git-echo/linux_patch_manager
Private
Public Access
1
0
Fork 0
Code Releases 8 Wiki Activity

ci: adapt CI to ubuntu-22.04 runner with proven linux_patch_api patterns
Some checks failed
CI Pipeline / Rust Format Check (push) Failing after 0s
Details
CI Pipeline / Clippy Lints (push) Failing after 11s
Details
CI Pipeline / Rust Unit Tests (push) Failing after 1s
Details
CI Pipeline / Security Audit (push) Failing after 0s
Details
CI Pipeline / Frontend Lint & Type Check (push) Failing after 2s
Details
CI Pipeline / Build .deb & Release (push) Has been skipped
Details

Browse Source 
- Pin all jobs to ubuntu-22.04 runner
- Use curl -sfL with secrets.GITEATOKEN for checkout
- Switch checkout URL to https://gitea-lxc.moon-dragon.us
- Install rustup with --default-toolchain stable --profile minimal
- Add cargo bin to GITHUB_PATH instead of sourcing per-step
- Enforce clippy -D warnings
- Ignore RUSTSEC-2025-0134 in cargo audit
- Pass GITEA_TOKEN via env for release step
This commit is contained in:
Echo
2026-04-27 02:43:46 +00:00
parent bcb93c1d2d
commit f8bac85903
5 changed files with 425 additions and 229 deletions
Download Patch File Download Diff File Expand all files Collapse all files

