Darius Kazemi
3 years ago
38 changed files with 475 additions and 351 deletions
@ -1,211 +0,0 @@
|
||||
version: 2.1 |
||||
|
||||
orbs: |
||||
ruby: circleci/ruby@1.4.1 |
||||
node: circleci/node@5.0.1 |
||||
|
||||
executors: |
||||
default: |
||||
parameters: |
||||
ruby-version: |
||||
type: string |
||||
docker: |
||||
- image: cimg/ruby:<< parameters.ruby-version >> |
||||
environment: |
||||
BUNDLE_JOBS: 3 |
||||
BUNDLE_RETRY: 3 |
||||
CONTINUOUS_INTEGRATION: true |
||||
DB_HOST: localhost |
||||
DB_USER: root |
||||
DISABLE_SIMPLECOV: true |
||||
RAILS_ENV: test |
||||
- image: cimg/postgres:14.0 |
||||
environment: |
||||
POSTGRES_USER: root |
||||
POSTGRES_HOST_AUTH_METHOD: trust |
||||
- image: cimg/redis:6.2 |
||||
|
||||
commands: |
||||
install-system-dependencies: |
||||
steps: |
||||
- run: |
||||
name: Install system dependencies |
||||
command: | |
||||
sudo apt-get update |
||||
sudo apt-get install -y libicu-dev libidn11-dev |
||||
install-ruby-dependencies: |
||||
parameters: |
||||
ruby-version: |
||||
type: string |
||||
steps: |
||||
- run: |
||||
command: | |
||||
bundle config clean 'true' |
||||
bundle config frozen 'true' |
||||
bundle config without 'development production' |
||||
name: Set bundler settings |
||||
- ruby/install-deps: |
||||
bundler-version: '2.3.8' |
||||
key: ruby<< parameters.ruby-version >>-gems-v1 |
||||
wait-db: |
||||
steps: |
||||
- run: |
||||
command: dockerize -wait tcp://localhost:5432 -wait tcp://localhost:6379 -timeout 1m |
||||
name: Wait for PostgreSQL and Redis |
||||
|
||||
jobs: |
||||
build: |
||||
docker: |
||||
- image: cimg/ruby:3.0-node |
||||
environment: |
||||
RAILS_ENV: test |
||||
steps: |
||||
- checkout |
||||
- install-system-dependencies |
||||
- install-ruby-dependencies: |
||||
ruby-version: '3.0' |
||||
- node/install-packages: |
||||
cache-version: v1 |
||||
pkg-manager: yarn |
||||
- run: |
||||
command: | |
||||
export NODE_OPTIONS=--openssl-legacy-provider |
||||
./bin/rails assets:precompile |
||||
name: Precompile assets |
||||
- persist_to_workspace: |
||||
paths: |
||||
- public/assets |
||||
- public/packs-test |
||||
root: . |
||||
|
||||
test: |
||||
parameters: |
||||
ruby-version: |
||||
type: string |
||||
executor: |
||||
name: default |
||||
ruby-version: << parameters.ruby-version >> |
||||
environment: |
||||
ALLOW_NOPAM: true |
||||
PAM_ENABLED: true |
||||
PAM_DEFAULT_SERVICE: pam_test |
||||
PAM_CONTROLLED_SERVICE: pam_test_controlled |
||||
parallelism: 4 |
||||
steps: |
||||
- checkout |
||||
- install-system-dependencies |
||||
- run: |
||||
command: sudo apt-get install -y ffmpeg imagemagick libpam-dev |
||||
name: Install additional system dependencies |
||||
- run: |
||||
command: bundle config with 'pam_authentication' |
||||
name: Enable PAM authentication |
||||
- install-ruby-dependencies: |
||||
ruby-version: << parameters.ruby-version >> |
||||
- attach_workspace: |
||||
at: . |
||||
- wait-db |
||||
- run: |
||||
command: ./bin/rails db:create db:schema:load db:seed |
||||
name: Load database schema |
||||
- ruby/rspec-test |
||||
|
||||
test-migrations: |
||||
executor: |
||||
name: default |
||||
ruby-version: '3.0' |
||||
steps: |
||||
- checkout |
||||
- install-system-dependencies |
||||
- install-ruby-dependencies: |
||||
ruby-version: '3.0' |
||||
- wait-db |
||||
- run: |
||||
command: ./bin/rails db:create |
||||
