mirror of
https://github.com/nexu-io/open-design.git
synced 2026-06-01 03:14:35 +07:00
369d136d19
* Add Docker Compose deployment workflow * Address Docker deployment review feedback Harden publishing inputs and temporary credential handling, and tighten Docker runtime defaults requested by the PR review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix Docker publish build in CI mode Set CI=true during the image build so pnpm prune can run non-interactively inside Docker. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Fix Docker runtime dependency layout Use pnpm deploy for the daemon package so the runtime image includes production dependencies where Node resolves them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use legacy pnpm deploy in Docker build Allow pnpm v10 deploy to package the daemon workspace without requiring injected workspace packages. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Align Docker runtime with Node 24 Use Node 24 for both build and runtime stages and update image verification for the workspace daemon dependency layout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Remove legacy OD_HOST Docker binding fallback Use OD_BIND_HOST as the single daemon bind-host setting for Docker deployment and origin validation. * Update Docker image verifier for daemon dist runtime Check the packaged daemon dist entrypoint and allow npm from the Node 24 runtime image while still rejecting build-only tools. * Allow private LAN browser origins for daemon * Share daemon origin validation helpers Move browser origin validation into a shared daemon module so tests exercise the production logic and cover the remaining private LAN edge cases. * Harden Docker Compose port exposure Bind the Compose deployment to localhost by default and pass the published port through to the daemon origin checks so host-port overrides remain same-origin. * Keep deployment hosts out of local-only no-origin checks Require an actual matching Origin before configured deployment origins can satisfy local-only daemon guards, preventing no-Origin remote clients from bypassing those checks. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: mrcfps <mrc@powerformer.com> Co-authored-by: lefarcen <935902669@qq.com>
30 lines
871 B
Bash
Executable file
30 lines
871 B
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ $# -lt 1 || $# -gt 2 ]]; then
|
|
echo "usage: $0 <image-ref> [expected-platforms]" >&2
|
|
exit 64
|
|
fi
|
|
|
|
IMAGE_REF="$1"
|
|
EXPECTED_PLATFORMS="${2:-linux/amd64,linux/arm64}"
|
|
|
|
inspect_output="$(skopeo inspect --raw "docker://${IMAGE_REF}")"
|
|
printf '%s\n' "$inspect_output"
|
|
|
|
missing=0
|
|
IFS=',' read -r -a expected <<<"$EXPECTED_PLATFORMS"
|
|
for platform in "${expected[@]}"; do
|
|
os="${platform%/*}"
|
|
arch="${platform#*/}"
|
|
if ! jq -e --arg os "$os" --arg arch "$arch" '
|
|
(.mediaType == "application/vnd.docker.distribution.manifest.list.v2+json" or
|
|
.mediaType == "application/vnd.oci.image.index.v1+json") and
|
|
any(.manifests[]?; .platform.os == $os and .platform.architecture == $arch)
|
|
' >/dev/null <<<"$inspect_output"; then
|
|
echo "missing platform in manifest: $platform" >&2
|
|
missing=1
|
|
fi
|
|
done
|
|
|
|
exit "$missing"
|