-
Notifications
You must be signed in to change notification settings - Fork 5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci: docker testnet #58
Changes from all commits
9d06192
b74eb4e
59f98d5
45195d5
f4c615b
a4c7088
c8c0153
c6115f1
2255b9a
c804128
429a9a9
60e8caf
f551636
f2c4253
1921ad9
8f9f9fa
46271d9
5f09ad1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,46 @@ | ||
name: Build and Push Docker Image | ||
|
||
on: | ||
push: | ||
branches: | ||
- main | ||
|
||
jobs: | ||
build-and-push: | ||
runs-on: ubuntu-latest | ||
environment: 'Production - Testnet' | ||
|
||
steps: | ||
- name: Checkout code | ||
uses: actions/checkout@v4 | ||
|
||
- name: Set up Docker Buildx | ||
uses: docker/setup-buildx-action@v3 | ||
|
||
- name: Log in to Docker Hub | ||
uses: docker/login-action@v3 | ||
with: | ||
username: ${{ vars.DOCKERHUB_USERNAME }} | ||
password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
|
||
- name: Create .env file | ||
run: | | ||
touch .env | ||
echo "NEXT_PUBLIC_CHAIN=${{ vars.NEXT_PUBLIC_CHAIN }}" >> .env | ||
echo "NEXT_PUBLIC_CHAIN_ID=${{ vars.NEXT_PUBLIC_CHAIN_ID }}" >> .env | ||
echo "NEXT_PUBLIC_TESTNET_CHAIN_ID=${{ vars.NEXT_PUBLIC_TESTNET_CHAIN_ID }}" >> .env | ||
echo "NEXT_PUBLIC_MAINNET_RPC_URL=${{ vars.NEXT_PUBLIC_MAINNET_RPC_URL }}" >> .env | ||
echo "NEXT_PUBLIC_TESTNET_RPC_URL=${{ vars.NEXT_PUBLIC_TESTNET_RPC_URL }}" >> .env | ||
echo "NEXT_PUBLIC_MAINNET_API_URL=${{ vars.NEXT_PUBLIC_MAINNET_API_URL }}" >> .env | ||
echo "NEXT_PUBLIC_TESTNET_API_URL=${{ vars.NEXT_PUBLIC_TESTNET_API_URL }}" >> .env | ||
echo "NEXT_PUBLIC_ABLY_API_KEY=${{ secrets.NEXT_PUBLIC_ABLY_API_KEY }}" >> .env | ||
echo "NEXT_PUBLIC_WALLETCONNECT_KEY=${{ secrets.NEXT_PUBLIC_WALLETCONNECT_KEY }}" >> .env | ||
echo "NEXT_PUBLIC_WEB3_CLIENT_ID=${{ secrets.NEXT_PUBLIC_WEB3_CLIENT_ID }}" >> .env | ||
cat .env | ||
|
||
- name: Build and push Docker image | ||
uses: docker/build-push-action@v6 | ||
with: | ||
context: . | ||
push: true | ||
tags: lifted/manifest-app:testnet |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -26,9 +26,7 @@ yarn-error.log* | |
.pnpm-debug.log* | ||
|
||
# local env files | ||
.env*.local | ||
.env | ||
/.env | ||
.env* | ||
|
||
# vercel | ||
.vercel | ||
|
Original file line number | Diff line number | Diff line change | ||||||||
---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,71 @@ | ||||||||||
# syntax=docker.io/docker/dockerfile:1 | ||||||||||
|
||||||||||
FROM oven/bun:slim AS base | ||||||||||
|
||||||||||
# Install dependencies only when needed | ||||||||||
FROM base AS deps | ||||||||||
WORKDIR /app | ||||||||||
|
||||||||||
# Install dependencies based on the preferred package manager | ||||||||||
COPY package.json yarn.lock* package-lock.json* pnpm-lock.yaml* .npmrc* bun.lockb ./ | ||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security Concern: Avoid copying Copying Apply this diff to address the issue: -COPY package.json yarn.lock* package-lock.json* pnpm-lock.yaml* .npmrc* bun.lockb ./
+COPY package.json yarn.lock* package-lock.json* pnpm-lock.yaml* bun.lockb ./ 📝 Committable suggestion
Suggested change
|
||||||||||
RUN \ | ||||||||||
if [ -f yarn.lock ]; then yarn --frozen-lockfile; \ | ||||||||||
elif [ -f package-lock.json ]; then npm ci; \ | ||||||||||
elif [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm i --frozen-lockfile; \ | ||||||||||
elif [ -f bun.lockb ]; then bun install --no-save; \ | ||||||||||
else echo "Lockfile not found." && exit 1; \ | ||||||||||
fi | ||||||||||
|
||||||||||
|
||||||||||
# Rebuild the source code only when needed | ||||||||||
FROM base AS builder | ||||||||||
WORKDIR /app | ||||||||||
COPY --from=deps /app/node_modules ./node_modules | ||||||||||
COPY . . | ||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Prevent copying unnecessary or sensitive files into the image Using Create a
Alternatively, adjust the -COPY . .
