build: harden CI, split docker workflow, update dependencies#72
Merged
build: harden CI, split docker workflow, update dependencies#72
Conversation
- Split docker build into separate workflow with workflow_run trigger - Harden against CI injection: env-var indirection for all expressions in run blocks, event=='push' guard on workflow_run trigger - Replace unmaintained wbari/start-mongoDB action with native service container - Update action versions: login v3→v4, build-push v6→v7, upload-artifact v4→v7, download-artifact v4→v8 - Fix dependabot gomod directory /backend → / (post structure flatten) - Update all Go dependencies, removing vulnerable otel/sdk (CVE-2026-24051) - Apply go fix: use builtin min(), range-over-int loops
paskal
force-pushed
the
worktree-ci-hardening
branch
from
6a92058 to
f214eb6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
docker.yml) withworkflow_runtrigger, decoupling it from CI${{ }}expressions inrun:blocks,event == 'push'guard onworkflow_runtriggerwbari/start-mongoDBaction with native service containerdocker/login-actionv3→v4,docker/build-push-actionv6→v7,actions/upload-artifactv4→v7,actions/download-artifactv4→v8/backend→/(broken since project structure flatten)go.opentelemetry.io/otel/sdk(CVE-2026-24051)go fix: use builtinmin(), range-over-int loops