Skip to content

Commit 139a344

Browse files
mannie-exemannie-exe
committed
ci: add fork CI/CD workflows and security config
- Add upstream sync workflow (weekly Monday 6am UTC, ff-only + rebase) - Add Docker publish workflow (tag v*-h2c* → ghcr.io, Trivy scan) - Add CodeQL analysis workflow for Go - Add Dependabot config for Go modules and GitHub Actions - Update check.yaml: Go 1.24 via go-version-file, actions to v6 - Remove semgrep.yml (requires Cloudflare private server)
1 parent 4519347 commit 139a344

6 files changed

Lines changed: 195 additions & 37 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
labels:
8+
- dependencies
9+
- go
10+
11+
- package-ecosystem: github-actions
12+
directory: /
13+
schedule:
14+
interval: weekly
15+
labels:
16+
- dependencies
17+
- ci

‎.github/workflows/check.yaml‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,29 @@
1-
on: [push, pull_request]
21
name: Check
2+
3+
on:
4+
push:
5+
branches: [master, feat/h2c-origin]
6+
pull_request:
7+
branches: [master, feat/h2c-origin]
8+
39
jobs:
410
check:
511
strategy:
612
matrix:
7-
go-version: [1.22.x]
813
os: [ubuntu-latest, macos-latest, windows-latest]
914
runs-on: ${{ matrix.os }}
1015
steps:
11-
- name: Install Go
12-
uses: actions/setup-go@v5
13-
with:
14-
go-version: ${{ matrix.go-version }}
15-
- name: Checkout code
16-
uses: actions/checkout@v4
17-
- name: Allow unprivileged ICMP (Linux)
18-
if: runner.os == 'Linux'
19-
run: sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
20-
- name: Test
21-
run: make test
16+
- name: Checkout code
17+
uses: actions/checkout@v6
18+
19+
- name: Install Go
20+
uses: actions/setup-go@v6
21+
with:
22+
go-version-file: go.mod
23+
24+
- name: Allow unprivileged ICMP (Linux)
25+
if: runner.os == 'Linux'
26+
run: sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"
27+
28+
- name: Test
29+
run: make test

‎.github/workflows/codeql.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [master, feat/h2c-origin]
6+
pull_request:
7+
branches: [master, feat/h2c-origin]
8+
schedule:
9+
- cron: "30 5 * * 1"
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
15+
jobs:
16+
analyze:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v6
21+
22+
- name: Initialize CodeQL
23+
uses: github/codeql-action/init@v4
24+
with:
25+
languages: go
26+
27+
- name: Autobuild
28+
uses: github/codeql-action/autobuild@v4
29+
30+
- name: Perform CodeQL analysis
31+
uses: github/codeql-action/analyze@v4

‎.github/workflows/docker-publish.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Docker publish
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*-h2c*"
7+
workflow_dispatch:
8+
9+
permissions:
10+
packages: write
11+
contents: read
12+
13+
env:
14+
REGISTRY: ghcr.io
15+
IMAGE_NAME: inherent-design/cloudflared
16+
17+
jobs:
18+
build-and-push:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v6
23+
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v3
26+
27+
- name: Log in to GHCR
28+
uses: docker/login-action@v3
29+
with:
30+
registry: ${{ env.REGISTRY }}
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract metadata
35+
id: meta
36+
uses: docker/metadata-action@v5
37+
with:
38+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=semver,pattern={{version}}
41+
type=raw,value=latest-h2c
42+
43+
- name: Build and push
44+
uses: docker/build-push-action@v6
45+
with:
46+
context: .
47+
push: true
48+
platforms: linux/amd64
49+
tags: ${{ steps.meta.outputs.tags }}
50+
labels: ${{ steps.meta.outputs.labels }}
51+
cache-from: type=gha
52+
cache-to: type=gha,mode=max
53+
54+
- name: Trivy scan
55+
uses: aquasecurity/trivy-action@0.34.0
56+
with:
57+
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest-h2c
58+
format: table
59+
exit-code: "1"
60+
severity: CRITICAL,HIGH

‎.github/workflows/semgrep.yml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/workflows/sync-upstream.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Sync upstream
2+
3+
on:
4+
schedule:
5+
- cron: "0 6 * * 1" # Monday 6am UTC
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
12+
jobs:
13+
sync:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v6
18+
with:
19+
fetch-depth: 0
20+
token: ${{ secrets.GITHUB_TOKEN }}
21+
22+
- name: Configure git
23+
run: |
24+
git config user.name "github-actions[bot]"
25+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
26+
27+
- name: Add upstream remote
28+
run: git remote add upstream https://github.com/cloudflare/cloudflared.git || true
29+
30+
- name: Fetch upstream
31+
run: git fetch upstream master
32+
33+
- name: Fast-forward master
34+
run: |
35+
git checkout master
36+
git merge --ff-only upstream/master
37+
git push origin master
38+
39+
- name: Rebase feature branch
40+
id: rebase
41+
continue-on-error: true
42+
run: |
43+
git checkout feat/h2c-origin
44+
git rebase master
45+
git push --force-with-lease origin feat/h2c-origin
46+
47+
- name: Open issue on conflict
48+
if: steps.rebase.outcome == 'failure'
49+
uses: actions/github-script@v8
50+
with:
51+
script: |
52+
const existing = await github.rest.issues.listForRepo({
53+
owner: context.repo.owner,
54+
repo: context.repo.repo,
55+
state: 'open',
56+
labels: 'upstream-conflict',
57+
});
58+
if (existing.data.length === 0) {
59+
await github.rest.issues.create({
60+
owner: context.repo.owner,
61+
repo: context.repo.repo,
62+
title: 'Upstream sync conflict on feat/h2c-origin',
63+
body: `The automatic rebase of \`feat/h2c-origin\` onto \`master\` failed.\n\nPlease resolve the conflict manually:\n\`\`\`bash\ngit fetch origin\ngit checkout feat/h2c-origin\ngit rebase origin/master\n# resolve conflicts\ngit push --force-with-lease origin feat/h2c-origin\n\`\`\`\n\nRun: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
64+
labels: ['upstream-conflict'],
65+
});
66+
}

0 commit comments

Comments
 (0)