Compare commits
1 Commits
v0.1.7
...
feat/preac
| Author | SHA1 | Date | |
|---|---|---|---|
| ff6670c98c |
@@ -1,6 +0,0 @@
|
|||||||
node_modules
|
|
||||||
dist
|
|
||||||
.git
|
|
||||||
.env
|
|
||||||
.DS_Store
|
|
||||||
.claude/
|
|
||||||
@@ -1,22 +1,14 @@
|
|||||||
name: Build and Release to Staging
|
name: Build and Release
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: git.ivanch.me
|
|
||||||
REGISTRY_USERNAME: ivanch
|
|
||||||
IMAGE_NAME: ${{ env.REGISTRY_HOST }}/ivanch/vision-start
|
|
||||||
IMAGE_TAG: staging
|
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
name: Build Vision Start
|
|
||||||
if: gitea.event_name == 'push'
|
if: gitea.event_name == 'push'
|
||||||
runs-on: ubuntu-amd64
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- name: Check out repository code
|
- name: Check out repository code
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
@@ -24,47 +16,3 @@ jobs:
|
|||||||
run: npm install
|
run: npm install
|
||||||
- name: Run build
|
- name: Run build
|
||||||
run: npm run build
|
run: npm run build
|
||||||
|
|
||||||
build_vision_start:
|
|
||||||
name: Build Vision Start Image
|
|
||||||
runs-on: ubuntu-amd64
|
|
||||||
needs: build
|
|
||||||
steps:
|
|
||||||
- name: Check out repository
|
|
||||||
uses: actions/checkout@v2
|
|
||||||
|
|
||||||
- name: Log in to Container Registry
|
|
||||||
run: |
|
|
||||||
echo "${{ secrets.REGISTRY_PASSWORD }}" \
|
|
||||||
| docker login "${{ env.REGISTRY_HOST }}" \
|
|
||||||
-u "${{ env.REGISTRY_USERNAME }}" \
|
|
||||||
--password-stdin
|
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
|
||||||
uses: docker/setup-buildx-action@v3
|
|
||||||
|
|
||||||
- name: Build and Push Multi-Arch Image
|
|
||||||
uses: docker/build-push-action@v6
|
|
||||||
with:
|
|
||||||
push: true
|
|
||||||
context: .
|
|
||||||
platforms: linux/amd64,linux/arm64
|
|
||||||
tags: |
|
|
||||||
${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
|
|
||||||
|
|
||||||
deploy_vision_start:
|
|
||||||
name: Deploy Vision Start (staging)
|
|
||||||
runs-on: ubuntu-amd64
|
|
||||||
needs: build_vision_start
|
|
||||||
steps:
|
|
||||||
- name: Recreate Container
|
|
||||||
uses: appleboy/ssh-action@v0.1.7
|
|
||||||
with:
|
|
||||||
host: ${{ secrets.HOST }}
|
|
||||||
username: ${{ secrets.USERNAME }}
|
|
||||||
key: ${{ secrets.KEY }}
|
|
||||||
port: ${{ secrets.PORT }}
|
|
||||||
script: |
|
|
||||||
cd ${{ secrets.STAGING_DIR }}
|
|
||||||
docker compose pull
|
|
||||||
docker compose up -d --force-recreate
|
|
||||||
|
|||||||
@@ -5,12 +5,6 @@ on:
|
|||||||
tags:
|
tags:
|
||||||
- v*
|
- v*
|
||||||
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: git.ivanch.me
|
|
||||||
REGISTRY_USERNAME: ivanch
|
|
||||||
IMAGE_NAME: ${{ env.REGISTRY_HOST }}/ivanch/vision-start
|
|
||||||
IMAGE_TAG: latest
|
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
@@ -59,9 +53,8 @@ jobs:
|
|||||||
virustotal_apikey: ${{ secrets.VIRUSTOTAL_APIKEY }}
|
virustotal_apikey: ${{ secrets.VIRUSTOTAL_APIKEY }}
|
||||||
VIRUS_TOTAL_FILE: vision-start-${{ gitea.ref_name }}.zip
|
VIRUS_TOTAL_FILE: vision-start-${{ gitea.ref_name }}.zip
|
||||||
run: |
|
run: |
|
||||||
# Run the VirusTotal check script and capture output in real-time
|
# Run the VirusTotal check script and capture output
|
