Skip to content
Integrate

Fix loading photos on paginated #12885

Sign in to view logs

Fix loading photos on paginated

Fix loading photos on paginated #12885

Workflow file for this run

.github/workflows/CICD.yml at 236edc8
name: Integrate
# Run this workflow every time a new commit pushed to your repository
on:
push:
branches:
- master
tags:
- '*'
paths-ignore:
- '**/*.md'
- 'public/dist/*.js'
- 'public/dist/**/*.js'
pull_request:
paths-ignore:
- '**/*.md'
- 'public/dist/*.js'
- 'public/dist/**/*.js'
# Allow manually triggering the workflow.
workflow_dispatch:
# Declare default permissions as read only.
permissions: read-all
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ !contains(github.ref, 'master') && !startsWith(github.ref, 'refs/tags/') }} # Only cancel previous runs on non-master/non-tag branches.
jobs:
php_syntax_errors:
name: 0️⃣ PHP 8.4 - Syntax errors
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Setup PHP Action
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
php-version: 8.4
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies
uses: ramsey/composer-install@a35c6ebd3d08125aaf8852dff361e686a1a67947 # 3.2.0
- name: Check source code for syntax errors
run: vendor/bin/parallel-lint --exclude .git --exclude vendor .
check_js:
name: 0️⃣ JS front-end
uses: ./.github/workflows/js_check.yml
code_style_errors:
name: 1️⃣ PHP 8.4 - Code Style errors
runs-on: ubuntu-latest
needs:
- php_syntax_errors
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Set up PHP
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
php-version: 8.4
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install dependencies
uses: ramsey/composer-install@a35c6ebd3d08125aaf8852dff361e686a1a67947 # 3.2.0
- name: Check source code for code style errors
run: vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.php --verbose --diff --dry-run
phpstan:
name: 1️⃣ PHP 8.4 - PHPStan
runs-on: ubuntu-latest
needs:
- php_syntax_errors
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup PHP
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
php-version: 8.4
coverage: none
- name: Install Composer dependencies
uses: ramsey/composer-install@a35c6ebd3d08125aaf8852dff361e686a1a67947 # 3.2.0
- name: Run PHPStan
run: vendor/bin/phpstan analyze
license:
name: 1️⃣ PHP 8.4 - License Check
runs-on: ubuntu-latest
needs:
- php_syntax_errors
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup PHP
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
php-version: 8.4
coverage: none
- name: Install Composer dependencies
uses: ramsey/composer-install@a35c6ebd3d08125aaf8852dff361e686a1a67947 # 3.2.0
# We ban GPL-2.0-or-later, we don't want that viral thing in Lychee: We want to keep our MIT license.
- name: Run License Checker
run: vendor/bin/composer-license-checker check -b GPL-2.0-or-later -b GPL-2.0-only -b GPL-3.0-only -b GPL-3.0-or-later -b AGPL-1.0-only -b AGPL-1.0-or-later -b AGPL-3.0-only -b AGPL-3.0-or-later -b LGPL-2.0-only -b LGPL-2.0-or-later -b LGPL-2.1-only -b LGPL-2.1-or-later -b LGPL-3.0-only -b LGPL-3.0-or-later --no-dev
tests:
name: 1️⃣ PHP tests
needs:
- php_syntax_errors
uses: ./.github/workflows/php_tests.yml
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
dist:
name: 2️⃣ PHP dist
needs:
- code_style_errors
uses: ./.github/workflows/php_dist.yml
docker_check:
name: 3️⃣ Dockerfile Lint
runs-on: ubuntu-latest
needs:
- phpstan
- check_js
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
- name: Docker Lint
uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
with:
dockerfile: ./Dockerfile
failure-threshold: warning
- name: Build Docker image locally
run: docker build -t lychee:local .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
image-ref: lychee:local
format: 'table'
exit-code: 1
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
docker_build:
name: 4️⃣ Build Docker Image
runs-on: ubuntu-latest
if: >
(github.ref == 'refs/heads/master' && github.event_name == 'push') ||
(startsWith(github.ref, 'refs/tags/') && github.event_name == 'push') ||
(github.event_name == 'workflow_dispatch')
needs:
- docker_check
permissions:
contents: read
packages: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
- name: Log in to GitHub Container Registry
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Login to DockerHub
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: |
${{ github.repository }}
ghcr.io/${{ github.repository }}
flavor: |
latest=${{ startsWith(github.ref, 'refs/tags/') }}
tags: |
# define default branch
type=edge,branch=master
# branch event
type=ref,event=branch
# tag event
type=ref,event=tag
- name: Build and push Docker image
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
with:
