Skip to content

赵月辉 / fastgpt-migrated

Go to a project
Commit ff92dced by Finley Ge Committed by GitHub
Options

chore: security update (#4447)

parent 7a074794
Showing with 65 additions and 78 deletions
.github/gh-bot.yml deleted 100644 → 0
version: v1
debug: true
action:
printConfig: false
release:
retry: 15s
actionName: Release
allowOps:
- cuisongliu
bot:
prefix: /
spe: _
allowOps:
- sealos-ci-robot
- sealos-release-robot
email: sealos-ci-robot@sealos.io
username: sealos-ci-robot
repo:
org: false
message:
success: |
🤖 says: Hooray! The action {{.Body}} has been completed successfully. 🎉
format_error: |
🤖 says: ‼️ There is a formatting issue with the action, kindly verify the action's format.
permission_error: |
🤖 says: ‼️ The action doesn't have permission to trigger.
release_error: |
🤖 says: ‼️ Release action failed.
Error details: {{.Error}}
.github/workflows/docs-preview.yml
name: Preview FastGPT docs name: Preview FastGPT docs
on: on:
pull_request_target: pull_request:
paths: paths:
- 'docSite/**' - 'docSite/**'
workflow_dispatch: workflow_dispatch:
...@@ -72,6 +72,8 @@ jobs: ...@@ -72,6 +72,8 @@ jobs:
alias-domains: | #Optional alias-domains: | #Optional
fastgpt-staging.vercel.app fastgpt-staging.vercel.app
docsOutput: docsOutput:
permissions:
pull-requests: write
needs: [deploy-preview] needs: [deploy-preview]
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
...@@ -79,18 +81,13 @@ jobs: ...@@ -79,18 +81,13 @@ jobs:
with: with:
ref: ${{ github.event.pull_request.head.ref }} ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }} repository: ${{ github.event.pull_request.head.repo.full_name }}
- name: Write md - uses: actions/github-script@v7
run: |
echo "# 🤖 Generated by deploy action" > report.md
echo "[👀 Visit Preview](${{ needs.deploy-preview.outputs.url }})" >> report.md
cat report.md
- name: Gh Rebot for Sealos
uses: labring/gh-rebot@v0.0.6
if: ${{ (github.event_name == 'pull_request_target') }}
with: with:
version: v0.0.6 github-token: ${{secrets.GITHUB_TOKEN}}
env: script: |
GH_TOKEN: '${{ secrets.GH_PAT }}' github.rest.issues.createComment({
SEALOS_TYPE: 'pr_comment' issue_number: context.issue.number,
SEALOS_FILENAME: 'report.md' owner: context.repo.owner,
SEALOS_REPLACE_TAG: 'DEFAULT_REPLACE_DEPLOY' repo: context.repo.repo,
body: '[👀 Visit Preview](${{ needs.deploy-preview.outputs.url }})'
})
.github/workflows/docs-sync_imgs.yml
name: Sync images name: Sync images
on: on:
pull_request_target: pull_request:
branches: branches:
- main - main
paths: paths:
...@@ -17,13 +17,6 @@ jobs: ...@@ -17,13 +17,6 @@ jobs:
steps: steps:
- name: Checkout - name: Checkout
uses: actions/checkout@v3 uses: actions/checkout@v3
if: ${{ (github.event_name == 'pull_request_target') }}
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
- name: Checkout
uses: actions/checkout@v3
- name: Run GitHub File Sync - name: Run GitHub File Sync
uses: BetaHuhn/repo-file-sync-action@v1.21.0 uses: BetaHuhn/repo-file-sync-action@v1.21.0
...@@ -32,4 +25,4 @@ jobs: ...@@ -32,4 +25,4 @@ jobs:
CONFIG_PATH: .github/sync_imgs.yml CONFIG_PATH: .github/sync_imgs.yml
ORIGINAL_MESSAGE: true ORIGINAL_MESSAGE: true
SKIP_PR: true SKIP_PR: true
COMMIT_EACH_FILE: false COMMIT_EACH_FILE: false
\ No newline at end of file
.github/workflows/fastgpt-build-image-personal.yml
...@@ -9,6 +9,11 @@ on: ...@@ -9,6 +9,11 @@ on:
- 'main' - 'main'
jobs: jobs:
build-fastgpt-images: build-fastgpt-images:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
if: github.repository != 'labring/FastGPT' if: github.repository != 'labring/FastGPT'
steps: steps:
...@@ -32,7 +37,7 @@ jobs: ...@@ -32,7 +37,7 @@ jobs:
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.repository_owner }} username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }} password: ${{ secret.GITHUB_TOKEN }}
- name: Set DOCKER_REPO_TAGGED based on branch or tag - name: Set DOCKER_REPO_TAGGED based on branch or tag
run: | run: |
echo "DOCKER_REPO_TAGGED=ghcr.io/${{ github.repository_owner }}/fastgpt:latest" >> $GITHUB_ENV echo "DOCKER_REPO_TAGGED=ghcr.io/${{ github.repository_owner }}/fastgpt:latest" >> $GITHUB_ENV
......
.github/workflows/fastgpt-build-image.yml
...@@ -9,6 +9,11 @@ on: ...@@ -9,6 +9,11 @@ on:
- 'v*' - 'v*'
jobs: jobs:
build-fastgpt-images: build-fastgpt-images:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
# install env # install env
...@@ -39,7 +44,7 @@ jobs: ...@@ -39,7 +44,7 @@ jobs:
