mirror of
https://github.com/infiniflow/ragflow.git
synced 2025-12-31 09:05:30 +08:00
Potential fix for [https://github.com/infiniflow/ragflow/security/code-scanning/62](https://github.com/infiniflow/ragflow/security/code-scanning/62) In general, the fix is to explicitly declare a `permissions:` block so the GITHUB_TOKEN used by this workflow only has the scopes required: read access to repository contents and write access to contents/releases. Since this workflow creates or moves tags and creates/overwrites releases via `softprops/action-gh-release`, it needs `contents: write`. There is no evidence that it needs other elevated scopes (issues, pull-requests, actions, etc.), so these should remain at their default of `none` by omission. The best minimal fix without changing existing functionality is to add a workflow-level `permissions:` block near the top of `.github/workflows/release.yml`, after `name:` and before `on:` (or anywhere at the root level, but this is conventional). This will apply to all jobs (there is only `jobs.release`) and ensure that the GITHUB_TOKEN has only `contents: write`. No additional imports or methods are needed because this is a YAML configuration change only. Concretely: - Edit `.github/workflows/release.yml`. - Insert: ```yaml permissions: contents: write ``` between line 2 (empty line after `name: release`) and line 3 (`on:`). No other lines need to be changed. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
99 lines
4.3 KiB
YAML
99 lines
4.3 KiB
YAML
name: release
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 13 * * *' # This schedule runs every 13:00:00Z(21:00:00+08:00)
|
|
# https://github.com/orgs/community/discussions/26286?utm_source=chatgpt.com#discussioncomment-3251208
|
|
# "The create event does not support branch filter and tag filter."
|
|
# The "create tags" trigger is specifically focused on the creation of new tags, while the "push tags" trigger is activated when tags are pushed, including both new tag creations and updates to existing tags.
|
|
push:
|
|
tags:
|
|
- "v*.*.*" # normal release
|
|
|
|
# https://docs.github.com/en/actions/using-jobs/using-concurrency
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: [ "self-hosted", "ragflow-test" ]
|
|
steps:
|
|
- name: Ensure workspace ownership
|
|
run: echo "chown -R ${USER} ${GITHUB_WORKSPACE}" && sudo chown -R ${USER} ${GITHUB_WORKSPACE}
|
|
|
|
# https://github.com/actions/checkout/blob/v6/README.md
|
|
- name: Check out code
|
|
uses: actions/checkout@v6
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }} # Use the secret as an environment variable
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
|
|
- name: Prepare release body
|
|
run: |
|
|
if [[ ${GITHUB_EVENT_NAME} != "schedule" ]]; then
|
|
RELEASE_TAG=${GITHUB_REF#refs/tags/}
|
|
if [[ ${RELEASE_TAG} == v* ]]; then
|
|
PRERELEASE=false
|
|
else
|
|
PRERELEASE=true
|
|
fi
|
|
echo "Workflow triggered by create tag: ${RELEASE_TAG}"
|
|
else
|
|
RELEASE_TAG=nightly
|
|
PRERELEASE=true
|
|
echo "Workflow triggered by schedule"
|
|
fi
|
|
echo "RELEASE_TAG=${RELEASE_TAG}" >> ${GITHUB_ENV}
|
|
echo "PRERELEASE=${PRERELEASE}" >> ${GITHUB_ENV}
|
|
RELEASE_DATETIME=$(date --rfc-3339=seconds)
|
|
echo Release ${RELEASE_TAG} created from ${GITHUB_SHA} at ${RELEASE_DATETIME} > release_body.md
|
|
|
|
- name: Move the existing mutable tag
|
|
# https://github.com/softprops/action-gh-release/issues/171
|
|
run: |
|
|
git fetch --tags
|
|
if [[ ${GITHUB_EVENT_NAME} == "schedule" ]]; then
|
|
# Determine if a given tag exists and matches a specific Git commit.
|
|
# actions/checkout@v6 fetch-tags doesn't work when triggered by schedule
|
|
if [ "$(git rev-parse -q --verify "refs/tags/${RELEASE_TAG}")" = "${GITHUB_SHA}" ]; then
|
|
echo "mutable tag ${RELEASE_TAG} exists and matches ${GITHUB_SHA}"
|
|
else
|
|
git tag -f ${RELEASE_TAG} ${GITHUB_SHA}
|
|
git push -f origin ${RELEASE_TAG}:refs/tags/${RELEASE_TAG}
|
|
echo "created/moved mutable tag ${RELEASE_TAG} to ${GITHUB_SHA}"
|
|
fi
|
|
fi
|
|
|
|
- name: Create or overwrite a release
|
|
# https://github.com/actions/upload-release-asset has been replaced by https://github.com/softprops/action-gh-release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }} # Use the secret as an environment variable
|
|
prerelease: ${{ env.PRERELEASE }}
|
|
tag_name: ${{ env.RELEASE_TAG }}
|
|
# The body field does not support environment variable substitution directly.
|
|
body_path: release_body.md
|
|
|
|
- name: Build and push image
|
|
run: |
|
|
sudo docker login --username infiniflow --password-stdin <<< ${{ secrets.DOCKERHUB_TOKEN }}
|
|
sudo docker build --build-arg NEED_MIRROR=1 --build-arg HTTPS_PROXY=${HTTPS_PROXY} --build-arg HTTP_PROXY=${HTTP_PROXY} -t infiniflow/ragflow:${RELEASE_TAG} -f Dockerfile .
|
|
sudo docker tag infiniflow/ragflow:${RELEASE_TAG} infiniflow/ragflow:latest
|
|
sudo docker push infiniflow/ragflow:${RELEASE_TAG}
|
|
sudo docker push infiniflow/ragflow:latest
|
|
|
|
- name: Build and push ragflow-sdk
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
cd sdk/python && uv build && uv publish --token ${{ secrets.PYPI_API_TOKEN }}
|
|
|
|
- name: Build and push ragflow-cli
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
cd admin/client && uv build && uv publish --token ${{ secrets.PYPI_API_TOKEN }}
|