Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 0 additions & 141 deletions .github/workflows/docker-build.yml

This file was deleted.

46 changes: 46 additions & 0 deletions .github/workflows/docker-hub-user.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
name: Publish user Docker Hub image

on:
push:
branches:
- main
workflow_dispatch:
Comment on lines +4 to +7

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Align the pushed Docker image with the documented deployment image.

The repo docs and compose examples consume calciumion/new-api:latest, but this push-on-main workflow only publishes yeranshuanghua/shuanghua-api. Main builds will not update the image users are instructed to deploy; if this is only a personal mirror, make it manual/fork-scoped instead.

Proposed fix if this workflow is meant to publish the documented image
           username: yeranshuanghua
           password: ${{ secrets.DOCKER_HUB }}
@@
           tags: |
-            yeranshuanghua/shuanghua-api:latest
-            yeranshuanghua/shuanghua-api:${{ github.sha }}
+            calciumion/new-api:latest
+            calciumion/new-api:${{ github.sha }}

Also applies to: 29-44

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-hub-user.yml around lines 4 - 7, The Docker Hub
publish workflow is pushing the wrong image target for main branch builds.
Update the workflow in docker-hub-user to publish the documented deployment
image used by the repo docs and compose examples, and make sure the build/push
job in the workflow points to the same repository/name as the deployed image
rather than yeranshuanghua/shuanghua-api; if this workflow is intended only as a
personal mirror, remove the main branch push trigger and keep it manual or
fork-scoped. Also verify the related build/push steps later in the workflow stay
consistent with this image name.


jobs:
build:
name: Build and push
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: Check out
uses: actions/checkout@v4
Comment on lines +17 to +18

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials before building the Docker context.

actions/checkout persists the GitHub token by default, and this job does not need git credentials after checkout. Keep the token out of the workspace used for the Docker build.

Proposed fix
       - name: Check out
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Check out
uses: actions/checkout@v4
- name: Check out
uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 17-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-hub-user.yml around lines 17 - 18, The checkout
step in the docker-hub-user workflow is leaving GitHub credentials in the
workspace, which can get copied into the Docker build context. Update the
existing actions/checkout usage in the checkout step to disable persisted
credentials so no token remains after checkout, keeping the workspace clean
before the Docker build runs.

Source: Linters/SAST tools


- name: Write VERSION
run: echo "main-${GITHUB_SHA::7}" > VERSION

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to Docker Hub
uses: docker/login-action@v3
with:
username: yeranshuanghua
password: ${{ secrets.DOCKER_HUB }}

- name: Build and push
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
platforms: linux/amd64,linux/arm64
push: true
tags: |
yeranshuanghua/shuanghua-api:latest
yeranshuanghua/shuanghua-api:${{ github.sha }}
cache-from: type=gha
cache-to: type=gha,mode=max
170 changes: 0 additions & 170 deletions .github/workflows/docker-image-branch.yml

This file was deleted.

Loading