diff --git a/.github/workflows/build-containers.yml b/.github/workflows/build-containers.yml index c2bebd3df..69a1066af 100644 --- a/.github/workflows/build-containers.yml +++ b/.github/workflows/build-containers.yml @@ -5,6 +5,16 @@ name: 🐳 Build Containers on: release: types: [published] + push: + branches: [main, master] + paths: + - 'VERSION' + - 'frontend/package.json' + - 'backend/go.mod' + workflow_run: + workflows: ["🚀 Release Management"] + types: [completed] + branches: [main, master] workflow_dispatch: inputs: tag: @@ -22,6 +32,7 @@ jobs: build-and-push: name: 🐳 Build & Push Images runs-on: ubuntu-latest + if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' strategy: matrix: @@ -99,7 +110,7 @@ jobs: platforms: linux/amd64,linux/arm64 build-args: | VERSION=${{ github.sha }} - BUILD_DATE=${{ github.event.head_commit.timestamp || github.event.release.created_at }} + BUILD_DATE=${{ github.event.head_commit.timestamp || github.event.release.created_at || github.event.repository.pushed_at }} - name: Build and push (Frontend) if: matrix.component == 'frontend' @@ -125,7 +136,7 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v3 - if: always() + if: always() && hashFiles('trivy-results.sarif') != '' with: sarif_file: 'trivy-results.sarif' diff --git a/backend/Dockerfile b/backend/Dockerfile index f62ed8ee8..05fd73081 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.23-alpine@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f AS builder +FROM golang:1.24-alpine AS builder # Add security updates and build tools RUN apk --no-cache add git ca-certificates tzdata diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 7d4bbf083..767cc6ec7 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -8,8 +8,8 @@ WORKDIR /app # Copy package files first for better caching COPY package*.json ./ -# Install dependencies with clean install -RUN npm ci --only=production --no-audit --no-fund +# Install dependencies with clean install (including dev dependencies for build) +RUN npm ci --no-audit --no-fund # Copy source code COPY . .