name: Create database |
||||
- run: |
||||
command: ./bin/rails db:migrate VERSION=20171010025614 |
||||
name: Run migrations up to v2.0.0 |
||||
- run: |
||||
command: ./bin/rails tests:migrations:populate_v2 |
||||
name: Populate database with test data |
||||
- run: |
||||
command: ./bin/rails db:migrate VERSION=20180514140000 |
||||
name: Run migrations up to v2.4.0 |
||||
- run: |
||||
command: ./bin/rails tests:migrations:populate_v2_4 |
||||
name: Populate database with test data |
||||
- run: |
||||
command: ./bin/rails db:migrate |
||||
name: Run all remaining migrations |
||||
- run: |
||||
command: ./bin/rails tests:migrations:check_database |
||||
name: Check migration result |
||||
|
||||
test-two-step-migrations: |
||||
executor: |
||||
name: default |
||||
ruby-version: '3.0' |
||||
steps: |
||||
- checkout |
||||
- install-system-dependencies |
||||
- install-ruby-dependencies: |
||||
ruby-version: '3.0' |
||||
- wait-db |
||||
- run: |
||||
command: ./bin/rails db:create |
||||
name: Create database |
||||
- run: |
||||
command: ./bin/rails db:migrate VERSION=20171010025614 |
||||
name: Run migrations up to v2.0.0 |
||||
- run: |
||||
command: ./bin/rails tests:migrations:populate_v2 |
||||
name: Populate database with test data |
||||
- run: |
||||
command: ./bin/rails db:migrate VERSION=20180514140000 |
||||
name: Run pre-deployment migrations up to v2.4.0 |
||||
environment: |
||||
SKIP_POST_DEPLOYMENT_MIGRATIONS: true |
||||
- run: |
||||
command: ./bin/rails tests:migrations:populate_v2_4 |
||||
name: Populate database with test data |
||||
- run: |
||||
command: ./bin/rails db:migrate |
||||
name: Run all pre-deployment migrations |
||||
environment: |
||||
SKIP_POST_DEPLOYMENT_MIGRATIONS: true |
||||
- run: |
||||
command: ./bin/rails db:migrate |
||||
name: Run all post-deployment remaining migrations |
||||
- run: |
||||
command: ./bin/rails tests:migrations:check_database |
||||
name: Check migration result |
||||
|
||||
workflows: |
||||
version: 2 |
||||
build-and-test: |
||||
jobs: |
||||
- build |
||||
- test: |
||||
matrix: |
||||
parameters: |
||||
ruby-version: |
||||
- '2.7' |
||||
- '3.0' |
||||
name: test-ruby<< matrix.ruby-version >> |
||||
requires: |
||||
- build |
||||
- test-migrations: |
||||
requires: |
||||
- build |
||||
- test-two-step-migrations: |
||||
requires: |
||||
- build |
||||
- node/run: |
||||
cache-version: v1 |
||||
name: test-webui |
||||
pkg-manager: yarn |
||||
requires: |
||||
- build |
||||
version: lts |
||||
yarn-run: test:jest |
||||
@ -0,0 +1,92 @@
|
||||
on: |
||||
workflow_call: |
||||
inputs: |
||||
platforms: |
||||
required: true |
||||
type: string |
||||
cache: |
||||
type: boolean |
||||
default: true |
||||
use_native_arm64_builder: |
||||
type: boolean |
||||
push_to_images: |
||||
type: string |
||||
flavor: |
||||
type: string |
||||
tags: |
||||
type: string |
||||
labels: |
||||
type: string |
||||
|
||||
jobs: |
||||
build-image: |
||||
runs-on: ubuntu-latest |
||||
|
||||
steps: |
||||
- uses: actions/checkout@v3 |
||||
|
||||
- uses: docker/setup-qemu-action@v2 |
||||
if: contains(inputs.platforms, 'linux/arm64') && !inputs.use_native_arm64_builder |
||||
|
||||
- uses: docker/setup-buildx-action@v2 |
||||
id: buildx |
||||
if: ${{ !(inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64')) }} |
||||
|
||||
- name: Start a local Docker Builder |
||||