||||||
set -o pipefail
|
bash scripts/check_virustotal.sh > vt_output.txt 2>&1
|
||||||
bash scripts/check_virustotal.sh 2>&1 | tee vt_output.txt
|
|
||||||
|
|
||||||
# Extract analysis URL and detection ratio from output
|
# Extract analysis URL and detection ratio from output
|
||||||
ANALYSIS_URL=$(grep "Analysis URL:" vt_output.txt | cut -d' ' -f3- || echo "Not available")
|
ANALYSIS_URL=$(grep "Analysis URL:" vt_output.txt | cut -d' ' -f3- || echo "Not available")
|
||||||
@@ -71,6 +64,9 @@ jobs:
|
|||||||
echo "analysis-url=$ANALYSIS_URL" >> $GITEA_OUTPUT
|
echo "analysis-url=$ANALYSIS_URL" >> $GITEA_OUTPUT
|
||||||
echo "detection-ratio=$DETECTION_RATIO" >> $GITEA_OUTPUT
|
echo "detection-ratio=$DETECTION_RATIO" >> $GITEA_OUTPUT
|
||||||
|
|
||||||
|
# Display the full output
|
||||||
|
cat vt_output.txt
|
||||||
|
|
||||||
release:
|
release:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
needs: [build, virus-total-check]
|
needs: [build, virus-total-check]
|
||||||
@@ -92,47 +88,3 @@ jobs:
|
|||||||
name: ${{ gitea.ref_name }}
|
name: ${{ gitea.ref_name }}
|
||||||
tag_name: ${{ gitea.ref_name }}
|
tag_name: ${{ gitea.ref_name }}
|
||||||
files: vision-start-${{ gitea.ref_name }}.zip
|
files: vision-start-${{ gitea.ref_name }}.zip
|
||||||
|
|
||||||
build_vision_start:
|
|
||||||
name: Build Vision Start Image
|
|
||||||
runs-on: ubuntu-amd64
|
|
||||||
needs: [build, virus-total-check]
|
|
||||||
steps:
|
|
||||||
- name: Check out repository
|
|
||||||
uses: actions/checkout@v2
|
|
||||||
|
|
||||||
- name: Log in to Container Registry
|
|
||||||
run: |
|
|
||||||
echo "${{ secrets.REGISTRY_PASSWORD }}" \
|
|
||||||
| docker login "${{ env.REGISTRY_HOST }}" \
|
|
||||||
-u "${{ env.REGISTRY_USERNAME }}" \
|
|
||||||
--password-stdin
|
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
|
||||||
uses: docker/setup-buildx-action@v3
|
|
||||||
|
|
||||||
- name: Build and Push Multi-Arch Image
|
|
||||||
uses: docker/build-push-action@v6
|
|
||||||
with:
|
|
||||||
push: true
|
|
||||||
context: .
|
|
||||||
platforms: linux/amd64,linux/arm64
|
|
||||||
tags: |
|
|
||||||
${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
|
|
||||||
|
|
||||||
deploy_vision_start:
|
|
||||||
name: Deploy Vision Start (production)
|
|
||||||
runs-on: ubuntu-amd64
|
|
||||||
needs: build_vision_start
|
|
||||||
steps:
|
|
||||||
- name: Recreate Container
|
|
||||||
uses: appleboy/ssh-action@v0.1.7
|
|
||||||
with:
|
|
||||||
host: ${{ secrets.HOST }}
|
|
||||||
username: ${{ secrets.USERNAME }}
|
|
||||||
key: ${{ secrets.KEY }}
|
|
||||||
port: ${{ secrets.PORT }}
|
|
||||||
script: |
|
|
||||||
cd ${{ secrets.PROD_DIR }}
|
|
||||||
docker compose pull
|
|
||||||
docker compose up -d --force-recreate
|
|
||||||
|
|||||||
1
.gitignore
vendored
1
.gitignore
vendored
@@ -11,7 +11,6 @@ node_modules
|
|||||||
dist
|
dist
|
||||||
dist-ssr
|
dist-ssr
|
||||||
*.local
|
*.local
|
||||||
.claude/
|
|
||||||
|
|
||||||
# Editor directories and files
|
# Editor directories and files
|
||||||
.vscode/*
|
.vscode/*
|
||||||
|
|||||||
14
Dockerfile
14
Dockerfile
@@ -1,14 +0,0 @@
|
|||||||
FROM node:22-alpine AS builder
|
|
||||||
|
|
||||||
WORKDIR /app
|
|
||||||
COPY package*.json ./
|
|
||||||
RUN npm ci
|
|
||||||
COPY . .
