From a5d4e0a5a3fe50097623211fd486715cec67684d Mon Sep 17 00:00:00 2001 From: PPawlowski Date: Tue, 23 Jun 2026 10:51:36 +0200 Subject: [PATCH 1/5] Introduce `Docker build` workflow --- .github/workflows/docker-build.yaml | 65 +++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 .github/workflows/docker-build.yaml diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml new file mode 100644 index 00000000..b41f4971 --- /dev/null +++ b/.github/workflows/docker-build.yaml @@ -0,0 +1,65 @@ +name: Docker build + +on: + pull_request: + paths: + - 'docker/**' + - '.github/workflows/docker-build.yaml' + +jobs: + docker-build: + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + security-events: write + strategy: + matrix: + include: + - node: 18 + platforms: linux/amd64,linux/arm64,linux/arm/v7 + - node: 20 + platforms: linux/amd64,linux/arm64,linux/arm/v7 + - node: 24 + platforms: linux/amd64,linux/arm64 + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up Docker + uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 #v4.7.0 + with: + daemon-config: | + { + "features": { + "containerd-snapshotter": true + } + } + + - name: Set up QEMU + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 + + - name: Build Docker image + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + with: + context: . + file: docker/Dockerfile + platforms: ${{ matrix.platforms }} + tags: flowfuse-device-agent-pr:${{ matrix.node }}-scan + push: false + load: true + build-args: | + NODE_VERSION=${{ matrix.node }} + + - name: Perform SAST scan + uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 + with: + image-ref: flowfuse-device-agent-pr:${{ matrix.node }}-scan + trivy-config: .github/trivy.yaml + version: 'v0.69.2' # https://github.com/aquasecurity/trivy-action/issues/512 + output: 'sast-results.sarif' + + - name: Upload scan results + uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0 + with: + sarif_file: sast-results.sarif From d93842c02221af931806072cba64227e8b87c37d Mon Sep 17 00:00:00 2001 From: PPawlowski Date: Tue, 23 Jun 2026 11:19:48 +0200 Subject: [PATCH 2/5] Build container with Node 22 --- .github/workflows/docker-build.yaml | 2 ++ .github/workflows/release-publish.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml index b41f4971..5b19a5eb 100644 --- a/.github/workflows/docker-build.yaml +++ b/.github/workflows/docker-build.yaml @@ -20,6 +20,8 @@ jobs: platforms: linux/amd64,linux/arm64,linux/arm/v7 - node: 20 platforms: linux/amd64,linux/arm64,linux/arm/v7 + - node: 22 + platforms: linux/amd64,linux/arm64,linux/arm/v7 - node: 24 platforms: linux/amd64,linux/arm64 steps: diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 3a382597..732487df 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -28,6 +28,8 @@ jobs: platforms: linux/amd64, linux/arm64, linux/arm/v7 - node: 20 platforms: linux/amd64, linux/arm64, linux/arm/v7 + - node: 22 + platforms: linux/amd64,linux/arm64,linux/arm/v7 - node: 24 platforms: linux/amd64, linux/arm64 steps: From ccfd3fcccd09b233501d93b0431af8ee09352f82 Mon Sep 17 00:00:00 2001 From: PPawlowski Date: Tue, 23 Jun 2026 11:20:59 +0200 Subject: [PATCH 3/5] Set container with node 22 as base for `latest` and `version` tags --- .github/workflows/release-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 732487df..50913bb8 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -40,9 +40,9 @@ jobs: uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 with: tags: | - type=semver,event=tag,pattern=v{{version}},enable=${{ matrix.node == 18}} + type=semver,event=tag,pattern=v{{version}},enable=${{ matrix.node == 22}} type=semver,event=tag,pattern=v{{version}}-${{ matrix.node }} - type=raw,value=latest,enable=${{ matrix.node == 18}} + type=raw,value=latest,enable=${{ matrix.node == 22}} type=raw,value=latest-${{matrix.node}} flavor: | latest=false From 2cf13271d6ce3ae3dcdca88f83dd4fbf297602bf Mon Sep 17 00:00:00 2001 From: PPawlowski Date: Tue, 23 Jun 2026 11:31:26 +0200 Subject: [PATCH 4/5] Usa latest GHActions versions --- .github/workflows/docker-build.yaml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml index b41f4971..6ba15344 100644 --- a/.github/workflows/docker-build.yaml +++ b/.github/workflows/docker-build.yaml @@ -24,10 +24,10 @@ jobs: platforms: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Docker - uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 #v4.7.0 + uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23 #v5.2.0 with: daemon-config: | { @@ -37,10 +37,10 @@ jobs: } - name: Set up QEMU - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 + uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Build Docker image - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 with: context: . file: docker/Dockerfile @@ -52,14 +52,13 @@ jobs: NODE_VERSION=${{ matrix.node }} - name: Perform SAST scan - uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: image-ref: flowfuse-device-agent-pr:${{ matrix.node }}-scan trivy-config: .github/trivy.yaml - version: 'v0.69.2' # https://github.com/aquasecurity/trivy-action/issues/512 output: 'sast-results.sarif' - name: Upload scan results - uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0 + uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: sarif_file: sast-results.sarif From b75b7b026f376d2895dbb1ca40110cd8be5cf6e8 Mon Sep 17 00:00:00 2001 From: PPawlowski Date: Tue, 23 Jun 2026 11:51:47 +0200 Subject: [PATCH 5/5] Set friendlier job name --- .github/workflows/docker-build.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml index 6ba15344..c02ad1dc 100644 --- a/.github/workflows/docker-build.yaml +++ b/.github/workflows/docker-build.yaml @@ -8,6 +8,7 @@ on: jobs: docker-build: + name: 'Build docker image: Node ${{ matrix.node }}' runs-on: ubuntu-latest timeout-minutes: 15 permissions: