From 99d3e4a78129aaa8ba36fe3f7b055b753dc2afcd Mon Sep 17 00:00:00 2001 From: Sagent Date: Mon, 8 Jun 2026 19:11:38 +0000 Subject: [PATCH 1/5] feat: add lint, build, test, push pipeline with SHA-pinned actions - Split single build job into 4 jobs: lint, build, test, push - SHA-pin all actions for supply chain security - Use ChristopherHX artifact actions (Gitea-compatible) - Add tests/test.sh with Docker bridge gateway networking - Test GET / returns RSS-Bridge HTML --- .gitea/workflows/docker-build.yaml | 84 +++++++++++++++++++++--------- tests/test.sh | 72 +++++++++++++++++++++++++ 2 files changed, 132 insertions(+), 24 deletions(-) create mode 100644 tests/test.sh diff --git a/.gitea/workflows/docker-build.yaml b/.gitea/workflows/docker-build.yaml index 4ec8672..523d3af 100644 --- a/.gitea/workflows/docker-build.yaml +++ b/.gitea/workflows/docker-build.yaml @@ -9,38 +9,74 @@ on: - cron: '0 0 * * *' jobs: + lint: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + + - name: Hadolint + uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 + with: + dockerfile: Dockerfile + build: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + - name: Build image + run: docker build -t ci-image:${{ github.sha }} . + + - name: Save image + run: docker save -o image.tar ci-image:${{ github.sha }} + + - name: Upload artifact + uses: https://github.com/ChristopherHX/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2 # main + with: + name: docker-image + path: image.tar + retention-days: 1 + + test: + runs-on: ubuntu-latest + needs: [lint, build] + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + + - name: Download artifact + uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # main + with: + name: docker-image + + - name: Load image + run: docker load < image.tar + + - name: Run tests + run: bash tests/test.sh ci-image:${{ github.sha }} + + push: + runs-on: ubuntu-latest + needs: test + if: github.event_name != 'pull_request' + steps: + - name: Download artifact + uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # main + with: + name: docker-image + + - name: Load image + run: docker load < image.tar - name: Login to Docker Hub - if: github.event_name != 'pull_request' - uses: docker/login-action@v4 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Docker metadata - id: meta - uses: docker/metadata-action@v6 - with: - images: jcabillot/rssbridge - tags: | - #type=ref,event=branch - #type=ref,event=pr - #type=sha - type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - pull: true + - name: Tag and push + run: | + docker tag ci-image:${{ github.sha }} jcabillot/rssbridge:latest + docker push jcabillot/rssbridge:latest diff --git a/tests/test.sh b/tests/test.sh new file mode 100644 index 0000000..88eaad9 --- /dev/null +++ b/tests/test.sh @@ -0,0 +1,72 @@ +#!/usr/bin/env bash +set -euo pipefail + +IMAGE="${1:?Usage: test.sh }" +CONTAINER_NAME="test-$(echo "$IMAGE" | tr ':/' '-')-$$" +PASSED=0 +FAILED=0 +TOTAL=0 + +cleanup() { + docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true +} +trap cleanup EXIT + +assert() { + local name="$1" expected="$2" actual="$3" + TOTAL=$((TOTAL + 1)) + if [ "$expected" = "$actual" ]; then + echo " PASS: $name" + PASSED=$((PASSED + 1)) + else + echo " FAIL: $name (expected: '$expected', got: '$actual')" + FAILED=$((FAILED + 1)) + fi +} + +assert_match() { + local name="$1" pattern="$2" actual="$3" + TOTAL=$((TOTAL + 1)) + if echo "$actual" | grep -qE "$pattern"; then + echo " PASS: $name" + PASSED=$((PASSED + 1)) + else + echo " FAIL: $name (pattern: '$pattern', got: '$actual')" + FAILED=$((FAILED + 1)) + fi +} + +echo "Running container: $IMAGE" +docker run -d --name "$CONTAINER_NAME" -p 8080:8080 "$IMAGE" >/dev/null + +DOCKER_GW=$(docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}') +BASE_URL="http://${DOCKER_GW}:8080" + +echo "Waiting for container on ${DOCKER_GW}:8080..." +for i in $(seq 1 30); do + if curl -sf "$BASE_URL/" >/dev/null 2>&1; then + echo "Container ready after ${i}s" + break + fi + if [ "$i" -eq 30 ]; then + echo "FAIL: Container did not become ready within 30s" + docker logs "$CONTAINER_NAME" + exit 1 + fi + sleep 1 +done + +echo "" +echo "Test: GET /" +RESPONSE=$(curl -sf -D - "$BASE_URL/") +STATUS=$(echo "$RESPONSE" | head -1 | grep -oP '\d{3}') +CONTENT_TYPE=$(echo "$RESPONSE" | grep -i 'content-type' | tr -d '\r' | cut -d: -f2- | xargs) +BODY=$(echo "$RESPONSE" | sed -n '/^\r$/,$p' | tail -n +2) + +assert "HTTP status is 200" "200" "$STATUS" +assert_match "Content-Type is text/html" "text/html" "$CONTENT_TYPE" +assert_match "Body contains RSS-Bridge" "[Rr][Ss][Ss].