sqlite-web 0.7.2
gitea.db
action_run_job
Create
Query
access
access_token
action
action_artifact
action_run
action_run_index
action_run_job
action_runner
action_runner_token
action_schedule
action_schedule_spec
action_task
action_task_output
action_task_step
action_tasks_version
action_variable
app_state
attachment
auth_token
badge
branch
collaboration
comment
commit_status
commit_status_index
commit_status_summary
commit_sync_log
commit_sync_status
dbfs_data
dbfs_meta
deploy_key
email_address
email_hash
external_login_user
follow
gpg_key
gpg_key_import
hook_task
issue
issue_assignees
issue_content_history
issue_dependency
issue_index
issue_label
issue_pin
issue_user
issue_watch
label
language_stat
lfs_lock
lfs_meta_object
login_source
milestone
mirror
notice
notification
oauth2_application
oauth2_authorization_code
oauth2_grant
org_user
package
package_blob
package_blob_upload
package_cleanup_rule
package_file
package_property
package_version
project
project_board
project_issue
protected_branch
protected_tag
public_key
pull_auto_merge
pull_request
push_mirror
reaction
release
renamed_branch
repo_archiver
repo_hidden_file
repo_indexer_status
repo_license
repo_redirect
repo_topic
repo_transfer
repo_unit
repository
review
review_state
secret
session
sqlite_sequence
star
stopwatch
system_setting
task
team
team_invite
team_repo
team_unit
team_user
topic
tracked_time
two_factor
upload
user
user_badge
user_blocking
user_open_id
user_redirect
user_setting
version
watch
webauthn_credential
webhook
Toggle helper tables
Structure
Content
Query
Insert
Drop
Import
Export
Delete row 18466 from action_run_job
id
18466
run_id
13602
repo_id
6
owner_id
5
commit_sha
2e3188c85a6cfc38ac7d3643b1cbbfc2e3e850d0
is_fork_pull_request
0
name
构建并推送镜像
attempt
1
workflow_payload
name: CI/CD Deploy "on": # test-pipeli
name: CI/CD Deploy "on": # test-pipeline 通过后自动触发（仅 main 分支） workflow_run: workflows: ["Test Pipeline"] types: [completed] branches: [main] # 版本标签触发完整部署 push: tags: ['v*'] # 手动触发 workflow_dispatch: inputs: environment: description: '部署环境' required: true default: 'staging' type: choice options: - staging - production - aliyun - rollback-production - rollback-aliyun skip_tests: description: '跳过测试（紧急修复）' required: false default: false type: boolean version: description: '部署版本号（留空使用自动版本）' required: false type: string env: IMAGE_PREFIX: ${{ github.repository_owner }}/juhi NODE_VERSION: "20" PNPM_VERSION: "8" REGISTRY: ghcr.io jobs: build-and-push: name: 构建并推送镜像 runs-on: ubuntu-latest if: >- always() && needs.gate.outputs.should_deploy == 'true' && needs.gate.outputs.is_rollback == 'false' && (needs.quick-check.result == 'success' || needs.quick-check.result == 'skipped') steps: - uses: actions/checkout@v4 - id: version name: 获取版本号 run: | if [[ "${{ github.ref }}" == refs/tags/* ]]; then VERSION=${GITHUB_REF#refs/tags/v} elif [ -n "${{ github.event.inputs.version }}" ]; then VERSION=${{ github.event.inputs.version }} else VERSION=$(date +%Y%m%d)-${{ github.run_number }} fi echo "version=$VERSION" >> $GITHUB_OUTPUT echo "short_sha=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT - name: 设置 Docker Buildx uses: docker/setup-buildx-action@v3 - name: 登录容器仓库 uses: docker/login-action@v3 with: password: ${{ secrets.GITHUB_TOKEN }} registry: ${{ env.REGISTRY }} username: ${{ github.actor }} - id: meta-api name: 后端镜像元数据 uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-api tags: | type=raw,value=${{ steps.version.outputs.version }} type=raw,value=latest type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=sha - name: 构建后端镜像 uses: docker/build-push-action@v5 with: build-args: NODE_ENV=production cache-from: type=gha cache-to: type=gha,mode=max context: . file: backend/Dockerfile labels: ${{ steps.meta-api.outputs.labels }} load: "true" push: "false" tags: ${{ steps.meta-api.outputs.tags }} - id: meta-frontend name: 前端镜像元数据 uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-frontend tags: | type=raw,value=${{ steps.version.outputs.version }} type=raw,value=latest type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=sha - name: 构建前端镜像 uses: docker/build-push-action@v5 with: build-args: VITE_API_BASE_URL=/api/v1 cache-from: type=gha cache-to: type=gha,mode=max context: . file: frontend/Dockerfile labels: ${{ steps.meta-frontend.outputs.labels }} load: "true" push: "false" tags: ${{ steps.meta-frontend.outputs.tags }} - id: trivy-api name: Trivy 扫描后端镜像 uses: aquasecurity/trivy-action@0.28.0 with: exit-code: "1" format: sarif image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-api:${{ steps.version.outputs.version }} output: trivy-api-results.sarif severity: HIGH,CRITICAL - id: trivy-frontend if: always() name: Trivy 扫描前端镜像 uses: aquasecurity/trivy-action@0.28.0 with: exit-code: "1" format: sarif image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-frontend:${{ steps.version.outputs.version }} output: trivy-frontend-results.sarif severity: HIGH,CRITICAL - if: always() name: 上传后端镜像安全扫描报告到 GitHub Security uses: github/codeql-action/upload-sarif@v3 with: category: trivy-deploy-api-image sarif_file: trivy-api-results.sarif - if: always() name: 上传前端镜像安全扫描报告到 GitHub Security uses: github/codeql-action/upload-sarif@v3 with: category: trivy-deploy-frontend-image sarif_file: trivy-frontend-results.sarif - id: trivy-gate if: always() name: 检查 Trivy 扫描结果 run: | if [ "${{ steps.trivy-api.outcome }}" != "success" ] || [ "${{ steps.trivy-frontend.outcome }}" != "success" ]; then echo "scan_passed=false" >> $GITHUB_OUTPUT echo "::error::Trivy 安全扫描未通过，阻断镜像推送" else echo "scan_passed=true" >> $GITHUB_OUTPUT fi - if: steps.trivy-gate.outputs.scan_passed == 'true' name: 推送后端镜像 run: | # 逐个推送 metadata-action 生成的所有标签 echo '${{ steps.meta-api.outputs.tags }}' | while IFS= read -r tag; do [ -n "$tag" ] && docker push "$tag" done - if: steps.trivy-gate.outputs.scan_passed == 'true' name: 推送前端镜像 run: | echo '${{ steps.meta-frontend.outputs.tags }}' | while IFS= read -r tag; do [ -n "$tag" ] && docker push "$tag" done - if: steps.trivy-gate.outputs.scan_passed != 'true' name: 扫描未通过时终止流水线 run: | echo "Trivy 扫描发现安全漏洞，镜像未推送" exit 1 - name: 输出构建信息 run: | echo "## 构建信息" >> $GITHUB_STEP_SUMMARY echo "- 版本: \`${{ steps.version.outputs.version }}\`" >> $GITHUB_STEP_SUMMARY echo "- 提交: \`${{ steps.version.outputs.short_sha }}\`" >> $GITHUB_STEP_SUMMARY timeout-minutes: "20" outputs: api-image: ${{ steps.meta-api.outputs.tags }} frontend-image: ${{ steps.meta-frontend.outputs.tags }} version: ${{ steps.version.outputs.version }} permissions: contents: read packages: write security-events: write # 上传 SARIF 安全报告所需权限
...
job_id
build-and-push
needs
["gate","quick-check"]
runs_on
["ubuntu-latest"]
task_id
15732
status
4
started
1776007347
stopped
1776007348
created
1776007339
updated
1776007348
raw_concurrency
is_concurrency_evaluated
1
concurrency_group
concurrency_cancel
0
Delete
Cancel