Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create Automatic Docker deployment #578

Closed
wants to merge 4 commits into from

Conversation

Anunayj
Copy link
Contributor

@Anunayj Anunayj commented Mar 19, 2021

Adds Automatic docker builds using Github Actions.
Image tags used:

latest: For the latest commit, only built if npm ci passes. (ran after Build workflow)
lts: For latest tagged release.
*tag*: Specific version/tag on git, will build whenever a commit with new tag is pushed.

DOCKERHUB_USERNAME and DOCKERHUB_TOKEN GitHub secrets need to be set.

Images for the following platforms are made: linux/amd64, linux/arm64, linux/arm using the Dockerfile at root of repo.
(Both Windows and Mac users should be able to run these easily)

@coveralls
Copy link

coveralls commented Mar 19, 2021

Pull Request Test Coverage Report for Build 676929608

  • 14 of 19 (73.68%) changed or added relevant lines in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage increased (+0.1%) to 59.685%

Changes Missing Coverage Covered Lines Changed/Added Lines %
lib/wallet/rpc.js 14 19 73.68%
Totals Coverage Status
Change from base Build 661852759: 0.1%
Covered Lines: 19659
Relevant Lines: 30681

💛 - Coveralls

@Anunayj Anunayj closed this Mar 23, 2021
@Anunayj
Copy link
Contributor Author

Anunayj commented Mar 23, 2021

Docker builds in their current state look like a security issue, since it's very hard to verify the contents of the docker image to be trustworthy, furthermore Docker Repos like DockerHub provide next to no protection against account compromises. (If account token get's leaked user can push/overwrite any tag).

There are ways to remedy this using Docker Content Trust. trusted contributers can sign images to indicate their trust (after verifying it's contents manually) and users can be told to verify signatures when pulling a image. The biggest problem with this method is, both the steps are manual (Unless you set a global docker flag to verify ALL images), and it is very likely that people will skip these steps.

For right now it is best to encourage users to fork this project and make their own Docker builds.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants