From 313cef60ee8d2454263d8ae7671c846f4d418f0e Mon Sep 17 00:00:00 2001 From: Julia van der Kris Date: Mon, 7 Oct 2024 04:15:19 +0200 Subject: [PATCH 1/5] infra: build quartz docker image to GHCR (#1192) * Add GitHub action to build & push Docker image to GHCR * Use double quotes to keep `prettier` happy :) * Don't run Docker build & push on forks * -1 char commit lmao * Add git metadata to Docker image * Apply Aaron's patch * chore: run prettier --------- Signed-off-by: Aaron Pham Co-authored-by: Aaron Pham --- .github/workflows/docker-build-push.yaml | 117 +++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .github/workflows/docker-build-push.yaml diff --git a/.github/workflows/docker-build-push.yaml b/.github/workflows/docker-build-push.yaml new file mode 100644 index 000000000..e72c96700 --- /dev/null +++ b/.github/workflows/docker-build-push.yaml @@ -0,0 +1,117 @@ +name: Docker build & push image + +on: + push: + branches: [v4] + tags: ["v*"] + pull_request: + branches: [v4] + paths: + - .github/workflows/docker-build-push.yaml + - quartz/** + workflow_dispatch: + +jobs: + build: + if: ${{ github.repository == 'jackyzha0/quartz' }} # Comment this out if you want to publish your own images on a fork! + runs-on: ubuntu-latest + steps: + - name: Set lowercase repository owner environment variable + run: | + echo "OWNER_LOWERCASE=${OWNER,,}" >> ${GITHUB_ENV} + env: + OWNER: "${{ github.repository_owner }}" + - uses: actions/checkout@v4 + with: + fetch-depth: 1 + - name: Inject slug/short variables + uses: rlespinasse/github-slug-action@v4.4.1 + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + with: + install: true + driver-opts: | + image=moby/buildkit:master + network=host + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@v3.7.0 + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + if: github.event_name != 'pull_request' + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata tags and labels on PRs + if: github.event_name == 'pull_request' + id: meta-pr + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ env.OWNER_LOWERCASE }}/quartz + tags: | + type=raw,value=sha-${{ env.GITHUB_SHA_SHORT }} + labels: | + org.opencontainers.image.source="https://github.com/${{ github.repository_owner }}/quartz" + - name: Extract metadata tags and labels for main, release or tag + if: github.event_name != 'pull_request' + id: meta + uses: docker/metadata-action@v5 + with: + flavor: | + latest=auto + images: ghcr.io/${{ env.OWNER_LOWERCASE }}/quartz + tags: | + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}}.{{minor}}.{{patch}} + type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }} + type=raw,value=sha-${{ env.GITHUB_SHA_SHORT }} + labels: | + maintainer=${{ github.repository_owner }} + org.opencontainers.image.source="https://github.com/${{ github.repository_owner }}/quartz" + + - name: Build and push Docker image + id: build-and-push + uses: docker/build-push-action@v6 + with: + push: true + build-args: | + GIT_SHA=${{ env.GITHUB_SHA }} + DOCKER_LABEL=sha-${{ env.GITHUB_SHA_SHORT }} + tags: ${{ steps.meta.outputs.tags || steps.meta-pr.outputs.tags }} + labels: ${{ steps.meta.outputs.labels || steps.meta-pr.outputs.labels }} + cache-from: type=gha + cache-to: type=gha + + - name: Sign the released image + if: ${{ github.event_name != 'pull_request' }} + env: + COSIGN_EXPERIMENTAL: "true" + run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} + - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph + uses: aquasecurity/trivy-action@master + if: ${{ github.event_name != 'pull_request' }} + with: + image-ref: "ghcr.io/${{ github.repository_owner }}/quartz:sha-${{ env.GITHUB_SHA_SHORT }}" + format: "github" + output: "dependency-results.sbom.json" + github-pat: ${{ secrets.GITHUB_TOKEN }} + scanners: "vuln" + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + if: ${{ github.event_name != 'pull_request' }} + with: + image-ref: "ghcr.io/${{ github.repository_owner }}/quartz:sha-${{ env.GITHUB_SHA_SHORT }}" + format: "sarif" + output: "trivy-results.sarif" + severity: "CRITICAL" + scanners: "vuln" + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + if: ${{ github.event_name != 'pull_request' }} + with: + sarif_file: "trivy-results.sarif" From 66d7dd8677e5ef05c97773f3590d43ef97d21d98 Mon Sep 17 00:00:00 2001 From: Aaron Pham Date: Sun, 6 Oct 2024 22:34:31 -0400 