mixandClaude Opus 5.5
68493dc097
Security audit 2026-10-17, findings I4 and I5 (low), stage 5. I4: every action is pinned by commit with its version in a comment - the latest release of the major each used, so nothing changes in behaviour (checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0, build-push-action v6.19.2, login-action v3.7.0; commits read with git ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the source in test.yml, and in release.yml on the image's panel and selfpost-backup binaries before the push (-mode=binary: the base image's Go, which may lag the runner's - a fixed stdlib advisory then fails the release until golang:1.26-trixie moves, which is the point). certbot is pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17). provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the plan says. I5: published tags are never rebuilt, so a Debian security fix reaches operators with the next release. The guide (§ Upgrading) and SECURITY.md say so; base-packages.yml runs .github/scripts/base-packages.sh every Monday: what debian:trixie-slim would install for postfix, libsasl2-2, libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against the table in development.md (the 2.14.3 image's versions), red when one moved. Tried on the test server: green as it stands, red with a version changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
245 lines
10 KiB
YAML
245 lines
10 KiB
YAML
name: release
|
|
|
|
# Publishes an immutable, version-tagged image on ghcr.io.
|
|
# Ordinary commits and bare git tag pushes do not publish anything. A published
|
|
# GitHub Release runs this workflow directly (same pattern as gosentry / imap-scrub).
|
|
# You can also run it manually via workflow_dispatch with an explicit SemVer X.Y.Z.
|
|
#
|
|
# Native per-architecture builds (see docs/development.md), not qemu: running
|
|
# the full Postfix and panel stack under emulation for the e2e gate below is
|
|
# impractically slow. Each arch builds, e2e-gates and pushes its own tag on its
|
|
# own native runner; a merge job then combines them into the one manifest tag
|
|
# documented in deploy/docker-compose.yml. "test, then push" (not push-by-digest
|
|
# then test) is deliberate: it means the bytes that get tagged are exactly the
|
|
# bytes that passed e2e. The per-arch tags stay in GHCR next to the version
|
|
# tag: they are the images the multi-arch manifest points at, and GHCR cannot
|
|
# drop a tag without deleting the image behind it.
|
|
on:
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Image version as X.Y.Z (no v prefix)."
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
prepare:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
steps:
|
|
- name: Derive a SemVer X.Y.Z version
|
|
id: version
|
|
env:
|
|
INPUT_VERSION: ${{ github.event.inputs.version }}
|
|
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ "$EVENT_NAME" = "release" ]; then
|
|
raw="${RELEASE_TAG:-}"
|
|
else
|
|
raw="${INPUT_VERSION:-}"
|
|
fi
|
|
raw="${raw#v}"
|
|
if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
echo "::error::release version is not SemVer X.Y.Z (event=${EVENT_NAME}; tag=${RELEASE_TAG:-} input=${INPUT_VERSION:-}). Refusing to publish ghcr.io/${{ github.repository }}:${raw:-?}"
|
|
exit 1
|
|
fi
|
|
echo "version=${raw}" >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
needs: prepare
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- runner: ubuntu-latest
|
|
arch: amd64
|
|
- runner: ubuntu-24.04-arm
|
|
arch: arm64
|
|
runs-on: ${{ matrix.runner }}
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
ref: v${{ needs.prepare.outputs.version }}
|
|
|
|
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
|
|
|
- name: Build image (native, loaded locally for the e2e gate)
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
|
with:
|
|
context: .
|
|
file: build/Dockerfile
|
|
load: true
|
|
provenance: false
|
|
build-args: |
|
|
VERSION=${{ needs.prepare.outputs.version }}
|
|
tags: selfpost:e2e
|
|
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: "1.26"
|
|
cache-dependency-path: test/e2e/go.sum
|
|
|
|
- name: e2e (gates publishing — see docs/development.md)
|
|
# The e2e builds selfpost:e2e again through compose.override.yml, and
|
|
# that rebuild is the image pushed below. Without the version here it
|
|
# was stamped "e2e" (audit 2026-10-12, H1); the suite now checks the
|
|
# stamp against this variable.
|
|
env:
|
|
SELFPOST_E2E_VERSION: ${{ needs.prepare.outputs.version }}
|
|
run: cd test/e2e && go test -v -timeout 20m ./...
|
|
|
|
- name: Check the version stamp of the image about to be pushed
|
|
env:
|
|
WANT: ${{ needs.prepare.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
for bin in panel selfpost-backup; do
|
|
got=$(docker run --rm --entrypoint "$bin" selfpost:e2e -version)
|
|
if [ "$got" != "$WANT" ]; then
|
|
echo "::error::selfpost:e2e $bin -version = '$got', want '$WANT'; refusing to push"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
