mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
c9db917422
* build: enforce Docker image contract * fix: run Docker contract on durable storage * build: restore 200 MB image contract * build: complete container runtime contract * chore: refresh reviewed secret fingerprint * fix: unwrap Docker backup response * build: exclude generated Docker context * build: enforce platform image budgets * chore: align Docker docs leak baseline
50 lines
1.1 KiB
YAML
50 lines
1.1 KiB
YAML
name: Docker Image Contract
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- Dockerfile
|
|
- .dockerignore
|
|
- package.json
|
|
- pnpm-lock.yaml
|
|
- pnpm-workspace.yaml
|
|
- server/**
|
|
- shared/**
|
|
- web/**
|
|
- scripts/check-docker-image.mjs
|
|
- .github/workflows/docker-image.yml
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- Dockerfile
|
|
- .dockerignore
|
|
- package.json
|
|
- pnpm-lock.yaml
|
|
- pnpm-workspace.yaml
|
|
- server/**
|
|
- shared/**
|
|
- web/**
|
|
- scripts/check-docker-image.mjs
|
|
- .github/workflows/docker-image.yml
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: docker-image-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
contract:
|
|
name: Build, Size, and Runtime Contract
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Build production image
|
|
run: docker build --target production --tag veritas-kanban:contract .
|
|
|
|
- name: Enforce image and runtime contract
|
|
run: node scripts/check-docker-image.mjs veritas-kanban:contract
|