Subject: [PATCH 2/5] fix(ci): run build on tags (#1483) * fix(ci): run build on tags Signed-off-by: Aaron Pham * chore: update docker warning and not push on PR Signed-off-by: Aaron Pham --------- Signed-off-by: Aaron Pham --- .github/workflows/docker-build-push.yaml | 4 ++-- Dockerfile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-build-push.yaml b/.github/workflows/docker-build-push.yaml index e72c96700..61ec110e6 100644 --- a/.github/workflows/docker-build-push.yaml +++ b/.github/workflows/docker-build-push.yaml @@ -3,7 +3,7 @@ name: Docker build & push image on: push: branches: [v4] - tags: ["v*"] + tags: ["v*"] pull_request: branches: [v4] paths: @@ -78,7 +78,7 @@ jobs: id: build-and-push uses: docker/build-push-action@v6 with: - push: true + push: ${{ github.event_name != 'pull_request' }} build-args: | GIT_SHA=${{ env.GITHUB_SHA }} DOCKER_LABEL=sha-${{ env.GITHUB_SHA_SHORT }} diff --git a/Dockerfile b/Dockerfile index 1d9e5915f..4493853e2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:20-slim as builder +FROM node:20-slim AS builder WORKDIR /usr/src/app COPY package.json . COPY package-lock.json* . From 497d51973ae2a986373decbfeb7a1afe229e5fd6 Mon Sep 17 00:00:00 2001 From: Aaron Pham Date: Mon, 7 Oct 2024 02:52:14 -0400 Subject: [PATCH 3/5] chore(ci): remove signing and vuln (#1484) Signed-off-by: Aaron Pham --- .github/workflows/docker-build-push.yaml | 29 ------------------------ 1 file changed, 29 deletions(-) diff --git a/.github/workflows/docker-build-push.yaml b/.github/workflows/docker-build-push.yaml index 61ec110e6..f3bd2cdb3 100644 --- a/.github/workflows/docker-build-push.yaml +++ b/.github/workflows/docker-build-push.yaml @@ -86,32 +86,3 @@ jobs: labels: ${{ steps.meta.outputs.labels || steps.meta-pr.outputs.labels }} cache-from: type=gha cache-to: type=gha - - - name: Sign the released image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} - - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph - uses: aquasecurity/trivy-action@master - if: ${{ github.event_name != 'pull_request' }} - with: - image-ref: "ghcr.io/${{ github.repository_owner }}/quartz:sha-${{ env.GITHUB_SHA_SHORT }}" - format: "github" - output: "dependency-results.sbom.json" - github-pat: ${{ secrets.GITHUB_TOKEN }} - scanners: "vuln" - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master - if: ${{ github.event_name != 'pull_request' }} - with: - image-ref: "ghcr.io/${{ github.repository_owner }}/quartz:sha-${{ env.GITHUB_SHA_SHORT }}" - format: "sarif" - output: "trivy-results.sarif" - severity: "CRITICAL" - scanners: "vuln" - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - if: ${{ github.event_name != 'pull_request' }} - with: - sarif_file: "trivy-results.sarif" From fe4b039b60826e1ed10aab3d9127ae6e08b396d8 Mon Sep 17 00:00:00 2001 From: Aaron Pham Date: Wed, 9 Oct 2024 12:52:49 -0400 Subject: [PATCH 4/5] chore(ci): group dependabot upgrade (#1491) Signed-off-by: Aaron Pham --- .github/dependabot.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 42adb4474..0ea6875a2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,11 +1,11 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file - version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" + groups: + production-dependencies: + applies-to: "version-updates" + patterns: + - "*" From 8a95c865c86b94ad2b8553cfc6362233243984d1 Mon Sep 17 00:00:00 2001 From: Aaron Pham Date: Wed, 9 Oct 2024 14:14:44 -0400 Subject: [PATCH 5/5] chore(citations): passthrough options (#1429) --- quartz/plugins/transformers/citations.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/quartz/plugins/transformers/citations.ts b/quartz/plugins/transformers/citations.ts index 5242f37c5..dcac41b2e 100644 --- a/quartz/plugins/transformers/citations.ts +++ b/quartz/plugins/transformers/citations.ts @@ -21,7 +21,7 @@ export const Citations: QuartzTransformerPlugin> = (userOpts) = const opts = { ...defaultOptions, ...userOpts } return { name: "Citations", - htmlPlugins() { + htmlPlugins(ctx) { const plugins: PluggableList = [] // Add rehype-citation to the list of plugins @@ -31,6 +31,8 @@ export const Citations: QuartzTransformerPlugin> = (userOpts) = bibliography: opts.bibliographyFile, suppressBibliography: opts.suppressBibliography, linkCitations: opts.linkCitations, + csl: opts.csl, + lang: ctx.cfg.configuration.locale ?? "en-US", }, ])