Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 12 additions & 30 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,46 +13,28 @@ jobs:

services:
postgres:
image: postgres:14
image: postgres:16
env:
POSTGRES_USER: test
POSTGRES_PASSWORD: correcthorsebatterystaple
POSTGRES_DB: test
POSTGRES_USER: buildlight
POSTGRES_PASSWORD: buildlight
POSTGRES_DB: buildlight_test
ports:
- 5432:5432
# needed because the postgres container does not provide a healthcheck
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

env:
DATABASE_URL: postgres://test:correcthorsebatterystaple@localhost:5432/test
RAILS_ENV: test
RUBYOPT: --enable=frozen-string-literal
TEST_DATABASE_URL: postgresql://buildlight:buildlight@localhost:5432/buildlight_test

steps:
- uses: actions/checkout@master
- uses: actions/checkout@v4

- name: Set up Ruby
uses: ruby/setup-ruby@v1
- name: Set up Zig
uses: mlugg/setup-zig@v2
with:
bundler-cache: true
version: 0.15.2

- name: Set up Node
uses: actions/setup-node@v4
with:
node-version-file: 'package.json'
cache: 'npm'

- name: NPM Install
run: npm ci

- name: App Setup
run: bin/setup

- name: Build CSS
run: npm run build:css

- name: Standard
run: bundle exec rake standard
- name: Build
run: zig build

- name: Run Tests
run: bundle exec rspec --format progress --color
run: zig build test
26 changes: 3 additions & 23 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,23 +1,3 @@
# See http://help.github.com/ignore-files/ for more about ignoring files.
#
# If you find yourself ignoring temporary files generated by your text editor
# or operating system, you probably want to add a global ignore instead:
# git config --global core.excludesfile ~/.gitignore_global

# Ignore bundler config
/.bundle

# Ignore the default SQLite database.
/db/*.sqlite3

# Ignore all logfiles and tempfiles.
/log/*.log
/tmp

# Ignore application configuration
/config/application.yml

/app/assets/builds/*
!/app/assets/builds/.keep

/node_modules
# Zig build artifacts
/.zig-cache/
/zig-out/
2 changes: 2 additions & 0 deletions .mise.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[tools]
zig = "0.15"
1 change: 0 additions & 1 deletion .node-version

This file was deleted.

2 changes: 0 additions & 2 deletions .rspec

This file was deleted.

1 change: 0 additions & 1 deletion .ruby-version

This file was deleted.

3 changes: 0 additions & 3 deletions .standard.yml

This file was deleted.

18 changes: 0 additions & 18 deletions .travis.yml

This file was deleted.

104 changes: 16 additions & 88 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,96 +1,24 @@
# syntax=docker/dockerfile:1
# check=error=true
FROM debian:stable-slim AS builder

# Make sure RUBY_VERSION matches the Ruby version in .ruby-version
ARG RUBY_VERSION=3.4.4
FROM ruby:$RUBY_VERSION-alpine AS base
# Install Zig
RUN apt-get update && apt-get install -y curl xz-utils && \
curl -L https://ziglang.org/download/0.15.2/zig-x86_64-linux.tar.xz | tar xJ && \
mv zig-* /opt/zig
Comment on lines +3 to +6
Copy link

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Dockerfile downloads the Zig toolchain via curl ... | tar from ziglang.org without any checksum or signature verification. If the download endpoint or TLS channel is compromised, an attacker could supply a malicious compiler that injects backdoors into the built buildlight binary. Pin the archive with a strong hash or use a base image or package manager that provides integrity verification for Zig.

Copilot uses AI. Check for mistakes.

LABEL fly_launch_runtime="rails"

# Rails app lives here
WORKDIR /rails

# Update gems and bundler
RUN gem update --system --no-document && \
gem install -N bundler

# Install base packages
RUN apk add --no-cache curl jemalloc postgresql-client tzdata

# Set production environment
ENV BUNDLE_DEPLOYMENT="1" \
BUNDLE_PATH="/usr/local/bundle" \
BUNDLE_WITHOUT="development:test" \
RAILS_ENV="production"


# Throw-away build stages to reduce size of final image
FROM base AS prebuild

# Install packages needed to build gems and node modules
RUN apk add --no-cache build-base git gyp libpq-dev pkgconfig python3 yaml-dev


FROM prebuild AS node

# Install Node.js
ARG NODE_VERSION=22.4.0
ENV PATH=/usr/local/node/bin:$PATH
RUN curl -sL https://unofficial-builds.nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64-musl.tar.gz | tar xz -C /tmp/ && \
mkdir /usr/local/node && \
cp -rp /tmp/node-v${NODE_VERSION}-linux-x64-musl/* /usr/local/node/ && \
rm -rf /tmp/node-v${NODE_VERSION}-linux-x64-musl

# Install node modules
COPY package.json ./
RUN npm install


FROM prebuild AS build

# Install application gems
COPY Gemfile Gemfile.lock .ruby-version ./
RUN bundle install && \
rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
bundle exec bootsnap precompile --gemfile

# Copy node modules
COPY --from=node /rails/node_modules /rails/node_modules
COPY --from=node /usr/local/node /usr/local/node
ENV PATH=/usr/local/node/bin:$PATH

# Copy application code
WORKDIR /app
COPY . .

# Precompile bootsnap code for faster boot times
RUN bundle exec bootsnap precompile app/ lib/

# Adjust binfiles to set current working directory
RUN grep -l '#!/usr/bin/env ruby' /rails/bin/* | xargs sed -i '/^#!/aDir.chdir File.expand_path("..", __dir__)'

# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile


# Final stage for app image
FROM base

# Install packages needed for deployment
RUN apk add --no-cache gzip libpq
ENV PATH="/opt/zig:$PATH"
RUN zig build -Doptimize=ReleaseSafe

# Copy built artifacts: gems, application
COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
COPY --from=build /rails /rails
FROM debian:stable-slim

# Run and own only the runtime files as a non-root user for security
RUN addgroup --system --gid 1000 rails && \
adduser --system rails --uid 1000 --ingroup rails --home /home/rails --shell /bin/sh rails && \
chown -R 1000:1000 db log tmp
USER 1000:1000
# Install CA certificates for outbound HTTPS (triggers)
RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*

# Entrypoint sets up the container.
ENTRYPOINT ["/rails/bin/docker-entrypoint"]
COPY --from=builder /app/zig-out/bin/buildlight /usr/local/bin/buildlight
# Copy public files for Fly.io [[statics]] to serve
COPY --from=builder /app/public /app/public

# Start the server by default, this can be overwritten at runtime
EXPOSE 3000
CMD ["./bin/rails", "server"]
EXPOSE 8080
CMD ["buildlight"]
32 changes: 0 additions & 32 deletions Gemfile

This file was deleted.

Loading