Skip to content
Open

Dev #117

Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .dockerignore
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,15 @@
.vscode
node_modules
npm-debug.log
yarn.lock
composer.phar
var/cache
var/logs
var/log
var/sessions
.env
Dockerfile*
docker-compose*.yml
**/.DS_Store
**/Thumbs.db
vendor/
public/build
58 changes: 58 additions & 0 deletions .github/workflows/docker-publish.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
name: Build And Publish Container

on:
push:
branches:
- main
- dev
tags:
- 'v*'
workflow_dispatch:

env:
# todo: change to phplist dockerhub
DOCKERHUB_IMAGE: tatevikg1/phplist4

jobs:
docker:
runs-on: ubuntu-22.04
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify all `uses:` entries in workflows and find non-SHA refs.
rg -n --type=yaml '^\s*uses:\s*[^@]+@' .github/workflows \
  | rg -n -v '@[0-9a-fA-F]{40}$'

Repository: phpList/base-distribution

Length of output: 798


🏁 Script executed:

cat -n .github/workflows/docker-publish.yml | head -60

Repository: phpList/base-distribution

Length of output: 1947


Pin GitHub Actions to immutable SHAs instead of floating version tags.

Using floating major tags for build/publish actions increases supply-chain risk. Pin all uses: entries to full commit SHAs.

Lines 23, 26, 29, 33, 40, 50 currently use:

  • actions/checkout@v4
  • docker/setup-qemu-action@v3
  • docker/setup-buildx-action@v3
  • docker/login-action@v3
  • docker/metadata-action@v5
  • docker/build-push-action@v6

Replace with specific SHAs (e.g., actions/checkout@a5ac7e51b41094c5405359c7b978efb3c90df8be).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-publish.yml at line 23, The workflow currently uses
floating tags for actions (e.g., actions/checkout, docker/setup-qemu-action,
docker/setup-buildx-action, docker/login-action, docker/metadata-action,
docker/build-push-action); replace each `uses:` entry with the corresponding
immutable commit SHA (pin to a full commit ref like actions/checkout@<SHA>) to
reduce supply-chain risk, updating all occurrences of those symbols in the
workflow file (the instances referenced in the review) so none remain on
major/minor tags.


- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to Docker Hub
if: github.event_name != 'pull_request'
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.DOCKERHUB_IMAGE }}
tags: |
type=raw,value=latest,enable={{is_default_branch}}
type=raw,value=test,enable=${{ github.ref == 'refs/heads/dev' }}
type=ref,event=tag
type=sha,prefix=sha-

- name: Build and push image
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}

1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
/public/
/var/
/vendor/
/node_modules/
.DS_Store
.vagrant
.phpunit.result.cache
13 changes: 11 additions & 2 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,18 @@ RUN apt-get update \
&& apt-get install -y --no-install-recommends \
git unzip libzip-dev libicu-dev libpng-dev libonig-dev libxml2-dev \
libc-client2007e-dev libkrb5-dev libssl-dev libpq-dev \
libfreetype6-dev libjpeg62-turbo-dev \
&& docker-php-ext-configure intl \
&& docker-php-ext-configure imap --with-kerberos --with-imap-ssl \
&& docker-php-ext-configure gd --with-freetype --with-jpeg \
&& docker-php-ext-install -j"$(nproc)" \
pdo pdo_mysql pdo_pgsql zip intl imap \
pdo pdo_mysql pdo_pgsql zip intl imap gd \
&& rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
&& apt install -y nodejs \
&& npm install -g yarn

# Enable Apache modules and set DocumentRoot to /public
RUN a2enmod rewrite headers \
&& sed -ri 's!/var/www/html!/var/www/html/public!g' /etc/apache2/sites-available/000-default.conf \
Expand All @@ -25,7 +31,7 @@ RUN a2enmod rewrite headers \
&& a2enconf phplist

# Copy composer definition first and install dependencies
COPY composer.json composer.lock ./
COPY composer.json composer.lock package.json yarn.lock ./

# Install Composer
ENV COMPOSER_ALLOW_SUPERUSER=1 \
Expand Down Expand Up @@ -53,6 +59,9 @@ RUN chown -R www-data:www-data var public \
&& find var -type d -exec chmod 775 {} \; \
&& find var -type f -exec chmod 664 {} \;

# Build frontend assets once, during image build
RUN composer run-script build-web-frontend-assets

# Expose port and run Apache
EXPOSE 80
CMD ["apache2-foreground"]
8 changes: 8 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,14 @@ You can get a list of all installed phpList modules with this command:
composer run-script list-modules
```

To compile and publish the `phplist/web-frontend` assets into
`public/build` (used by the web frontend Twig templates),
run:

```bash
composer run-script build-web-frontend-assets
```


## Creating a .tar.gz package of this distribution

Expand Down
14 changes: 12 additions & 2 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,9 @@
"phplist/rest-api": "dev-main",
"phplist/web-frontend": "dev-main",
"doctrine/orm": "^3.3",
"tatevikgr/rest-api-client": "dev-ISSUE-357",
"tatevikgr/rss-feed": "dev-main as 0.1.0"
"tatevikgr/rest-api-client": "dev-main",
"tatevikgr/rss-feed": "dev-main as 0.1.0",
"nelmio/cors-bundle": "^2.6"
},
"require-dev": {
"phpunit/phpunit": "^9.6.33",
Expand Down Expand Up @@ -90,6 +91,10 @@
"php bin/console cache:clear",
"php bin/console cache:warmup"
],
"build-web-frontend-assets": [
"yarn install",
"yarn build:web-frontend"
],
"post-install-cmd": [
"@create-directories",
"@update-configuration"
Expand All @@ -104,6 +109,11 @@
]
},
"extra": {
"phplist/core": {
"bundles": [
"Nelmio\\CorsBundle\\NelmioCorsBundle"
]
},
"symfony-app-dir": "bin",
"symfony-bin-dir": "bin",
"symfony-var-dir": "var",
Expand Down
Loading
Loading