208
.gitea/workflows/ci.yml
View File

@ -1,6 +1,6 @@
name: CI Pipeline
on:
"on":
push:
branches: [master]
tags: ["v*"]
@ -12,42 +12,23 @@ env:
RUST_BACKTRACE: 1
jobs:
# ─── Quality Gates (run on every push/PR/tag) ───
rust-format:
name: Rust Format Check
runs-on: ubuntu-22.04
steps:
- name: Install checkout dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends curl ca-certificates
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
- name: Ensure Rust toolchain
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Rust
run: |
if ! command -v cargo &>/dev/null; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"
fi
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
. "$HOME/.cargo/env"
rustup component add rustfmt
echo "Rust: $(cargo --version)"
echo "Rustfmt: $(rustfmt --version)"
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
- name: Check formatting
run: |
. "$HOME/.cargo/env"
cargo fmt --check --all 2>&1
run: cargo fmt --all -- --check
clippy:
name: Clippy Lints
@ -55,33 +36,21 @@ jobs:
steps:
- name: Install system dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends curl ca-certificates pkg-config libssl-dev
sudo apt-get update -qq
sudo apt-get install -y --no-install-recommends curl ca-certificates build-essential pkg-config libssl-dev
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
- name: Ensure Rust toolchain
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Rust
run: |
if ! command -v cargo &>/dev/null; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"
fi
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
. "$HOME/.cargo/env"
rustup component add clippy
echo "Rust: $(cargo --version)"
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
- name: Run Clippy
run: |
. "$HOME/.cargo/env"
cargo clippy --all-targets --all-features 2>&1
run: cargo clippy --all-targets --all-features -- -D warnings
rust-test:
name: Rust Unit Tests
@ -89,70 +58,39 @@ jobs:
steps:
- name: Install system dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends curl ca-certificates pkg-config libssl-dev
sudo apt-get update -qq
sudo apt-get install -y --no-install-recommends curl ca-certificates build-essential pkg-config libssl-dev
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
- name: Ensure Rust toolchain
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Rust
run: |
if ! command -v cargo &>/dev/null; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"
fi
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
. "$HOME/.cargo/env"
echo "Rust: $(cargo --version)"
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
- name: Run tests
run: |
. "$HOME/.cargo/env"
cargo test --workspace --all-features 2>&1
run: cargo test --workspace --all-features
security-audit:
name: Security Audit
runs-on: ubuntu-22.04
steps:
- name: Install checkout dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends curl ca-certificates
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
- name: Ensure Rust toolchain
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Rust
run: |
if ! command -v cargo &>/dev/null; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"
fi
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
. "$HOME/.cargo/env"
echo "Rust: $(cargo --version)"
- name: Install cargo-audit
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
- name: Run cargo-audit
run: |
. "$HOME/.cargo/env"
cargo install cargo-audit 2>&1
- name: Run security audit
run: |
. "$HOME/.cargo/env"
cargo audit 2>&1
cargo install cargo-audit
cargo audit --ignore RUSTSEC-2025-0134
frontend-lint:
name: Frontend Lint & Type Check
@ -160,32 +98,22 @@ jobs:
steps:
- name: Install checkout dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends curl ca-certificates nodejs npm
sudo apt-get update -qq
sudo apt-get install -y --no-install-recommends curl ca-certificates nodejs npm
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Node.js dependencies
working-directory: frontend
run: npm ci
- name: Run ESLint
working-directory: frontend
run: npx eslint src/ --ext .ts,.tsx --max-warnings 0 2>&1
run: npx eslint src/ --ext .ts,.tsx --max-warnings 0
- name: TypeScript type check
working-directory: frontend
run: npx tsc --noEmit 2>&1
# ─── Build & Release (only on tag pushes, gated by quality checks) ───
run: npx tsc --noEmit
build-and-release:
name: Build .deb & Release
@ -195,68 +123,48 @@ jobs:
steps:
- name: Install system dependencies
run: |
apt-get update -qq
apt-get install -y --no-install-recommends \
curl ca-certificates pkg-config libssl-dev \
sudo apt-get update -qq
sudo apt-get install -y --no-install-recommends \
curl ca-certificates build-essential pkg-config libssl-dev \
git nodejs npm dpkg-dev python3
- name: Checkout repository
run: |
TOKEN="${GITHUB_TOKEN:-$GITEA_TOKEN}"
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
curl -sf -H "Authorization: token ${TOKEN}" \
"http://192.168.2.189:3000/api/v1/repos/${REPO}/archive/${GITHUB_SHA}.tar.gz" \
-o repo.tar.gz
tar xzf repo.tar.gz --strip-components=1
rm repo.tar.gz
- name: Ensure Rust toolchain
curl -sfL -H "Authorization: token ${{ secrets.GITEATOKEN }}" "https://gitea-lxc.moon-dragon.us/echo/linux_patch_manager/archive/${GITHUB_SHA}.tar.gz" -o repo.tar.gz
tar -xzf repo.tar.gz --strip-components=1
rm -f repo.tar.gz
- name: Install Rust
run: |
if ! command -v cargo &>/dev/null; then
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"
fi
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
. "$HOME/.cargo/env"
echo "Rust: $(cargo --version)"
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
- name: Build Rust backend (release)
run: |
. "$HOME/.cargo/env"
cargo build --release 2>&1
run: cargo build --release
- name: Run Rust tests
run: |
. "$HOME/.cargo/env"
cargo test --workspace --all-features 2>&1
run: cargo test --workspace --all-features
- name: Strip binaries
run: |
strip target/release/pm-web target/release/pm-worker
- name: Build frontend
run: |
cd frontend && npm ci && npm run build
- name: Determine version
run: |
VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\(.*\)"/\1/')
echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
echo "Building version: ${VERSION}"
- name: Assemble .deb package
run: |
chmod +x scripts/build-package.sh
scripts/build-package.sh
- name: Verify package
run: |
ls -la target/package/*.deb
dpkg-deb -I target/package/linux-patch-manager_*.deb
- name: Create Gitea Release (tags only)
- name: Create Gitea Release
if: startsWith(github.ref, 'refs/tags/v')
env:
GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
run: |
. "$HOME/.cargo/env"
VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*=.*"\(.*\)"/\1/')
REPO="${GITHUB_REPOSITORY:-echo/linux_patch_manager}"
REF_NAME="${GITHUB_REF_NAME:-v${VERSION}}"
@ -266,5 +174,5 @@ jobs:
--tag "${REF_NAME}" \
--title "Release ${REF_NAME}" \
--asset "${DEB}" \
--token "${GITHUB_TOKEN:-$GITEA_TOKEN}" \
--gitea-url "http://192.168.2.189:3000"
--token "${GITEA_TOKEN}" \
--gitea-url "https://gitea-lxc.moon-dragon.us"