nmemmertandClaude Sonnet 5.5
f18d9dd7a9
build-container / build (push) Successful in 2m20s
- Accounts: the setup code (or an existing single-user install, migrated automatically) creates the admin; the admin adds people in Settings -> People and gives each a one-time invite code to enrol their own passkey - Each person's tasks, NE Hub events and subscribe link, settings, calendar links, iCloud connection and Plex sign-in are private, stored in their own folder (/data/users/<id>/); Plex sign-in moved from browser cookies into that folder (encrypted), so it also follows them across devices - Tab access is enforced by the server (403) and reflected in the app (nav, Home, Settings, search, /api/config hides addresses of tabs a person cannot use); browser storage is namespaced per person - Admin tools: change tabs, invite a device, sign out everywhere (session epoch), turn off, make/remove admin, delete a person and their data; the last admin cannot be removed - Sessions carry the person (uid.epoch.expiry.signature); old single-user cookies still work as the admin - tools/users-test.js (83 checks: isolation, access limits, invites, sign-out/disable/delete, Plex and iCloud per person, migration) now runs in the Gitea workflow before the image is built Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
name: build-container
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Start the real server and call every endpoint; a missing function or a crash stops the build here.
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
- run: npm ci
|
|
- run: node tools/smoke-test.js
|
|
- run: node tools/users-test.js # accounts: private data, tab limits, invites, migration
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
# Repo secrets needed (Settings -> Actions -> Secrets):
|
|
# REGISTRY_TOKEN a Gitea access token with write:package scope
|
|
# REGISTRY_USER optional; defaults to the user who pushed
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: git.necloud.us
|
|
username: ${{ secrets.REGISTRY_USER || gitea.actor }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: git.necloud.us/nate/hub
|
|
tags: |
|
|
type=raw,value=latest,enable={{is_default_branch}}
|
|
type=sha,format=short
|
|
type=ref,event=tag
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=registry,ref=git.necloud.us/nate/hub:buildcache
|
|
cache-to: type=registry,ref=git.necloud.us/nate/hub:buildcache,mode=max
|