From 0b8f6e9b60ca9cc97be671e1c2e8db0e362d92bb Mon Sep 17 00:00:00 2001 From: yeasy Date: Mon, 18 May 2026 07:38:58 -0700 Subject: [PATCH] Refresh metadata and workflows --- .github/workflows/auto-release.yml | 15 +++++++----- .github/workflows/ci.yaml | 17 +++++++------ .github/workflows/dependabot-automerge.yml | 28 +++++++++++++++++++--- .github/workflows/preview-pdf.yml | 15 +++++++----- 14_kubernetes_setup/14.1_kubeadm.md | 2 +- 14_kubernetes_setup/14.2_kubeadm-docker.md | 2 +- 18_security/18.6_image_security.md | 4 ++-- CHANGELOG.md | 26 ++++++++++++++++++++ SUMMARY.md | 2 +- package.json | 6 ++--- scripts/check_metadata.js | 15 ++++++++++++ 11 files changed, 102 insertions(+), 30 deletions(-) create mode 100644 scripts/check_metadata.js diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index a22ae30..d696a20 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -24,13 +24,16 @@ jobs: sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra - - name: Install mdpress (latest) + - name: Install mdpress 0.7.10 + env: + MDPRESS_VERSION: "0.7.10" + MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" run: | - LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name) - VERSION="${LATEST_TAG#v}" - echo "Installing mdpress $VERSION" - curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o /tmp/mdpress.tar.gz - tar xzf /tmp/mdpress.tar.gz -C /tmp mdpress + archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" + echo "Installing mdpress ${MDPRESS_VERSION}" + curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive" + echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + tar xzf "$archive" -C /tmp mdpress sudo mv /tmp/mdpress /usr/local/bin/ mdpress --version diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ada25c3..55bb421 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -24,17 +24,20 @@ jobs: run: | sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra - - name: Install mdpress (latest) + - name: Install mdpress 0.7.10 + env: + MDPRESS_VERSION: "0.7.10" + MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" run: | - LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name) - VERSION="${LATEST_TAG#v}" - echo "Installing mdpress $VERSION" - curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o mdpress.tar.gz - tar xzf mdpress.tar.gz + archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" + echo "Installing mdpress ${MDPRESS_VERSION}" + curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive" + echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + tar xzf "$archive" sudo mv mdpress /usr/local/bin/ mdpress --version - name: Build site - run: mdpress build --format site + run: npm run build - name: Build PDF run: mdpress build --format pdf --output docker_practice.pdf - name: Upload PDF as artifact diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index f378b4f..ad87bd4 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -4,6 +4,7 @@ on: pull_request permissions: contents: write pull-requests: write + checks: read jobs: dependabot: @@ -12,15 +13,36 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - - name: Approve a PR + + - name: Confirm required checks are configured + if: > + steps.metadata.outputs.package-ecosystem == 'github_actions' && + contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type) + run: | + REQUIRED=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${{ github.event.pull_request.base.ref }}/protection/required_status_checks" --jq '((.contexts // []) | length) + ((.checks // []) | length)' 2>/dev/null || echo 0) + if [ "$REQUIRED" -eq 0 ]; then + echo "No required status checks configured on the base branch; refusing Dependabot auto-merge." + exit 1 + fi + env: + GH_TOKEN: ${{secrets.GITHUB_TOKEN}} + + - name: Approve low-risk Dependabot PR + if: > + steps.metadata.outputs.package-ecosystem == 'github_actions' && + contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type) run: gh pr review --approve "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}} GH_TOKEN: ${{secrets.GITHUB_TOKEN}} - - name: Enable auto-merge for Dependabot PRs + + - name: Enable auto-merge for low-risk Dependabot PRs + if: > + steps.metadata.outputs.package-ecosystem == 'github_actions' && + contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type) run: gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}} diff --git a/.github/workflows/preview-pdf.yml b/.github/workflows/preview-pdf.yml index 0b8d0dd..c30cbf2 100644 --- a/.github/workflows/preview-pdf.yml +++ b/.github/workflows/preview-pdf.yml @@ -31,13 +31,16 @@ jobs: sudo apt-get update sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra - - name: Install mdpress (latest) + - name: Install mdpress 0.7.10 + env: + MDPRESS_VERSION: "0.7.10" + MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4" run: | - LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name) - VERSION="${LATEST_TAG#v}" - echo "Installing mdpress $VERSION" - curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o /tmp/mdpress.tar.gz - tar xzf /tmp/mdpress.tar.gz -C /tmp mdpress + archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" + echo "Installing mdpress ${MDPRESS_VERSION}" + curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive" + echo "${MDPRESS_SHA256} $archive" | sha256sum -c - + tar xzf "$archive" -C /tmp mdpress sudo mv /tmp/mdpress /usr/local/bin/ mdpress --version diff --git a/14_kubernetes_setup/14.1_kubeadm.md b/14_kubernetes_setup/14.1_kubeadm.md index 1397838..a349ef8 100644 --- a/14_kubernetes_setup/14.1_kubeadm.md +++ b/14_kubernetes_setup/14.1_kubeadm.md @@ -140,7 +140,7 @@ $ sysctl --system #### 修改 `kubelet.service`（可选：IPVS 模式） -> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用，并在 **Kubernetes 1.36 中正式移除**。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.31+ 可用）。以下 IPVS 配置仅供 1.35 及更早版本的旧环境参考。 +> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用；Kubernetes 1.36 文档仍将其列为已弃用模式，并推荐迁移到 nftables。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.33+ 稳定）。以下 IPVS 配置仅供旧环境参考。 `/etc/systemd/system/kubelet.service.d/10-proxy-ipvs.conf` 写入以下内容 diff --git a/14_kubernetes_setup/14.2_kubeadm-docker.md b/14_kubernetes_setup/14.2_kubeadm-docker.md index cedb700..0b59f6a 100644 --- a/14_kubernetes_setup/14.2_kubeadm-docker.md +++ b/14_kubernetes_setup/14.2_kubeadm-docker.md @@ -171,7 +171,7 @@ $ sysctl --system #### 修改 `kubelet.service`（可选：IPVS 模式） -> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用，并在 **Kubernetes 1.36 中正式移除**。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.31+ 可用）。以下 IPVS 配置仅供 1.35 及更早版本的旧环境参考。 +> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用；Kubernetes 1.36 文档仍将其列为已弃用模式，并推荐迁移到 nftables。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.33+ 稳定）。以下 IPVS 配置仅供旧环境参考。 `/etc/systemd/system/kubelet.service.d/10-proxy-ipvs.conf` 写入以下内容 diff --git a/18_security/18.6_image_security.md b/18_security/18.6_image_security.md index 5e43958..629a713 100644 --- a/18_security/18.6_image_security.md +++ b/18_security/18.6_image_security.md @@ -77,7 +77,7 @@ Snyk 提供了商业级的安全扫描服务，特别适合企业环境。 **特点：** -- 支持开源漏洞和许可证扫描 +- 支持开源漏洞、许可证扫描和修复建议 - 与多个 Git 平台深度集成（GitHub、GitLab、Bitbucket） - 提供修复建议和自动化修复 PR - 支持 Kubernetes 部署后安全监控 @@ -114,7 +114,7 @@ $ docker scout quickview myapp:latest | Docker 集成 | ✓（原生） | 需安装 | 需安装 | 需安装 | | 零依赖 | ✗ | ✓ | ✗ | ✗ | | 离线模式 | ✗ | ✓ | ✓ | ✗ | -| 许可证扫描 | ✓ | ✗ | ✓ | ✓ | +| 许可证扫描 | ✓ | ✓ | ✓ | ✓ | | 自动修复建议 | ✓ | ✗ | ✗ | ✓ | | 开源免费 | 部分 | ✓ | ✓ | 部分 | | IDE 集成 | ✓ | ✓ | ✓ | ✓ | diff --git a/CHANGELOG.md b/CHANGELOG.md index d6a14a9..febe305 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,31 @@ # 修订记录 +* 1.9.2 2026-05-16 + * 刷新 Docker 生态说明，更新 Fedora CoreOS、Podman、containerd 等章节中的维护状态 + * 修复镜像事实、演示 TLS 密钥等后续审阅发现的问题 + +* 1.9.1 2026-05-08 + * 使用 `browser-actions/setup-chrome` 替代 Ubuntu runner 上不稳定的 Chromium snap 安装 + * 修正 Docker Engine 29 日期、TLS 协议、healthcheck 与交互式调试示例 + +* 1.9.0 2026-05-02 + * 更新 Docker Engine 29、nginx、MySQL 8.4 LTS、Node.js 22 LTS 与 Kubernetes 相关版本说明 + * 补充 ipvlan、nftables、Gateway API、Docker Scout、镜像安全与供应链安全内容 + * 修复 Docker Hub 限流、etcdctl API、Compose healthcheck、Docker Debug 等时效性内容 + +* 1.8.0 2026-04-27 + * 补全 Dockerfile 指令参考与多处章节编号、标题层级、代码块和表格格式 + * 增加预览 PDF 自动发布流程，修复 mdpress 端口和导出相关配置 + +* 1.7.5 2026-04-05 + * 将失效的 AtomHub 镜像替换为可用镜像源 + +* 1.7.4 2026-03-31 + * 修复标题层级格式 + +* 1.7.3 2026-03-29 + * 修复 Wikipedia URL 编码 + * 1.7.2 2026-03-28 * 修正 macOS、Windows、Compose 与 Kubernetes 章节中的时效性内容和错误前提 * 收缩越界网络内容，补充 bind mount、tmpfs 与端口映射的关键限制说明 diff --git a/SUMMARY.md b/SUMMARY.md index 3d4f9f4..11c6291 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -1,6 +1,6 @@ ## 目录 -* [前言](README.md) +* [Docker 从入门到实践](README.md) * [修订记录](CHANGELOG.md) * [如何贡献](CONTRIBUTING.md) diff --git a/package.json b/package.json index 9cf81ec..431056e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "docker_practice", - "version": "1.7.2", + "version": "1.9.2", "description": "docker_practice", "main": "index.js", "devDependencies": { @@ -9,7 +9,7 @@ "vuepress-theme-hope": "^1.0.0" }, "scripts": { - "test": "echo \"Error: no test specified\" && exit 1", + "test": "node scripts/check_metadata.js", "mdpress:help": "mdpress --help", "build": "rm -rf _site _site_site && mdpress build --format site --output _site && rm -rf _site && mv _site_site _site", "serve": "mdpress serve", @@ -23,7 +23,7 @@ "url": "git+https://github.com/yeasy/docker_practice.git" }, "author": "", - "license": "ISC", + "license": "CC-BY-NC-SA-4.0", "bugs": { "url": "https://github.com/yeasy/docker_practice/issues" }, diff --git a/scripts/check_metadata.js b/scripts/check_metadata.js new file mode 100644 index 0000000..eef17bc --- /dev/null +++ b/scripts/check_metadata.js @@ -0,0 +1,15 @@ +const fs = require('fs'); + +const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); +const changelog = fs.readFileSync('CHANGELOG.md', 'utf8'); +const readme = fs.readFileSync('README.md', 'utf8'); + +const topVersion = changelog.match(/^\* ([0-9]+\.[0-9]+\.[0-9]+)\b/m)?.[1]; + +if (pkg.version !== topVersion) { + throw new Error(`package.json version ${pkg.version} does not match CHANGELOG ${topVersion}`); +} + +if (pkg.license !== 'CC-BY-NC-SA-4.0' || !readme.includes('CC BY-NC-SA 4.0')) { + throw new Error('package.json license must match README license'); +}