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha,scope=image-frankenphp
cache-to: type=gha,scope=image-frankenphp,mode=max
build-args: |
NODE_ENV=production
docker_legacy_check:
name: 3️⃣ Legacy Dockerfile Lint
runs-on: ubuntu-latest
needs:
- phpstan
- check_js
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
- name: Docker Lint
uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
with:
dockerfile: ./Dockerfile-legacy
failure-threshold: warning
- name: Build Docker image locally
run: docker build -f Dockerfile-legacy -t lychee:local-legacy .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
image-ref: lychee:local-legacy
format: 'table'
exit-code: 1
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
docker_legacy_build:
name: 4️⃣ Build Legacy Docker Image
runs-on: ubuntu-latest
if: >
(github.ref == 'refs/heads/master' && github.event_name == 'push') ||
(startsWith(github.ref, 'refs/tags/') && github.event_name == 'push') ||
(github.event_name == 'workflow_dispatch')
needs:
- docker_legacy_check
permissions:
contents: read
packages: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
- name: Log in to GitHub Container Registry
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Login to DockerHub
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: |
${{ github.repository }}
ghcr.io/${{ github.repository }}
flavor: |
latest=${{ startsWith(github.ref, 'refs/tags/') }}
suffix=-legacy,onlatest=true
tags: |
# define default branch
type=edge,branch=master
# branch event
type=ref,event=branch
# tag event
type=ref,event=tag
- name: Build and push Docker image
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
with:
push: true
file: Dockerfile-legacy
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha,scope=image-legacy
cache-to: type=gha,scope=image-legacy,mode=max
build-args: |
NODE_ENV=production
createArtifact:
name: 3️⃣ Build Artifact
if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
needs:
- phpstan
- dist
- tests
- check_js
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
attestations: write
env:
extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_sqlite, pdo_mysql, pdo_pgsql, pgsql, sqlite3, zip
steps:
- name: Harden Runner
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup PHP
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
with:
php-version: 8.4
extensions: ${{ env.extensions }}
coverage: none
- name: Use Node.js 20
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: 20
- name: Build Dist
run: |
make clean dist
- name: Upload build artifact
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: Lychee.zip
path: Lychee.zip
if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
- name: Attest
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
with:
# Path to the artifact serving as the subject of the attestation. Must
# specify exactly one of "subject-path" or "subject-digest". May contain a
# glob pattern or list of paths (total subject count cannot exceed 2500).
subject-path: '${{ github.workspace }}/Lychee.zip'
# SHA256 digest of the subject for the attestation. Must be in the form
# "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
# of "subject-path" or "subject-digest".
# subject-digest:
# Subject name as it should appear in the attestation. Required unless
# "subject-path" is specified, in which case it will be inferred from the
# path.
# subject-name: Lychee
# Whether to push the attestation to the image registry. Requires that the
# "subject-name" parameter specify the fully-qualified image name and that
# the "subject-digest" parameter be specified. Defaults to false.
# push-to-registry:
# Whether to attach a list of generated attestations to the workflow run
# summary page. Defaults to true.
# show-summary:
# The GitHub token used to make authenticated API requests. Default is
# ${{ github.token }}
github-token: ${{ github.token }}
release:
name: 4️⃣ Release
if: startsWith(github.ref, 'refs/tags/')
needs:
- createArtifact
runs-on: ubuntu-latest
permissions:
contents: write
id-token: write
env:
extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_sqlite, pdo_mysql, pdo_pgsql, pgsql, sqlite3, zip
steps:
- name: Install Cosign
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
- name: Download generated artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: Lychee.zip
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
- name: Sign release with a key
run: |
cosign sign-blob --yes --key env://COSIGN_PRIVATE_KEY --bundle Lychee.zip.sigstore.json Lychee.zip
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
- name: Create release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
with:
files: |
Lychee.zip.sigstore.json
Lychee.zip
token: ${{ secrets.GITHUB_TOKEN }}
generate_release_notes: true
make_latest: true