ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 16:37:34 +00:00
Code Issues Projects Releases Wiki Activity
1,601 Commits 5 Branches 34 Tags
52f6c7347878ecf39000f48e2edb41d49a8e1932
Commit Graph
90 Commits
Author SHA1 Message Date
yeasy 52f6c73478 ci: bound every workflow job with timeout-minutes 
A wedged Chrome/mdPress step held a harness runner for 27 minutes yesterday
(normal run: ~4 min) and ignored `gh run cancel`; it only stopped because that
job happened to carry timeout-minutes: 30. An audit found 66 of the 101 jobs
across the cluster had no timeout at all — the same hang there would have held
a runner for GitHub's 6-hour default.

Values come from measured run history, not guesses. Across ~120 successful
runs the slowest workflow tops out at 10 min (Update Preview Publications),
CI at 6.5, Update Preview PDF at 4.8:

  30 min — jobs that run Chrome/mdPress/pandoc (3x the observed max, and the
           value harness already used)
  15 min — release, publish, deploy, check-link, chaincode-tests
  10 min — dependabot auto-merge

Every value has at least 6x headroom over its job's observed maximum, so this
should never turn a slow-but-working run into a failure.

Verified: all 72 workflow files still parse, and all 101 jobs now carry an
integer timeout in range.
 2026-07-23 08:26:48 -07:00
yeasy d705dfb631 fix(ci): make the Mermaid fail-closed guard actually fire 
The guard added earlier could never trigger. tools/render_mermaid.py has no
nonzero exit path — its own docstring said "Exits 0 even if some/all fail
(non-fatal)" — so `if ! render_mermaid.py ...; then exit 1; fi` never ran its
body, and a build that rendered zero diagrams still passed. Reproduced by
running the script with no Chrome on PATH: it printed the fallback warning and
exited 0.

Adds a --strict flag that exits 1 when Chrome is missing or any diagram fails
to render, and passes it from every workflow invocation. The default stays
lenient so local mobile-reader builds keep working, which is what the exit-0
behaviour was actually for.

Verified both directions: with no Chrome, --strict exits 1 and the default
exits 0; against the real book with Chrome, --strict renders every diagram and
exits 0.
 2026-07-23 07:40:28 -07:00
yeasy 1c8f0dc14d chore: remove the remaining VuePress artifacts 
Follows the devDependency removal. The build has been mdPress-only since
1.7.0 and nothing referenced these:

- .vuepress/ (config.js + .gitignore). The mirror it configured is still
  live, but no workflow in this repo builds or deploys it, so this was a
  recipe nobody ran. Local .vuepress/dist/ (400 files of Feb-2026 build
  output, never tracked) was removed from the working tree too — with its
  .gitignore gone it would otherwise have shown up as untracked noise.
- docker-compose.yml: the vuepress-offline service, plus the now-unused
  &mdpress-offline anchor that existed only to feed it.
- README: the 'docker run ... :vuepress' one-liner. That tag was last
  pushed 2022-06-25, so readers following it got a four-year-old snapshot
  of the book. 'mdpress serve' immediately above it still works.
- CODEOWNERS, .zhlintignore and check_project_rules.py entries for the
  deleted directory, and the check-link allowlist entry for the mirror
  (no content links to it).

The CHANGELOG entry recording the original CI removal is left alone — it
is history.

Verified: npm test passes (3 + 35), check_project_rules passes 202 files,
docker-compose.yml still parses with no dangling YAML aliases.
 2026-07-22 22:51:34 -07:00
yeasy a42f94faad ci: add timeout-minutes to Identity Guard 
harness_engineering_guide 的 lab/tests/unit/test_project_configuration.py 要求
每个工作流都写 timeout-minutes，我漏了，导致该仓库 CI 变红。

漏检原因值得记一笔：我本地批量跑测试时用的是 `ls tests/test_*.py`，
而 harness 的测试在 lab/tests/ 下、且用 pytest，这个 glob 一个都没匹配到，
于是它被静默报成"OK"。应当按各仓库 ci.yaml 里真正的测试命令来跑。

timeout-minutes 本身也是好实践：避免作业异常时空转到默认上限。
统一给 14 个仓库都加上，与该测试的其余约束（SHA 固定、禁 continue-on-error、
checkout 不持久化凭据）保持一致。
 2026-07-22 16:04:50 -07:00
yeasy 38c89065b6 ci: fix Identity Guard trigger — it was never actually running 
上一版给 push 只写了 tags-ignore: ['**']，本意是让发布 tag 不再触发一次
重复的全量审计。但 GitHub 的过滤规则是"只给了 tag 过滤器，就只在 tag 上跑"，
因此这条配置的真实含义变成"只跑 tag，但忽略所有 tag" —— 工作流一次都不会触发。

症状很有迷惑性：工作流在 API 里状态是 active、名字也正常显示，
只是 runs 数恒为 0，同一次推送里 CI 和 Preview 都正常跑。
改为 branches: ['**']，覆盖全部分支且天然排除 tag，达到原本的意图。

