debian_version: 'stable-slim' | ||||||
| permissions: | ||||||
| contents: write | ||||||
| contents: read | ||||||
| packages: write | ||||||
| security-events: write | ||||||
|
|
||||||
| id-token: write # For OIDC auth | ||||||
|
|
||||||
| steps: | ||||||
| - | ||||||
| name: Docker Setup QEMU | ||||||
| uses: docker/setup-qemu-action@v3 | ||||||
| id: qemu | ||||||
| with: | ||||||
| platforms: amd64,arm64,arm | ||||||
| - | ||||||
| name: Docker Setup Buildx | ||||||
| id: buildx | ||||||
| - name: Checkout code | ||||||
| uses: actions/checkout@v4 | ||||||
|
|
||||||
| - name: Set up Docker Buildx | ||||||
| uses: docker/setup-buildx-action@v3 | ||||||
| - | ||||||
| name: Login to DockerHub | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||||||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||||||
| - | ||||||
| name: Log into ghcr.io registry | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| registry: ghcr.io | ||||||
| username: ${{ github.repository_owner }} | ||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||
| - | ||||||
| name: Login to Quay.io | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| registry: quay.io | ||||||
| username: ${{ secrets.QUAY_USERNAME }} | ||||||
| password: ${{ secrets.QUAY_ROBOT_TOKEN }} | ||||||
| - | ||||||
| name: Build and test docker image | ||||||
| uses: docker/build-push-action@v6 | ||||||
| with: | ||||||
| # context: . | ||||||
| file: ./Dockerfile.alpine | ||||||
| load: true | ||||||
| tags: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine-test | ||||||
| cache-from: type=gha | ||||||
| cache-to: type=gha,mode=max | ||||||
| - | ||||||
| name: Test | ||||||
| run: | | ||||||
| docker run --rm docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine-test doxygen --help | ||||||
| - | ||||||
| name: Retrieve doxygen version | ||||||
| run: | | ||||||
| echo "doxygen_version=$(docker run --rm docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine-test doxygen -v)" >> $GITHUB_OUTPUT | ||||||
| id: version | ||||||
| # ${{ steps.version.outputs.doxygen_version }} | ||||||
| - | ||||||
| name: Run Trivy vulnerability scanner | ||||||
| uses: aquasecurity/trivy-action@master | ||||||
| with: | ||||||
| scan-type: image | ||||||
| image-ref: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine-test | ||||||
| format: 'sarif' | ||||||
| output: 'trivy-results-alpine.sarif' | ||||||
| severity: 'MEDIUM,CRITICAL,HIGH' | ||||||
| hide-progress: false | ||||||
| - | ||||||
| name: Upload Trivy scan results to GitHub Security tab | ||||||
| uses: github/codeql-action/upload-sarif@v3 | ||||||
| with: | ||||||
| sarif_file: 'trivy-results-alpine.sarif' | ||||||
| - | ||||||
| name: Build and push Docker image | ||||||
| uses: docker/build-push-action@v6 | ||||||
| with: | ||||||
| # context: . | ||||||
| file: ./Dockerfile.alpine | ||||||
| platforms: linux/amd64,linux/arm64,linux/arm/v7 | ||||||
| push: true | ||||||
| cache-from: type=gha | ||||||
| cache-to: type=gha,mode=max | ||||||
| tags: | | ||||||
| ghcr.io/kingpin/${{ github.event.repository.name }}:latest | ||||||
| ghcr.io/kingpin/${{ github.event.repository.name }}:alpine | ||||||
| ghcr.io/kingpin/${{ github.event.repository.name }}:alpine-${{ steps.version.outputs.doxygen_version }} | ||||||
| docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:latest | ||||||
| docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine | ||||||
| docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:alpine-${{ steps.version.outputs.doxygen_version }} | ||||||
| quay.io/kingpinx1/${{ github.event.repository.name }}:latest | ||||||
| quay.io/kingpinx1/${{ github.event.repository.name }}:alpine | ||||||