if: inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64') |
||||
run: | |
||||
docker run --rm -d --name buildkitd -p 1234:1234 --privileged moby/buildkit:latest --addr tcp://0.0.0.0:1234 |
||||
|
||||
- uses: docker/setup-buildx-action@v2 |
||||
id: buildx-native |
||||
if: inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64') |
||||
with: |
||||
driver: remote |
||||
endpoint: tcp://localhost:1234 |
||||
platforms: linux/amd64 |
||||
append: | |
||||
- endpoint: tcp://${{ vars.DOCKER_BUILDER_HETZNER_ARM64_01_HOST }}:13865 |
||||
platforms: linux/arm64 |
||||
name: mastodon-docker-builder-arm64-01 |
||||
driver-opts: |
||||
- servername=mastodon-docker-builder-arm64-01 |
||||
env: |
||||
BUILDER_NODE_1_AUTH_TLS_CACERT: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_CACERT }} |
||||
BUILDER_NODE_1_AUTH_TLS_CERT: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_CERT }} |
||||
BUILDER_NODE_1_AUTH_TLS_KEY: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_KEY }} |
||||
|
||||
- name: Log in to Docker Hub |
||||
if: contains(inputs.push_to_images, 'tootsuite') |
||||
uses: docker/login-action@v2 |
||||
with: |
||||
username: ${{ secrets.DOCKERHUB_USERNAME }} |
||||
password: ${{ secrets.DOCKERHUB_TOKEN }} |
||||
|
||||
- name: Log in to the Github Container registry |
||||
if: contains(inputs.push_to_images, 'ghcr.io') |
||||
uses: docker/login-action@v2 |
||||
with: |
||||
registry: ghcr.io |
||||
username: ${{ github.actor }} |
||||
password: ${{ secrets.GITHUB_TOKEN }} |
||||
|
||||
- uses: docker/metadata-action@v4 |
||||
id: meta |
||||
if: ${{ inputs.push_to_images != '' }} |
||||
with: |
||||
images: ${{ inputs.push_to_images }} |
||||
flavor: ${{ inputs.flavor }} |
||||
tags: ${{ inputs.tags }} |
||||
labels: ${{ inputs.labels }} |
||||
|
||||
- uses: docker/build-push-action@v4 |
||||
with: |
||||
context: . |
||||
platforms: ${{ inputs.platforms }} |
||||
provenance: false |
||||
builder: ${{ steps.buildx.outputs.name || steps.buildx-native.outputs.name }} |
||||
push: ${{ inputs.push_to_images != '' }} |
||||
tags: ${{ steps.meta.outputs.tags }} |
||||
labels: ${{ steps.meta.outputs.labels }} |
||||
cache-from: ${{ inputs.cache && 'type=gha' || '' }} |
||||
cache-to: ${{ inputs.cache && 'type=gha,mode=max' || '' }} |
||||
@ -1,64 +0,0 @@
|
||||
name: Build container image |
||||
on: |
||||
workflow_dispatch: |
||||
push: |
||||
branches: |
||||
- 'main' |
||||
tags: |
||||
- '*' |
||||
pull_request: |
||||
paths: |
||||
- .github/workflows/build-image.yml |
||||
- Dockerfile |
||||
|
||||
permissions: |
||||
contents: read |
||||
packages: write |
||||
|
||||
jobs: |
||||
build-image: |
||||
runs-on: ubuntu-latest |
||||
steps: |
||||
- uses: actions/checkout@v3 |
||||
- uses: docker/setup-qemu-action@v2 |
||||
- uses: docker/setup-buildx-action@v2 |
||||
|
||||
- name: Log in to Docker Hub |
||||
uses: docker/login-action@v2 |
||||
with: |
||||
username: ${{ secrets.DOCKERHUB_USERNAME }} |
||||
password: ${{ secrets.DOCKERHUB_TOKEN }} |
||||
if: github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request' |
||||
|
||||
- name: Log in to the Github Container registry |
||||
uses: docker/login-action@v2 |
||||
with: |
||||
registry: ghcr.io |
||||
username: ${{ github.actor }} |
||||
password: ${{ secrets.GITHUB_TOKEN }} |
||||
if: github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request' |
||||
|
||||