+COPY pages ./pages
+COPY public ./public
+COPY components ./components
+COPY next.config.js ./
+COPY package.json ./
|
||||||||||
|
||||||||||
RUN \ | ||||||||||
if [ -f .env ]; then echo ".env file found, continuing..."; else echo ".env file not found, exiting..."; exit 1; fi | ||||||||||
Comment on lines
+26
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Avoid including Requiring and copying the Modify the Dockerfile to remove the dependency on the RUN \
- if [ -f .env ]; then echo ".env file found, continuing..."; else echo ".env file not found, exiting..."; exit 1; fi
+ echo "Starting the build process..."
# Remove the command that deletes the .env file since it won't be included
-RUN rm -rf .env Adjust your application configuration to use environment variables provided at runtime rather than relying on an 📝 Committable suggestion
Suggested change
|
||||||||||
|
||||||||||
# Next.js collects completely anonymous telemetry data about general usage. | ||||||||||
# Learn more here: https://nextjs.org/telemetry | ||||||||||
# Uncomment the following line in case you want to disable telemetry during the build. | ||||||||||
ENV NEXT_TELEMETRY_DISABLED=1 | ||||||||||
|
||||||||||
RUN \ | ||||||||||
if [ -f yarn.lock ]; then yarn run build; \ | ||||||||||
elif [ -f package-lock.json ]; then npm run build; \ | ||||||||||
elif [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm run build; \ | ||||||||||
elif [ -f bun.lockb ]; then bun run build; \ | ||||||||||
else echo "Lockfile not found." && exit 1; \ | ||||||||||
fi | ||||||||||
|
||||||||||
RUN rm -rf .env | ||||||||||
|
||||||||||
# Production image, copy all the files and run next | ||||||||||
FROM base AS runner | ||||||||||
WORKDIR /app | ||||||||||
|
||||||||||
ENV NODE_ENV=production | ||||||||||
# Uncomment the following line in case you want to disable telemetry during runtime. | ||||||||||
ENV NEXT_TELEMETRY_DISABLED=1 | ||||||||||
|
||||||||||
RUN addgroup --system --gid 1001 nodejs | ||||||||||
RUN adduser --system --uid 1001 nextjs | ||||||||||
|
||||||||||
COPY --from=builder /app/public ./public | ||||||||||
|
||||||||||
# Automatically leverage output traces to reduce image size | ||||||||||
# https://nextjs.org/docs/advanced-features/output-file-tracing | ||||||||||
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./ | ||||||||||
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static | ||||||||||
|
||||||||||
USER nextjs | ||||||||||
|
||||||||||
EXPOSE 3000 | ||||||||||
|
||||||||||
ENV PORT=3000 | ||||||||||
|
||||||||||
# server.js is created by next build from the standalone output | ||||||||||
# https://nextjs.org/docs/pages/api-reference/next-config-js/output | ||||||||||
ENV HOSTNAME="0.0.0.0" | ||||||||||
CMD ["node", "server.js"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion
Remove sensitive environment file logging
The
cat .env
command will expose secrets in the workflow logs. This is a security risk.- cat .env
Improve environment file creation
The current implementation has several areas for improvement:
📝 Committable suggestion
🧰 Tools
🪛 actionlint
27-27: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects
(shellcheck)