Harden live mail OAuth and immutable releases

2026-07-30 02:00:09 +02:00
parent 1397f085bd
commit 67be350283
23 changed files with 429 additions and 20 deletions
@@ -0,0 +1,47 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  verify-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify release
+        run: ./scripts/codex_verify.sh
+      - name: Build immutable image
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          registry="gitea.itworx.tech"
+          image="${registry}/jens/vacatureradar:${version}"
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
+          docker build --file Dockerfile.unraid \
+            --build-arg "VCS_REF=${GITHUB_SHA}" \
+            --build-arg "APP_VERSION=${version}" \
+            --tag "$image" .
+          docker push "$image"
+          docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
+          docker sbom "$image" --format spdx-json > sbom.spdx.json
+          cat > RELEASE_NOTES.md <<EOF
+          # VacatureRadar ${version}
+
+          Immutable release image built from commit ${GITHUB_SHA}.
+          The accompanying digest, SPDX SBOM and checksums are release evidence.
+          EOF
+          sha256sum image-digest.txt sbom.spdx.json RELEASE_NOTES.md > SHA256SUMS
+      - name: Publish release evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-evidence-${{ github.ref_name }}
+          path: |
+            image-digest.txt
+            sbom.spdx.json
+            SHA256SUMS
+            RELEASE_NOTES.md