- uses: docker/metadata-action@v4 |
||||
id: meta |
||||
with: |
||||
images: | |
||||
tootsuite/mastodon |
||||
ghcr.io/mastodon/mastodon |
||||
flavor: | |
||||
latest=auto |
||||
tags: | |
||||
type=edge,branch=main |
||||
type=match,pattern=v(.*),group=0 |
||||
type=ref,event=pr |
||||
|
||||
- uses: docker/build-push-action@v4 |
||||
with: |
||||
context: . |
||||
platforms: linux/amd64,linux/arm64 |
||||
provenance: false |
||||
builder: ${{ steps.buildx.outputs.name }} |
||||
push: ${{ github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request' }} |
||||
tags: ${{ steps.meta.outputs.tags }} |
||||
labels: ${{ steps.meta.outputs.labels }} |
||||
cache-from: type=gha |
||||
cache-to: type=gha,mode=max |
||||
@ -0,0 +1,27 @@
|
||||
name: Build container release images |
||||
on: |
||||
push: |
||||
tags: |
||||
- '*' |
||||
|
||||
permissions: |
||||
contents: read |
||||
packages: write |
||||
|
||||
jobs: |
||||
build-image: |
||||
uses: ./.github/workflows/build-container-image.yml |
||||
with: |
||||
platforms: linux/amd64,linux/arm64 |
||||
use_native_arm64_builder: true |
||||
push_to_images: | |
||||
tootsuite/mastodon |
||||
ghcr.io/mastodon/mastodon |
||||
# Do not use cache when building releases, so apt update is always ran and the release always contain the latest packages |
||||
cache: false |
||||
flavor: | |
||||
latest=false |
||||
tags: | |
||||
type=pep440,pattern={{raw}} |
||||
type=pep440,pattern=v{{major}}.{{minor}} |
||||
secrets: inherit |
||||
@ -0,0 +1,15 @@
|
||||
name: Test container image build |
||||
on: |
||||
pull_request: |
||||
permissions: |
||||
contents: read |
||||
|
||||
jobs: |
||||
build-image: |
||||
concurrency: |
||||
group: ${{ github.workflow }}-${{ github.ref }} |
||||
cancel-in-progress: true |
||||
|
||||
uses: ./.github/workflows/build-container-image.yml |
||||
with: |
||||
platforms: linux/amd64 # Testing only on native platform so it is performant |
||||
@ -0,0 +1,9 @@
|
||||
# frozen_string_literal: true |
||||
|
||||
class Admin::AccountStatusesFilter < AccountStatusesFilter |
||||
private |
||||
|
||||
def blocked? |
||||
false |
||||
end |
||||
end |
||||
@ -0,0 +1,27 @@
|
||||
# frozen_string_literal: true |
||||
|
||||
require 'rails_helper' |
||||
|
||||
describe 'Content-Security-Policy' do |
||||
it 'sets the expected CSP headers' do |
||||
allow(SecureRandom).to receive(:base64).with(16).and_return('ZbA+JmE7+bK8F5qvADZHuQ==') |
||||
|
||||
get '/' |
||||
expect(response.headers['Content-Security-Policy'].split(';').map(&:strip)).to contain_exactly( |
||||
"base-uri 'none'", |
||||
"default-src 'none'", |
||||
"frame-ancestors 'none'", |
||||
"font-src 'self' https://cb6e6126.ngrok.io", |
||||
"img-src 'self' https: data: blob: https://cb6e6126.ngrok.io", |
||||
"style-src 'self' https://cb6e6126.ngrok.io 'nonce-ZbA+JmE7+bK8F5qvADZHuQ=='", |
||||
"media-src 'self' https: data: https://cb6e6126.ngrok.io", |
||||
"frame-src 'self' https:", |
||||
"manifest-src 'self' https://cb6e6126.ngrok.io", |
||||
"form-action 'self'", |
||||
"child-src 'self' blob: https://cb6e6126.ngrok.io", |
||||
"worker-src 'self' blob: https://cb6e6126.ngrok.io", |
||||
"connect-src 'self' data: blob: https://cb6e6126.ngrok.io https://cb6e6126.ngrok.io ws://localhost:4000", |
||||
"script-src 'self' https://cb6e6126.ngrok.io" |
||||
) |
||||
end |
||||
end |
||||
Loading…
Reference in new issue