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.repository_owner }} username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }} password: ${{ secret.GITHUB_TOKEN }}
- name: Login to Ali Hub - name: Login to Ali Hub
uses: docker/login-action@v2 uses: docker/login-action@v2
with: with:
...@@ -91,6 +96,11 @@ jobs: ...@@ -91,6 +96,11 @@ jobs:
-t ${Docker_Hub_Latest} \ -t ${Docker_Hub_Latest} \
. .
build-fastgpt-images-sub-route: build-fastgpt-images-sub-route:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
# install env # install env
...@@ -121,7 +131,7 @@ jobs: ...@@ -121,7 +131,7 @@ jobs:
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.repository_owner }} username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }} password: ${{ secret.GITHUB_TOKEN }}
- name: Login to Ali Hub - name: Login to Ali Hub
uses: docker/login-action@v2 uses: docker/login-action@v2
with: with:
...@@ -174,6 +184,11 @@ jobs: ...@@ -174,6 +184,11 @@ jobs:
-t ${Docker_Hub_Latest} \ -t ${Docker_Hub_Latest} \
. .
build-fastgpt-images-sub-route-gchat: build-fastgpt-images-sub-route-gchat:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
# install env # install env
...@@ -204,7 +219,7 @@ jobs: ...@@ -204,7 +219,7 @@ jobs:
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.repository_owner }} username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }} password: ${{ secret.GITHUB_TOKEN }}
- name: Login to Ali Hub - name: Login to Ali Hub
uses: docker/login-action@v2 uses: docker/login-action@v2
with: with:
......
.github/workflows/fastgpt-preview-image.yml
name: Preview FastGPT images name: Preview FastGPT images
on: on:
pull_request_target: pull_request:
workflow_dispatch: workflow_dispatch:
jobs: jobs:
preview-fastgpt-images: preview-fastgpt-images:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
- name: Checkout - name: Checkout
...@@ -48,20 +53,13 @@ jobs: ...@@ -48,20 +53,13 @@ jobs:
--cache-to=type=local,dest=/tmp/.buildx-cache \ --cache-to=type=local,dest=/tmp/.buildx-cache \
-t ${DOCKER_REPO_TAGGED} \ -t ${DOCKER_REPO_TAGGED} \
. .
# Add write md step after build - uses: actions/github-script@v7
- name: Write md
run: |
echo "# 🤖 Generated by deploy action" > report.md
echo "📦 Preview Image: \`${DOCKER_REPO_TAGGED}\`" >> report.md
cat report.md
- name: Gh Rebot for Sealos
uses: labring/gh-rebot@v0.0.6
if: ${{ (github.event_name == 'pull_request_target') }}
with: with:
version: v0.0.6 github-token: ${{secrets.GITHUB_TOKEN}}
env: script: |
GH_TOKEN: '${{ secrets.GH_PAT }}' github.rest.issues.createComment({
SEALOS_TYPE: 'pr_comment' issue_number: context.issue.number,
SEALOS_FILENAME: 'report.md' owner: context.repo.owner,
SEALOS_REPLACE_TAG: 'DEFAULT_REPLACE_DEPLOY' repo: context.repo.repo,
body: 'Preview Image: ${{ env.DOCKER_REPO_TAGGED }}'
})
.github/workflows/helm-release.yaml
...@@ -8,6 +8,11 @@ on: ...@@ -8,6 +8,11 @@ on:
jobs: jobs:
helm: helm:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
- name: Checkout - name: Checkout
...@@ -20,7 +25,7 @@ jobs: ...@@ -20,7 +25,7 @@ jobs:
run: echo "tag=$(git describe --tags)" >> $GITHUB_OUTPUT run: echo "tag=$(git describe --tags)" >> $GITHUB_OUTPUT
- name: Release Helm - name: Release Helm
run: | run: |
echo ${{ secrets.GH_PAT }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin
export APP_VERSION=${{ steps.vars.outputs.tag }} export APP_VERSION=${{ steps.vars.outputs.tag }}
export HELM_VERSION=${{ steps.vars.outputs.tag }} export HELM_VERSION=${{ steps.vars.outputs.tag }}
export HELM_REPO=ghcr.io/${{ github.repository_owner }} export HELM_REPO=ghcr.io/${{ github.repository_owner }}
......
.github/workflows/sandbox-build-image.yml
...@@ -8,6 +8,11 @@ on: ...@@ -8,6 +8,11 @@ on:
- 'v*' - 'v*'
jobs: jobs:
build-fastgpt-sandbox-images: build-fastgpt-sandbox-images:
permissions:
packages: write
contents: read
attestations: write
id-token: write
runs-on: ubuntu-20.04 runs-on: ubuntu-20.04
steps: steps:
# install env # install env
...@@ -38,7 +43,7 @@ jobs: ...@@ -38,7 +43,7 @@ jobs:
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.repository_owner }} username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }} password: ${{ secrets.GITHUB_TOKEN }}
- name: Login to Ali Hub - name: Login to Ali Hub
uses: docker/login-action@v2 uses: docker/login-action@v2
with: with:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or sign in to comment