# The binaries about to be pushed, as built in the image - with the Go
|
|
# of golang:1.26-trixie, which may lag the runner's: a standard-library
|
|
# advisory fixed in a later patch fails the release until the base tag
|
|
# moves, which is the point (security audit 2026-10-17, I4).
|
|
- name: Vulnerabilities in the image's binaries
|
|
run: |
|
|
set -euo pipefail
|
|
id=$(docker create selfpost:e2e)
|
|
trap 'docker rm -f "$id" >/dev/null' EXIT
|
|
for bin in panel selfpost-backup; do
|
|
docker cp "$id:/usr/local/bin/$bin" "/tmp/$bin"
|
|
go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 -mode=binary "/tmp/$bin"
|
|
done
|
|
|
|
- name: Log in to ghcr.io
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Push per-arch tag
|
|
# GHCR sometimes rejects the final manifest with "unknown blob" after
|
|
# every layer reports Pushed (registry race / overwrite of the same
|
|
# version tag). Retries are idempotent for identical local bytes.
|
|
run: |
|
|
set -euo pipefail
|
|
image="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
|
|
docker tag selfpost:e2e "$image"
|
|
attempt=1
|
|
max=4
|
|
backoff=15
|
|
while true; do
|
|
set +e
|
|
out=$(docker push "$image" 2>&1)
|
|
rc=$?
|
|
set -e
|
|
if [ "$rc" -eq 0 ]; then
|
|
printf '%s\n' "$out"
|
|
exit 0
|
|
fi
|
|
printf '%s\n' "$out" >&2
|
|
if [ "$attempt" -ge "$max" ] || ! grep -qiE 'unknown blob|blob unknown|blob upload invalid|manifest unknown|received unexpected HTTP status: 5[0-9]{2}|429 Too Many Requests|temporarily unavailable' <<<"$out"; then
|
|
echo "::error::docker push failed for ${image} (attempt ${attempt}/${max}, exit ${rc})" >&2
|
|
exit "$rc"
|
|
fi
|
|
echo "::warning::transient GHCR error pushing ${image} (attempt ${attempt}/${max}); retry in ${backoff}s" >&2
|
|
sleep "$backoff"
|
|
attempt=$((attempt + 1))
|
|
backoff=$((backoff * 2))
|
|
done
|
|
|
|
merge:
|
|
needs: [prepare, build]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
ref: v${{ needs.prepare.outputs.version }}
|
|
|
|
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
|
|
|
- name: Log in to ghcr.io
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Merge per-arch tags into the version manifest
|
|
# Same GHCR "unknown blob" class of failure can hit imagetools create
|
|
# when assembling the multi-arch version tag.
|
|
run: |
|
|
set -euo pipefail
|
|
version_tag="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}"
|
|
amd64="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64"
|
|
arm64="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"
|
|
attempt=1
|
|
max=4
|
|
backoff=15
|
|
while true; do
|
|
set +e
|
|
out=$(docker buildx imagetools create -t "$version_tag" "$amd64" "$arm64" 2>&1)
|
|
rc=$?
|
|
set -e
|
|
if [ "$rc" -eq 0 ]; then
|
|
printf '%s\n' "$out"
|
|
exit 0
|
|
fi
|
|
printf '%s\n' "$out" >&2
|
|
if [ "$attempt" -ge "$max" ] || ! grep -qiE 'unknown blob|blob unknown|blob upload invalid|manifest unknown|received unexpected HTTP status: 5[0-9]{2}|429 Too Many Requests|temporarily unavailable' <<<"$out"; then
|
|
echo "::error::imagetools create failed for ${version_tag} (attempt ${attempt}/${max}, exit ${rc})" >&2
|
|
exit "$rc"
|
|
fi
|
|
echo "::warning::transient GHCR error merging ${version_tag} (attempt ${attempt}/${max}); retry in ${backoff}s" >&2
|
|
sleep "$backoff"
|
|
attempt=$((attempt + 1))
|
|
backoff=$((backoff * 2))
|
|
done
|
|
|
|
- name: Remove orphaned untagged versions from GHCR
|
|
# Re-publishing a version moves its tags to new manifests and leaves the
|
|
# old ones behind as untagged "sha256:..." package versions. Delete only
|
|
# those that no tagged manifest references: the images behind a
|
|
# multi-arch tag are package versions too, and deleting one breaks pulls
|
|
# of that tag. Any failed lookup aborts the step before anything is
|
|
# deleted.
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
image="ghcr.io/${{ github.repository }}"
|
|
owner="${{ github.repository_owner }}"
|
|
pkg="${{ github.event.repository.name }}"
|
|
api="/users/${owner}/packages/container/${pkg}/versions"
|
|
versions=$(gh api "${api}?per_page=100" --paginate \
|
|
--jq '.[] | [.id, .name, (.metadata.container.tags | length)] | @tsv')
|
|
keep=$(mktemp)
|
|
while IFS=$'\t' read -r id digest ntags; do
|
|
[ "$ntags" -gt 0 ] || continue
|
|
echo "$digest" >> "$keep"
|
|
raw=$(docker buildx imagetools inspect --raw "${image}@${digest}")
|
|
jq -r '.manifests[]?.digest' <<<"$raw" >> "$keep"
|
|
done <<<"$versions"
|
|
while IFS=$'\t' read -r id digest ntags; do
|
|
[ "$ntags" -eq 0 ] || continue
|
|
if grep -qxF "$digest" "$keep"; then
|
|
continue
|
|
fi
|
|
echo "deleting orphaned GHCR package version ${id} (${digest})"
|
|
gh api -X DELETE "${api}/${id}"
|
|
done <<<"$versions"
|