|
|
||||||
RUN sh scripts/prepare_release.sh
|
|
||||||
RUN npm run build
|
|
||||||
|
|
||||||
FROM nginx:alpine
|
|
||||||
COPY --from=builder /app/dist /usr/share/nginx/html
|
|
||||||
COPY manifest.json /usr/share/nginx/html/
|
|
||||||
EXPOSE 80
|
|
||||||
CMD ["nginx", "-g", "daemon off;"]
|
|
||||||
@@ -9,7 +9,7 @@ set -e
|
|||||||
# Configuration
|
# Configuration
|
||||||
FILE_PATH="${VIRUS_TOTAL_FILE:-vision-start.zip}"
|
FILE_PATH="${VIRUS_TOTAL_FILE:-vision-start.zip}"
|
||||||
API_KEY="${virustotal_apikey}"
|
API_KEY="${virustotal_apikey}"
|
||||||
BASE_URL="https://www.virustotal.com/api/v3"
|
BASE_URL="https://www.virustotal.com/vtapi/v2"
|
||||||
|
|
||||||
# Check if API key is set
|
# Check if API key is set
|
||||||
if [ -z "$API_KEY" ]; then
|
if [ -z "$API_KEY" ]; then
|
||||||
@@ -38,12 +38,12 @@ echo "Uploading $FILE_PATH to VirusTotal for analysis..."
|
|||||||
|
|
||||||
# Upload file to VirusTotal
|
# Upload file to VirusTotal
|
||||||
UPLOAD_RESPONSE=$(curl -s -X POST \
|
UPLOAD_RESPONSE=$(curl -s -X POST \
|
||||||
-H "x-apikey: $API_KEY" \
|
-F "apikey=$API_KEY" \
|
||||||
-F "file=@$FILE_PATH" \
|
-F "file=@$FILE_PATH" \
|
||||||
"$BASE_URL/files")
|
"$BASE_URL/file/scan")
|
||||||
|
|
||||||
# Extract scan_id from response
|
# Extract scan_id from response
|
||||||
SCAN_ID=$(echo "$UPLOAD_RESPONSE" | jq -r '.data.id')
|
SCAN_ID=$(echo "$UPLOAD_RESPONSE" | jq -r '.scan_id')
|
||||||
|
|
||||||
if [ "$SCAN_ID" == "null" ] || [ -z "$SCAN_ID" ]; then
|
if [ "$SCAN_ID" == "null" ] || [ -z "$SCAN_ID" ]; then
|
||||||
echo "Error: Failed to upload file or get scan ID"
|
echo "Error: Failed to upload file or get scan ID"
|
||||||
@@ -55,7 +55,7 @@ echo "File uploaded successfully. Scan ID: $SCAN_ID"
|
|||||||
echo "Waiting for analysis to complete..."
|
echo "Waiting for analysis to complete..."
|
||||||
|
|
||||||
# Wait for analysis to complete and get results
|
# Wait for analysis to complete and get results
|
||||||
MAX_ATTEMPTS=60
|
MAX_ATTEMPTS=30
|
||||||
ATTEMPT=0
|
ATTEMPT=0
|
||||||
SLEEP_INTERVAL=10
|
SLEEP_INTERVAL=10
|
||||||
|
|
||||||
@@ -63,40 +63,40 @@ while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do
|
|||||||
echo "Checking analysis status (attempt $((ATTEMPT + 1))/$MAX_ATTEMPTS)..."
|
echo "Checking analysis status (attempt $((ATTEMPT + 1))/$MAX_ATTEMPTS)..."
