Stamp official Docker builds with a low-cardinality provenance marker and report build_provenance/image_modified in anonymous telemetry. Local and fork builds default to custom, while official GitHub/GitLab release paths mark images as official.
Add a PR job that installs the backend deps and runs the
settings-manifest drift guard, so a change to admin_settings_manifest.py
without regenerating settingsManifest.generated.json fails CI instead of
silently leaving the docs demo Settings screen stale.
- drop permissions block from reusable build workflow so callers set token
scope (fixes PR-checks startup failure: ci.yml grants only contents:read
while the reusable demanded packages:write)
- remove codeql.yml: repo already uses CodeQL default setup, which conflicts
with an advanced configuration
- pin trivy-action to 0.36.0 (0.28.0 tag does not exist; <0.35.0 is the
compromised supply-chain release flagged by dependency-review)
- make pip-audit and npm audit informational (continue-on-error); they flag
upstream/transitive advisories, dependency-review stays the PR gate
- dev-images: build/push backend, worker, frontend to ghcr.io and Docker
Hub on every push to dev (tags: dev, dev-<sha>)
- release-images: same images on v* tag push (tags: latest, <version>)
- PR checks (into main/dev): ruff lint+format, eslint+prettier, no-push
Docker build of all targets
- CodeQL (python, js/ts), dependency-review, pip-audit, npm audit, Trivy fs
- pin .github/workflows/*.yml to LF
- Integrated Docker Buildx setup step in the GitHub Actions workflow for enhanced multi-platform builds.
- This addition streamlines the Docker image building process, improving efficiency and flexibility.
- Introduced a new GitHub Actions workflow for building and pushing the development Docker image.
- Added inline mode handling for user interactions, allowing users to share referral links and view statistics.
- Enhanced admin functionalities with new sections for user management, statistics, and promo code management.
- Implemented CSV export for logs and improved notification services for various events, including new user registrations and payment notifications.
- Updated localization files to support new features and commands.
3252a8
BADtochka
machka pasla
machka-pasla