| quay.io/kingpinx1/${{ github.event.repository.name }}:alpine-${{ steps.version.outputs.doxygen_version }} | ||||||
| Debian: | ||||||
|
|
||||||
| runs-on: ubuntu-latest | ||||||
| permissions: | ||||||
| contents: write | ||||||
| packages: write | ||||||
| security-events: write | ||||||
|
|
||||||
| steps: | ||||||
| - | ||||||
| name: Docker Setup QEMU | ||||||
|
|
||||||
| - name: Set up QEMU | ||||||
| uses: docker/setup-qemu-action@v3 | ||||||
| id: qemu | ||||||
| with: | ||||||
| platforms: amd64,arm64,arm | ||||||
| - | ||||||
| name: Docker Setup Buildx | ||||||
| id: buildx | ||||||
| uses: docker/setup-buildx-action@v3 | ||||||
| - | ||||||
| name: Login to DockerHub | ||||||
| uses: docker/login-action@v3 | ||||||
| platforms: linux/amd64,linux/arm64,linux/arm/v7 | ||||||
|
|
||||||
| # Login to Docker Hub | ||||||
| - name: Login to Docker Hub | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||||||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||||||
| - | ||||||
| name: Log into ghcr.io registry | ||||||
|
|
||||||
| # Login to GitHub Container Registry | ||||||
| - name: Login to GitHub Container Registry | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| registry: ghcr.io | ||||||
| username: ${{ github.repository_owner }} | ||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||
| - | ||||||
| name: Login to Quay.io | ||||||
|
|
||||||
| # Login to Quay.io | ||||||
| - name: Login to Quay.io | ||||||
| uses: docker/login-action@v3 | ||||||
| with: | ||||||
| registry: quay.io | ||||||
| username: ${{ secrets.QUAY_USERNAME }} | ||||||
| password: ${{ secrets.QUAY_ROBOT_TOKEN }} | ||||||
| - | ||||||
| name: Build and test docker image | ||||||
|
|
||||||
| # Generate Dockerfile hash | ||||||
| - name: Generate Dockerfile hash | ||||||
| id: hash | ||||||
| run: | | ||||||
| echo "hash=$(sha256sum Dockerfile | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT | ||||||
|
|
||||||
| # Build test image | ||||||
| - name: Build test image | ||||||
| uses: docker/build-push-action@v6 | ||||||
| with: | ||||||
| # context: . | ||||||
| file: ./Dockerfile.debian | ||||||
| context: . | ||||||
| file: ./Dockerfile | ||||||
| build-args: | | ||||||
| DISTRO=${{ matrix.distro }} | ||||||
| ${{ matrix.distro == 'alpine' && format('DISTRO_VERSION={0}', matrix.distro_version) || format('DEBIAN_VERSION={0}', matrix.debian_version) }} | ||||||
| load: true | ||||||
| tags: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:debian-test | ||||||
| cache-from: type=gha | ||||||
| cache-to: type=gha,mode=max | ||||||
| - | ||||||
| name: Test | ||||||
| run: | | ||||||
| docker run --rm docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:debian-test doxygen --help | ||||||
| - | ||||||
| name: Retrieve doxygen version | ||||||
| tags: docker.io/${{ secrets.DOCKERHUB_USERNAME }}/${{ github.event.repository.name }}:${{ matrix.distro }}-test | ||||||
| cache-from: | | ||||||
| type=gha,scope=${{ matrix.distro }}-${{ steps.hash.outputs.hash }} | ||||||
| type=registry,ref=ghcr.io/kingpin/${{ github.event.repository.name }}:${{ matrix.distro }}-cache | ||||||
| cache-to: | | ||||||
| type=gha,scope=${{ matrix.distro }},mode=max | ||||||
|
||||||
| type=gha,scope=${{ matrix.distro }},mode=max | |
| type=gha,scope=${{ matrix.distro }}-${{ steps.hash.outputs.hash }},mode=max |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The conditional build-arg logic is fragile and will cause issues for Debian builds. When
DISTRO=debian, this setsDEBIAN_VERSION=stable-slimbut the Dockerfile's FROM statement uses${DISTRO}:${DISTRO_VERSION}, which would result indebian:latest(the default DISTRO_VERSION value). This needs to properly set both DISTRO and the appropriate version variable.