|
||||||
|
|
||||||
# Get scan report
|
# Get scan report
|
||||||
REPORT_RESPONSE=$(curl -s -X GET \
|
REPORT_RESPONSE=$(curl -s -X POST \
|
||||||
-H "x-apikey: $API_KEY" \
|
-d "apikey=$API_KEY" \
|
||||||
"$BASE_URL/analyses/$SCAN_ID")
|
-d "resource=$SCAN_ID" \
|
||||||
|
"$BASE_URL/file/report")
|
||||||
|
|
||||||
# Check if analysis is complete
|
# Check if analysis is complete
|
||||||
RESPONSE_CODE=$(echo "$REPORT_RESPONSE" | jq -r '.data.attributes.status')
|
RESPONSE_CODE=$(echo "$REPORT_RESPONSE" | jq -r '.response_code')
|
||||||
|
|
||||||
if [ "$RESPONSE_CODE" == "completed" ]; then
|
if [ "$RESPONSE_CODE" == "1" ]; then
|
||||||
# Analysis complete
|
# Analysis complete
|
||||||
echo "Analysis completed!"
|
echo "Analysis completed!"
|
||||||
|
|
||||||
# Extract results
|
# Extract results
|
||||||
POSITIVES=$(echo "$REPORT_RESPONSE" | jq -r '.data.attributes.stats.malicious')
|
POSITIVES=$(echo "$REPORT_RESPONSE" | jq -r '.positives')
|
||||||
SUSPICIOUS=$(echo "$REPORT_RESPONSE" | jq -r '.data.attributes.stats.suspicious')
|
TOTAL=$(echo "$REPORT_RESPONSE" | jq -r '.total')
|
||||||
# The v3 analyses object has no 'total' field — compute it by summing all stat categories
|
PERMALINK=$(echo "$REPORT_RESPONSE" | jq -r '.permalink')
|
||||||
TOTAL=$(echo "$REPORT_RESPONSE" | jq '[.data.attributes.stats | to_entries[].value] | add')
|
|
||||||
ANALYSIS_ID=$(echo "$REPORT_RESPONSE" | jq -r '.data.id')
|
|
||||||
PERMALINK="https://www.virustotal.com/gui/file-analysis/${ANALYSIS_ID}"
|
|
||||||
|
|
||||||
echo "Analysis URL: $PERMALINK"
|
echo "Analysis URL: $PERMALINK"
|
||||||
echo "Detection ratio: $POSITIVES/$TOTAL"
|
echo "Detection ratio: $POSITIVES/$TOTAL"
|
||||||
|
|
||||||
# Check if file is safe
|
# Check if file is safe
|
||||||
if [ "$POSITIVES" -eq 0 ] && [ "$SUSPICIOUS" -eq 0 ]; then
|
if [ "$POSITIVES" -eq 0 ]; then
|
||||||
echo "✅ File is clean (no threats detected)"
|
echo "✅ File is clean (no threats detected)"
|
||||||
exit 0
|
exit 0
|
||||||
else
|
else
|
||||||
echo "❌ File flagged: $POSITIVES malicious, $SUSPICIOUS suspicious (out of $TOTAL scanners)"
|
echo "❌ File contains threats ($POSITIVES detections out of $TOTAL scanners)"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
elif [ "$RESPONSE_CODE" == "queued" ]; then
|
elif [ "$RESPONSE_CODE" == "0" ]; then
|
||||||
echo "File still queued for analysis..."
|
# File not found or analysis not complete yet
|
||||||
elif [ "$RESPONSE_CODE" == "in-progress" ]; then
|
|
||||||
echo "Analysis still in progress..."
|
echo "Analysis still in progress..."
|
||||||
|
elif [ "$RESPONSE_CODE" == "-2" ]; then
|
||||||
|
# Still queued for analysis
|
||||||
|
echo "File still queued for analysis..."
|
||||||
else
|
else
|
||||||
echo "Unexpected response code: $RESPONSE_CODE"
|
echo "Unexpected response code: $RESPONSE_CODE"
|
||||||
echo "Response: $REPORT_RESPONSE"
|
echo "Response: $REPORT_RESPONSE"
|
||||||
|
|||||||
Reference in New Issue
Block a user