Merge pull request #82 from vbrandl/maintenance

Maintenance

.github/workflows/audit.yml

@@ -0,0 +1,26 @@
+name: Security Audit
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - "**/.cargo/audit.toml"
+  schedule:
+    - cron: "0 0 * * *"
+
+defaults:
+  run:
+    working-directory: backend
+
+jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: rustsec/audit-check@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/rust.yml

@@ -0,0 +1,82 @@
+name: Rust
+
+on:
+  workflow_call:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "0 0 * * *"
+
+
+defaults:
+  run:
+    working-directory: backend
+
+
+jobs:
+  test:
+    name: Run Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@master
+
+      - name: Install stable toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry, index and build directory
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ./backend/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Run Tests
+        run: cargo test
+
+  fmt:
+    name: Rustfmt
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@master
+
+      - name: Install stable toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Check Formatting
+        run: cargo fmt --all -- --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@master
+
+      - name: Install stable toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry, index and build directory
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ./backend/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Clippy Linting
+        run: cargo clippy --all-features -- -Dclippy::all -Dclippy::pedantic
+      - name: Clippy Test Linting
+        run: cargo clippy --tests -- -Dclippy::all -Dclippy::pedantic

Dockerfile

@@ -14,17 +14,18 @@ COPY ./frontend/src ./src
 
 RUN ./build.sh
 
-FROM ekidd/rust-musl-builder:stable as backend
+# FROM ekidd/rust-musl-builder:stable as backend
+FROM clux/muslrust:stable as backend
 
 # create new cargo project
-RUN USER=rust cargo new --bin yagcdn
-RUN USER=rust cargo new --lib time-cache
+RUN cargo new --bin yagcdn
+RUN cargo new --lib time-cache
 # copy build config
-COPY --chown=rust ./backend/Cargo.lock ./yagcdn/Cargo.lock
-COPY --chown=rust ./backend/Cargo.toml ./yagcdn/Cargo.toml
-COPY --chown=rust ./time-cache/Cargo.toml ./time-cache/Cargo.toml
+COPY ./backend/Cargo.lock ./yagcdn/Cargo.lock
+COPY ./backend/Cargo.toml ./yagcdn/Cargo.toml
+COPY ./time-cache/Cargo.toml ./time-cache/Cargo.toml
 
-WORKDIR /home/rust/src/yagcdn
+WORKDIR /volume/yagcdn
 # build to cache dependencies
 RUN cargo build --release
 # delete build cache to prevent caching issues later on
@@ -49,7 +50,7 @@ COPY --from=linuxkit/ca-certificates:v0.7 / /
 COPY --from=user_builder /etc/passwd /etc/passwd
 USER dummy
 
-COPY --from=backend /home/rust/src/yagcdn/target/x86_64-unknown-linux-musl/release/yagcdn /
+COPY --from=backend /volume/yagcdn/target/x86_64-unknown-linux-musl/release/yagcdn /
 COPY --from=frontend /output/index.html /public/index.html
 COPY --from=frontend /output/scripts /public/scripts
 COPY --from=frontend /output/assets /public/assets

backend/.cargo/audit.toml

@@ -0,0 +1,3 @@
+[advisories]
+
+severity_threshold = "low" # CVSS severity ("none", "low", "medium", "high", "critical")