Skip to content

Commit c28908f

Browse files
mingchengmingcheng
committed
ci: enhance Docker and Rust CI workflows
- update ghcr.yml to support multi-platform builds and add SBOM generation - improve rust.yml with linting, security audit, and toolchain matrix testing - add caching for faster builds and artifact attestations - expand triggers for feature branches and semantic versioning tags - optimize workflow steps for better error handling and performance Signed-off-by: mingcheng <[email protected]>
1 parent 05a6b3e commit c28908f

File tree

5 files changed

+282
-54
lines changed

5 files changed

+282
-54
lines changed

‎.dockerignore‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,6 @@ docker-compose*
1313
# Documentation
1414
/docs
1515

16-
# Project build files
17-
Cargo.lock
18-
**/.cargo-ok
19-
2016
# Test artifacts
2117
**/*test-*
2218
**/*Test*

‎.github/workflows/ghcr.yml‎

Lines changed: 72 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
1-
name: Create and publish a Docker image
1+
name: Build and Publish Docker Image
22

33
on:
44
push:
55
branches:
66
- main
7+
- develop
78
tags:
8-
- "v*"
9+
- "v*.*.*" # Semantic versioning tags (v1.0.0, v1.2.3, etc.)
10+
pull_request:
11+
branches:
12+
- main
913
workflow_dispatch:
1014

1115
env:
@@ -14,6 +18,7 @@ env:
1418

1519
jobs:
1620
build-and-push-image:
21+
name: Build & Push Docker Image
1722
runs-on: ubuntu-latest
1823
permissions:
1924
contents: read
@@ -23,34 +28,90 @@ jobs:
2328
steps:
2429
- name: Checkout repository
2530
uses: actions/checkout@v4
26-
- name: Log in to the Container registry
31+
32+
- name: Set up QEMU
33+
uses: docker/setup-qemu-action@v3
34+
35+
- name: Set up Docker Buildx
36+
uses: docker/setup-buildx-action@v3
37+
with:
38+
driver-opts: |
39+
image=moby/buildkit:latest
40+
network=host
41+
42+
- name: Log in to GitHub Container Registry
2743
uses: docker/login-action@v3
2844
with:
2945
registry: ${{ env.REGISTRY }}
3046
username: ${{ github.actor }}
3147
password: ${{ secrets.GITHUB_TOKEN }}
48+
3249
- name: Extract metadata (tags, labels) for Docker
3350
id: meta
3451
uses: docker/metadata-action@v5
3552
with:
3653
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
37-
- uses: benjlevesque/[email protected]
38-
id: short-sha
39-
with:
40-
length: 7
54+
tags: |
55+
# Tag with branch name for branch pushes
56+
type=ref,event=branch
57+
# Tag with PR number for pull requests
58+
type=ref,event=pr
59+
# Tag with git tag for version releases
60+
type=semver,pattern={{version}}
61+
type=semver,pattern={{major}}.{{minor}}
62+
type=semver,pattern={{major}}
63+
# Tag with short SHA
64+
type=sha,format=short
65+
# Tag latest only on main branch
66+
type=raw,value=latest,enable={{is_default_branch}}
67+
labels: |
68+
org.opencontainers.image.title=aigitcommit
69+
org.opencontainers.image.description=AI-powered Git commit message generator
70+
org.opencontainers.image.vendor=Hangzhou Guanwaii Technology Co,.Ltd.
71+
4172
- name: Build and push Docker image
4273
id: push
4374
uses: docker/build-push-action@v6
4475
with:
4576
context: .
77+
platforms: linux/amd64,linux/arm64
4678
push: ${{ github.event_name != 'pull_request' }}
47-
tags: |
48-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
49-
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.short-sha.outputs.sha }}
79+
tags: ${{ steps.meta.outputs.tags }}
5080
labels: ${{ steps.meta.outputs.labels }}
81+
cache-from: type=gha
82+
cache-to: type=gha,mode=max
83+
build-args: |
84+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
85+
VCS_REF=${{ github.sha }}
86+
VERSION=${{ steps.meta.outputs.version }}
87+
5188
- name: Generate artifact attestation
89+
if: github.event_name != 'pull_request'
5290
uses: actions/attest-build-provenance@v2
5391
with:
5492
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
5593
subject-digest: ${{ steps.push.outputs.digest }}
56-
push-to-registry: false
94+
push-to-registry: true
95+
96+
- name: Generate SBOM
97+
if: github.event_name != 'pull_request'
98+
uses: anchore/sbom-action@v0
99+
with:
100+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}
101+
format: spdx-json
102+
output-file: sbom.spdx.json
103+
104+
- name: Upload SBOM as artifact
105+
if: github.event_name != 'pull_request'
106+
uses: actions/upload-artifact@v4
107+
with:
108+
name: sbom-${{ github.sha }}
109+
path: sbom.spdx.json
110+
retention-days: 90
111+
112+
- name: Image digest
113+
if: github.event_name != 'pull_request'
114+
run: |
115+
echo "Image pushed successfully!"
116+
echo "Digest: ${{ steps.push.outputs.digest }}"
117+
echo "Tags: ${{ steps.meta.outputs.tags }}"

‎.github/workflows/rust.yml‎

Lines changed: 144 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,38 +5,170 @@
55
# which is located in the LICENSE file in the source tree's root directory.
66
#
77
# File: rust.yml
8-
# Author: mingcheng ([email protected])
8+
# Author: mingcheng <[email protected]>
99
# File Created: 2025-03-05 11:10:40
1010
#
11-
# Modified By: mingcheng ([email protected])
12-
# Last Modified: 2025-03-17 18:29:18
11+
# Modified By: mingcheng <[email protected]>
12+
# Last Modified: 2025-10-16 16:37:42
1313
##
1414

1515
name: Cargo Build & Test
1616

1717
on:
1818
push:
19+
branches:
20+
- main
21+
- master
22+
- develop
23+
- "feature/**"
1924
pull_request:
25+
branches:
26+
- main
27+
- master
28+
- develop
29+
workflow_dispatch:
2030

2131
env:
2232
CARGO_TERM_COLOR: always
33+
RUST_BACKTRACE: 1
2334

2435
jobs:
36+
# Code quality checks (clippy and rustfmt)
37+
lint:
38+
name: Lint (clippy & rustfmt)
39+
runs-on: ubuntu-latest
40+
steps:
41+
- name: Checkout code
42+
uses: actions/checkout@v4
43+
44+
- name: Setup Rust toolchain
45+
uses: dtolnay/rust-toolchain@stable
46+
with:
47+
components: clippy, rustfmt
48+
49+
- name: Cache cargo registry
50+
uses: actions/cache@v4
51+
with:
52+
path: |
53+
~/.cargo/bin/
54+
~/.cargo/registry/index/
55+
~/.cargo/registry/cache/
56+
~/.cargo/git/db/
57+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
58+
restore-keys: |
59+
${{ runner.os }}-cargo-
60+
61+
- name: Cache target directory
62+
uses: actions/cache@v4
63+
with:
64+
path: target
65+
key: ${{ runner.os }}-target-lint-${{ hashFiles('**/Cargo.lock') }}
66+
restore-keys: |
67+
${{ runner.os }}-target-lint-
68+
69+
- name: Run cargo fmt check
70+
run: cargo fmt --all -- --check
71+
72+
- name: Run cargo clippy
73+
run: cargo clippy --all-targets --all-features -- -D warnings
74+
75+
# Security audit
76+
security_audit:
77+
name: Security Audit
78+
runs-on: ubuntu-latest
79+
steps:
80+
- name: Checkout code
81+
uses: actions/checkout@v4
82+
83+
- name: Setup Rust toolchain
84+
uses: dtolnay/rust-toolchain@stable
85+
86+
- name: Install cargo-audit
87+
run: cargo install cargo-audit --locked
88+
89+
- name: Run cargo audit
90+
run: cargo audit
91+
92+
# Build and test on stable/beta/nightly
2593
build_and_test:
26-
name: Rust project - latest
94+
name: Build & Test (${{ matrix.toolchain }})
2795
runs-on: ubuntu-latest
96+
needs: [lint]
2897
strategy:
98+
fail-fast: false
2999
matrix:
30100
toolchain:
31101
- stable
32102
- beta
33103
- nightly
104+
continue-on-error: ${{ matrix.toolchain == 'nightly' }}
34105
steps:
35-
- uses: actions/checkout@v4
36-
- run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}
37-
- run: rustup component add clippy --toolchain ${{ matrix.toolchain }}
38-
- run: rustup component add rustfmt --toolchain ${{ matrix.toolchain }}
39-
- run: cargo clippy -- -D warnings
40-
- run: cargo fmt --all -- --check
41-
- run: cargo build --verbose
42-
- run: cargo test --verbose
106+
- name: Checkout code
107+
uses: actions/checkout@v4
108+
109+
- name: Setup Rust toolchain (${{ matrix.toolchain }})
110+
uses: dtolnay/rust-toolchain@master
111+
with:
112+
toolchain: ${{ matrix.toolchain }}
113+
114+
- name: Cache cargo registry
115+
uses: actions/cache@v4
116+
with:
117+
path: |
118+
~/.cargo/bin/
119+
~/.cargo/registry/index/
120+
~/.cargo/registry/cache/
121+
~/.cargo/git/db/
122+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
123+
restore-keys: |
124+
${{ runner.os }}-cargo-
125+
126+
- name: Cache target directory
127+
uses: actions/cache@v4
128+
with:
129+
path: target
130+
key: ${{ runner.os }}-target-${{ matrix.toolchain }}-${{ hashFiles('**/Cargo.lock') }}
131+
restore-keys: |
132+
${{ runner.os }}-target-${{ matrix.toolchain }}-
133+
134+
- name: Show Rust version
135+
run: |
136+
rustc --version
137+
cargo --version
138+
139+
- name: Build project
140+
run: cargo build --verbose --all-features
141+
142+
- name: Run tests
143+
run: cargo test --verbose --all-features
144+
145+
- name: Build release
146+
run: cargo build --release --verbose
147+
148+
# Check documentation builds
149+
doc:
150+
name: Documentation
151+
runs-on: ubuntu-latest
152+
steps:
153+
- name: Checkout code
154+
uses: actions/checkout@v4
155+
156+
- name: Setup Rust toolchain
157+
uses: dtolnay/rust-toolchain@stable
158+
159+
- name: Cache cargo registry
160+
uses: actions/cache@v4
161+
with:
162+
path: |
163+
~/.cargo/bin/
164+
~/.cargo/registry/index/
165+
~/.cargo/registry/cache/
166+
~/.cargo/git/db/
167+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
168+
restore-keys: |
169+
${{ runner.os }}-cargo-
170+
171+
- name: Build documentation
172+
run: cargo doc --no-deps --all-features
173+
env:
174+
RUSTDOCFLAGS: -D warnings

0 commit comments

Comments
 (0)