Skip to content

Settings: Replace hand-coded QML pages with JSON-driven code generation. Searchable settings. #1722

Settings: Replace hand-coded QML pages with JSON-driven code generation. Searchable settings.

Settings: Replace hand-coded QML pages with JSON-driven code generation. Searchable settings. #1722

Workflow file for this run

name: Docker
on:
push:
branches:
- master
- 'Stable*'
tags:
- 'v*'
paths-ignore:
- 'docs/**'
pull_request:
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
permissions:
contents: read
actions: read
security-events: write
jobs:
changes:
name: Detect Changes
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
timeout-minutes: 5
permissions:
contents: read
outputs:
linux: ${{ steps.detect-linux.outputs.any }}
android: ${{ steps.detect-android.outputs.any }}
steps:
- name: Checkout repo
uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Detect Linux changes
id: detect-linux
uses: ./.github/actions/detect-changes
with:
platform: docker-linux
- name: Detect Android changes
id: detect-android
uses: ./.github/actions/detect-changes
with:
platform: docker-android
plan-builds:
name: Plan Docker Builds
runs-on: ubuntu-latest
needs: changes
if: always() && !cancelled()
timeout-minutes: 5
outputs:
matrix: ${{ steps.plan.outputs.matrix }}
has_jobs: ${{ steps.plan.outputs.has_jobs }}
steps:
- name: Checkout planner
uses: actions/checkout@v6
with:
fetch-depth: 1
sparse-checkout: |
.github/scripts/plan_docker_builds.py
.github/scripts/ci_bootstrap.py
tools/common/gh_actions.py
sparse-checkout-cone-mode: false
- name: Plan matrix
id: plan
env:
EVENT_NAME: ${{ github.event_name }}
LINUX: ${{ needs.changes.outputs.linux }}
ANDROID: ${{ needs.changes.outputs.android }}
run: python3 "${GITHUB_WORKSPACE}/.github/scripts/plan_docker_builds.py"
build:
name: Docker ${{ matrix.platform }}
runs-on: ubuntu-latest
needs: [changes, plan-builds]
if: always() && !cancelled() && needs.plan-builds.outputs.has_jobs == 'true' && vars.DOCKER_BUILD_ENABLED == 'true'
timeout-minutes: 120
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.plan-builds.outputs.matrix) }}
defaults:
run:
shell: bash
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
with:
egress-policy: audit
- name: Free Disk Space
uses: endersonmenezes/free-disk-space@v3
with:
remove_android: ${{ matrix.platform != 'Android' }}
remove_dotnet: true
remove_haskell: true
remove_tool_cache: true
remove_swap: true
remove_packages: azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable
remove_packages_one_command: true
remove_folders: /usr/local/lib/docker/overlay2
rm_cmd: rmz
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 1
- name: Build with Docker
uses: ./.github/actions/docker
with:
dockerfile: ${{ matrix.dockerfile }}
fuse: ${{ matrix.fuse }}
docker-token: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Find build artifact
id: artifact
env:
BUILD_DIR: ${{ github.workspace }}/build
ARTIFACT_PATTERN: ${{ matrix.artifact_pattern }}
run: |
set +o pipefail # Disable pipefail to handle find | head gracefully
echo "Searching for ${ARTIFACT_PATTERN} in ${BUILD_DIR}"
# Check if build directory exists
if [ ! -d "${BUILD_DIR}" ]; then
echo "::warning::Build directory does not exist: ${BUILD_DIR}"
echo "found=false" >> "${GITHUB_OUTPUT}"
exit 0
fi
# Show build directory structure for debugging (ignore permission errors from Docker-created dirs)
echo "Build directory contents:"
find "${BUILD_DIR}" -maxdepth 4 \( -name "*.apk" -o -name "*.AppImage" \) -type f 2>/dev/null || true
# Find the produced artifact (APK or AppImage)
# Use -quit for efficiency and to avoid broken pipe with head
ARTIFACT=$(find "${BUILD_DIR}" -name "${ARTIFACT_PATTERN}" -type f -print -quit 2>/dev/null)
if [ -z "$ARTIFACT" ]; then
echo "::warning::No artifact matching ${ARTIFACT_PATTERN} found"
echo "found=false" >> "${GITHUB_OUTPUT}"
else
echo "Found artifact: $ARTIFACT"
echo "path=$ARTIFACT" >> "${GITHUB_OUTPUT}"
echo "found=true" >> "${GITHUB_OUTPUT}"
fi
- name: Compute Trivy cache key
if: steps.artifact.outputs.found == 'true'
id: trivy-cache-key
shell: bash
run: echo "week=$(date -u +%G-W%V)" >> "$GITHUB_OUTPUT"
- name: Restore Trivy DB cache
if: steps.artifact.outputs.found == 'true'
uses: actions/cache@v5
with:
path: ~/.cache/trivy
key: trivy-db-v1-${{ runner.os }}-${{ matrix.platform }}-${{ steps.trivy-cache-key.outputs.week }}-${{ hashFiles('.github/trivy.yaml') }}
restore-keys: |
trivy-db-v1-${{ runner.os }}-${{ matrix.platform }}-
trivy-db-v1-${{ runner.os }}-
- name: Scan artifact for vulnerabilities
if: steps.artifact.outputs.found == 'true'
uses: aquasecurity/trivy-action@0.35.0
with:
scan-type: 'fs'
scan-ref: ${{ steps.artifact.outputs.path }}
format: 'sarif'
output: 'trivy-results.sarif'
trivy-config: '.github/trivy.yaml'
cache-dir: ~/.cache/trivy
- name: Upload Trivy results to GitHub Security
if: steps.artifact.outputs.found == 'true'
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: 'trivy-results.sarif'
category: 'trivy-${{ matrix.platform }}'