教训记一句：光看"工作流已注册/active"不能算验证，必须确认它真的产生了 run。
 2026-07-22 15:37:50 -07:00
yeasy 3781d9c382 ci: fix a latent false negative and cut Identity Guard runtime 50s to 1s 
两处都是本地实测发现的，不是推测。

1) 漏判（正确性）：尾注预筛写成 `git log --format=%B "$RANGE" | grep -qiE`，
   在 `set -o pipefail` 下 grep -q 命中即退出，左侧 git log 收到 SIGPIPE，
   整条管道返回非 0，if 判定为"没命中"从而跳过整个尾注检查。
   实测：沙箱里 8 条应报错误只报出 6 条，两个带 AI 尾注的提交被静默放过。
   改为 here-string（不再有管道），身份预筛同样改掉以杜绝这一类问题。

2) 性能：全量审计路径（新建分支推送、workflow_dispatch）原先为每个提交
   各起一个 git 子进程，docker_practice 1,592 个提交实测 50 秒。
   现在先用一次 git log 流式预筛，只有命中时才逐个提交定位；
   同一仓库实测降到 1 秒，且不改变任何判定结果。

回归验证：被删分支的真实 4 个提交在 push / pull_request / 新建分支三种
形态下仍全部拦下；专门构造的 2,502 提交仓库（身份流 258KB，远超管道缓冲区）
中埋在末尾的 AI 提交能被检出；14 个仓库完整历史仍然零误报；
范围解析失败仍 fail closed，删除分支仍正确放行。
 2026-07-22 15:34:52 -07:00
yeasy f82e13017d ci: add Identity Guard rejecting AI-assistant commit attribution 
起因：blockchain_guide 上曾有一个 claude/novel-content-extraction-r0wys3
分支，4 个提交的 author 和 committer 都是 Claude <noreply@anthropic.com>
（内容还是与本书无关的小说抓取脚本）。分支已删除，但暴露出一个缺口：
既有的 .git/hooks/commit-msg 只查提交信息里的 Co-authored-by 尾注，
查不到身份字段；而且本地钩子不随仓库分发，那 4 个提交来自云端会话，
根本不经过本地钩子。

因此把闸门放到服务端：本工作流在 push 与 pull_request 上扫描本次新增
提交的 author/committer 身份与 Co-authored-by 尾注，命中即失败。
本地另配 pre-commit（拦当前身份）与 pre-push（拦 cherry-pick/rebase
带进来的外来提交）作为纵深防御，二者不入库。

判定刻意收窄，避免误伤本仓库群里大量讨论 Claude/Codex 的正文：
只检查身份字段与行首锚定的 Co-authored-by 尾注，绝不扫描自由文本；
姓名要求全等（"Claude Dubois" 这样的真人不受影响），邮箱按厂商域名
（含子域）匹配，并覆盖 claude[bot] 这类 GitHub App 身份。

已验证：
- 用被删分支的真实 4 个提交做回归，push / pull_request / 新建分支
  三种到达形态全部拦下；
- 全部 14 个仓库的完整历史（5,715 个提交，含 docker_practice 1,591
  个多人历史与 claude_guide 339 个满是 Claude 的提交）零误报；
- dependabot 的 Co-authored-by、真人 Claude Dubois、正文提到
  co-authored-by 但非尾注的提交，均正确放行；
- 范围解析不出来时 fail closed，只有确实没有 head 提交（删分支）才放行；
- tags-ignore 避免发布 tag 触发一次重复的全量审计。
 2026-07-22 15:24:38 -07:00
dependabot[bot]andGitHub fe46145e4a chore(deps): bump actions/checkout in the dependencies group 
Bumps the dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-22 18:44:00 +00:00
dependabot[bot]andGitHub 937ad3f1c3 chore(deps): bump softprops/action-gh-release in the dependencies group 
Bumps the dependencies group with 1 update: [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 18:43:44 +00:00
yeasy 2ef6d80d4f fix(ci): make publication checks runner-safe 2026-07-11 06:44:12 -07:00
yeasy 397c66673b fix(ci): fail closed on preview lookup errors 2026-07-10 19:29:30 -07:00
yeasy 8cd6094ae9 fix(ci): keep preview tag current 2026-07-10 19:29:30 -07:00
yeasy ee0fbd7d38 fix(ci): attest releases and validate offline examples 2026-07-10 19:29:30 -07:00
yeasy daa6661b2b fix(ci): harden publishing and validate examples 2026-07-10 19:29:30 -07:00
yeasy bd944a2383 fix(ci): embed local images for PDF builds 2026-07-05 19:30:30 +08:00
dependabot[bot]andGitHub 9058882b73 chore(deps): bump the dependencies group across 1 directory with 2 updates 
Bumps the dependencies group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-30 12:18:26 +00:00
yeasy 68fec82301 ci: sanitize auto-release artifact tag names 2026-06-24 15:39:30 +08:00
yeasy a601794cd4 ci: guard manual auto-release tag name 2026-06-21 15:53:28 +08:00
yeasy 2bcc83dcf4 ci: build and attach HTML reader to each release 
Renders Mermaid to SVG via the workflow's Chrome, pandoc --mathml, assembles a
single self-contained responsive HTML reader, and attaches <repo>-<tag>.html to
the GitHub Release next to the PDF. Non-blocking (continue-on-error).
 2026-06-21 10:14:47 +08:00
yeasy 9fdffa9d91 fix(content): harden Docker practice guide 2026-06-16 21:23:21 -07:00
yeasy 7abaff237a test: add project rules check 2026-05-18 22:37:02 -07:00
yeasy 1c4e0538d8 Fix CI PDF order 2026-05-18 08:06:51 -07:00
yeasy 0b8f6e9b60 Refresh metadata and workflows 2026-05-18 07:38:58 -07:00
yeasy 2cea196860 Replace chromium-browser snap with setup-chrome 2026-05-08 04:19:18 +00:00
dependabot[bot]andGitHub 9e194b9a74 chore(deps): bump the dependencies group with 2 updates 
Bumps the dependencies group with 2 updates: [softprops/action-gh-release](https://github.com/softprops/action-gh-release) and [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata).