*[Bb]ridge" "$BODY" + +echo "" +echo "Results: $PASSED/$TOTAL passed, $FAILED failed" +[ "$FAILED" -eq 0 ] From c148d9480d0956be2d322c94082715cfbc569e61 Mon Sep 17 00:00:00 2001 From: Sagent Date: Mon, 8 Jun 2026 19:17:29 +0000 Subject: [PATCH 2/5] fix: add SHELL pipefail for hadolint DL4006 --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index b311f7e..c28d925 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,6 +2,7 @@ ARG VERSION="latest" FROM "jcabillot/phpapache:${VERSION}" LABEL maintainer="Julien Cabillot " +SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN curl -s -L "https://github.com/RSS-Bridge/rss-bridge/tarball/master/" | tar -zx --strip=1 RUN echo "*" > "/var/www/html/whitelist.txt" From a552e414cce4eb02f29d6d5ae015fe62391d234d Mon Sep 17 00:00:00 2001 From: Sagent Date: Mon, 8 Jun 2026 19:53:12 +0000 Subject: [PATCH 3/5] fix: chown /var/www/html to www-data so FileCache can write --- Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index c28d925..bb7a35b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,4 +5,6 @@ LABEL maintainer="Julien Cabillot " SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN curl -s -L "https://github.com/RSS-Bridge/rss-bridge/tarball/master/" | tar -zx --strip=1 -RUN echo "*" > "/var/www/html/whitelist.txt" +RUN echo "*" > "/var/www/html/whitelist.txt" && \ + mkdir -p /var/www/html/cache && \ + chown -R www-data:www-data /var/www/html From 2c28c53bcc408c440441232bc1732870a6d40219 Mon Sep 17 00:00:00 2001 From: Sagent Date: Mon, 8 Jun 2026 20:45:01 +0000 Subject: [PATCH 4/5] fix: avoid pipefail/SIGPIPE by using temp files for HTTP tests --- tests/test.sh | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/tests/test.sh b/tests/test.sh index 88eaad9..945f415 100644 --- a/tests/test.sh +++ b/tests/test.sh @@ -58,10 +58,16 @@ done echo "" echo "Test: GET /" -RESPONSE=$(curl -sf -D - "$BASE_URL/") -STATUS=$(echo "$RESPONSE" | head -1 | grep -oP '\d{3}') -CONTENT_TYPE=$(echo "$RESPONSE" | grep -i 'content-type' | tr -d '\r' | cut -d: -f2- | xargs) -BODY=$(echo "$RESPONSE" | sed -n '/^\r$/,$p' | tail -n +2) +TMPDIR=$(mktemp -d) +cleanup() { + docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true + rm -rf "$TMPDIR" +} +curl -sf -o "$TMPDIR/body" -D "$TMPDIR/headers" "$BASE_URL/" +STATUS=$(head -1 "$TMPDIR/headers" | grep -oP '\d{3}') +CONTENT_TYPE=$(grep -i 'content-type' "$TMPDIR/headers" | tr -d '\r' | cut -d: -f2- | xargs) +BODY=$(cat "$TMPDIR/body") +trap cleanup EXIT assert "HTTP status is 200" "200" "$STATUS" assert_match "Content-Type is text/html" "text/html" "$CONTENT_TYPE" From dc774d6cb7f9fc8adc3e9e58975db28540f77315 Mon Sep 17 00:00:00 2001 From: Sagent Date: Mon, 8 Jun 2026 21:10:45 +0000 Subject: [PATCH 5/5] fix: use grep on file directly instead of echo piping for body test --- tests/test.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tests/test.sh b/tests/test.sh index 945f415..bf78f25 100644 --- a/tests/test.sh +++ b/tests/test.sh @@ -66,12 +66,19 @@ cleanup() { curl -sf -o "$TMPDIR/body" -D "$TMPDIR/headers" "$BASE_URL/" STATUS=$(head -1 "$TMPDIR/headers" | grep -oP '\d{3}') CONTENT_TYPE=$(grep -i 'content-type' "$TMPDIR/headers" | tr -d '\r' | cut -d: -f2- | xargs) -BODY=$(cat "$TMPDIR/body") trap cleanup EXIT assert "HTTP status is 200" "200" "$STATUS" assert_match "Content-Type is text/html" "text/html" "$CONTENT_TYPE" -assert_match "Body contains RSS-Bridge" "[Rr][Ss][Ss].*[Bb]ridge" "$BODY" + +TOTAL=$((TOTAL + 1)) +if grep -qEi "[Rr][Ss][Ss].*[Bb]ridge" "$TMPDIR/body"; then + echo " PASS: Body contains RSS-Bridge" + PASSED=$((PASSED + 1)) +else + echo " FAIL: Body contains RSS-Bridge (pattern not found)" + FAILED=$((FAILED + 1)) +fi echo "" echo "Results: $PASSED/$TOTAL passed, $FAILED failed"