Updates `softprops/action-gh-release` from 2 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3)

Updates `dependabot/fetch-metadata` from 2 to 3
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/v2...v3)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: dependabot/fetch-metadata
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-15 18:46:44 +00:00
yeasy aec453b9bb Remove duplicate release-pdf workflow 2026-04-05 08:55:52 -07:00
yeasy 565b40ab0b Add release-pdf CI workflow for automated PDF builds 2026-04-05 08:29:11 -07:00
yeasy c84927c196 ci: add auto-release.yml, remove release-pdf.yml, limit CI trigger to master 2026-04-05 07:57:56 -07:00
yeasy 59bfe9cff6 Rename preview PDF 2026-03-28 21:12:58 -07:00
yeasy 74c90a245d Auth mdpress API 2026-03-28 20:46:16 -07:00
yeasy 137d161480 Add preview PDF 2026-03-28 20:42:25 -07:00
yeasy c69a625a46 Update release workflow with PDF tag naming 2026-03-27 11:18:08 -07:00
yeasy fee861702c Add PDF build to CI workflow 2026-03-27 11:05:47 -07:00
yeasy 8e5468e8c2 Add CJK font support to CI 2026-03-26 08:42:40 -07:00
yeasy d6abed17da Simplify CI to mdpress only 2026-03-25 21:57:30 -07:00
dependabot[bot]andGitHub d494a19614 chore(deps): bump the dependencies group with 2 updates 
Bumps the dependencies group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 18:46:02 +00:00
yeasy ae9dd59355 Clean mdpress CI 2026-03-24 21:41:15 -07:00
yeasy 8ecf729198 Migrate docs to mdpress 2026-03-24 21:25:04 -07:00
Baohua Yang 8e8c554482 fix: update docker-compose V1 syntax to V2 and add release PDF workflow 
Replace remaining docker-compose command references with docker compose (V2).
Add GitHub Actions workflow to auto-generate PDF via mdpress on release.
 2026-03-19 20:21:06 -07:00
yeasy e219abe45e Fix CI build to use honkit directly 2026-03-17 00:23:32 -07:00
dependabot[bot]andGitHub 5fd3a46033 chore(deps): bump actions/checkout from 4.1.1 to 6.0.2 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.1.1...v6.0.2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-28 03:30:50 +00:00
Baohua Yang c600eb4a5c Allow auto bump dependencies 2026-02-27 19:30:13 -08:00
Baohua Yang 5e8d7252be Simplify words and fix format issues 2026-02-24 22:01:02 -08:00
Baohua Yang 492a921b31 fix: ensure directories exist in CI before copying 2026-02-15 15:12:17 -08:00
Baohua Yang 1af947392c release v1.5.3: fix CI image paths and update config 2026-02-15 09:09:02 -08:00
Baohua Yang 961fa2a033 fix: remove non-existent advanced_network/_images from CI 2026-01-30 16:08:28 -08:00
CybCom e9cef8e474 refactor(workflows): 💚 Update the YAMLs for GitHub workflows 
Update the out dated action version. Remove redundant/useless lines. Some other updates.
 2023-12-23 01:01:32 +08:00
CybCom 2c9ec19017 ci(workflows): 💚 Try to confirm and fix CI error:0308010C 
There might be a conflict between the new version node.js and this project's dependencies, according to CI Error message "error:0308010C:digital envelope routines::unsupported". Try to confirm and fix it by specifying the old styled openssl.
 2023-12-22 18:27:38 +08:00
Kang Huaishuai 8172936f19 remove deprecated features: machine and swarm 
Signed-off-by: Kang Huaishuai <khs1994@khs1994.com>
 2021-07-16 12:43:50 +08:00
Kang Huaishuai ba2940b167 Update minio case 
Signed-off-by: Kang Huaishuai <khs1994@khs1994.com>
 2021-07-15 13:29:08 +08:00