Skip to content

Commit 336c6d6

Browse files
ZePan110pre-commit-ci[bot]
authored and
cogniware-devops
committed
Fix some security issues (opea-project#2289)
Signed-off-by: ZePan110 <ze.pan@intel.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Signed-off-by: cogniware-devops <ambarish.desai@cogniware.ai>
1 parent 978d1aa commit 336c6d6

5 files changed

Lines changed: 161 additions & 12 deletions

File tree

‎.github/workflows/check-online-doc-build.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Check Online Document Building
5+
permissions: {}
6+
7+
on:
8+
pull_request:
9+
branches: [main]
10+
paths:
11+
- "**.md"
12+
- "**.rst"
13+
14+
jobs:
15+
build:
16+
runs-on: ubuntu-22.04
17+
steps:
18+
19+
- name: Checkout
20+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
21+
with:
22+
path: GenAIExamples
23+
24+
- name: Checkout docs
25+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
26+
with:
27+
repository: opea-project/docs
28+
path: docs
29+
30+
- name: Build Online Document
31+
shell: bash
32+
run: |
33+
echo "build online doc"
34+
cd docs
35+
bash scripts/build.sh

‎.github/workflows/dockerhub-description.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# Copyright (C) 2025 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Update Docker Hub Description
5+
permissions:
6+
contents: read
7+
on:
8+
schedule:
9+
- cron: "0 0 * * 0"
10+
workflow_dispatch:
11+
12+
jobs:
13+
get-images-matrix:
14+
runs-on: ubuntu-latest
15+
outputs:
16+
examples_json: ${{ steps.extract.outputs.examples_json }}
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v3
20+
21+
- name: Extract images info and generate JSON matrix
22+
id: extract
23+
run: |
24+
#!/bin/bash
25+
set -e
26+
images=$(awk -F'|' '/^\| *\[opea\// {
27+
gsub(/^ +| +$/, "", $2);
28+
gsub(/^ +| +$/, "", $4);
29+
gsub(/^ +| +$/, "", $5);
30+
31+
# Extract the path portion of the dockerHub link from the Example Images column
32+
match($2, /\(https:\/\/hub\.docker\.com\/r\/[^)]*\)/);
33+
repository = substr($2, RSTART, RLENGTH);
34+
# Remove the prefix and the trailing right bracket
35+
sub(/^\(https:\/\/hub\.docker\.com\/r\//, "", repository);
36+
sub(/\)$/, "", repository);
37+
38+
# Description Direct assignment
39+
description = $4;
40+
41+
# Extract the content of the github link from the Readme column
42+
match($5, /\(https:\/\/github\.com\/[^)]*\)/);
43+
readme_url = substr($5, RSTART, RLENGTH);
44+
# Remove the prefix and the trailing right bracket
45+
sub(/^\(https:\/\/github\.com\//, "", readme_url);
46+
sub(/\)$/, "", readme_url);
47+
# Remove blob information, such as "blob/main/" or "blob/habana_main/"
48+
gsub(/blob\/[^/]+\//, "", readme_url);
49+
# Remove the organization name and keep only the file path, such as changing "opea-project/GenAIExamples/AudioQnA/README.md" to "GenAIExamples/AudioQnA/README.md"
50+
sub(/^[^\/]+\//, "", readme_url);
51+
52+
# Generate JSON object string
53+
printf "{\"repository\":\"%s\",\"short-description\":\"%s\",\"readme-filepath\":\"%s\"}\n", repository, description, readme_url;
54+
}' docker_images_list.md)
55+
56+
# Concatenate all JSON objects into a JSON array, using paste to separate them with commas
57+
json="[$(echo "$images" | paste -sd, -)]"
58+
echo "$json"
59+
# Set as output variable for subsequent jobs to use
60+
echo "::set-output name=examples_json::$json"
61+
62+
check-images-matrix:
63+
runs-on: ubuntu-latest
64+
needs: get-images-matrix
65+
if: ${{ needs.get-images-matrix.outputs.examples_json != '' }}
66+
strategy:
67+
matrix:
68+
image: ${{ fromJSON(needs.get-images-matrix.outputs.examples_json) }}
69+
fail-fast: false
70+
steps:
71+
- name: Check dockerhub description
72+
run: |
73+
echo "dockerhub description for ${{ matrix.image.repository }}"
74+
echo "short-description: ${{ matrix.image.short-description }}"
75+
echo "readme-filepath: ${{ matrix.image.readme-filepath }}"
76+
77+
dockerHubDescription:
78+
runs-on: ubuntu-latest
79+
needs: get-images-matrix
80+
if: ${{ needs.get-images-matrix.outputs.examples_json != '' }}
81+
strategy:
82+
matrix:
83+
image: ${{ fromJSON(needs.get-images-matrix.outputs.examples_json) }}
84+
fail-fast: false
85+
steps:
86+
- name: Checkout GenAIExamples
87+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
88+
with:
89+
repository: opea-project/GenAIExamples
90+
path: GenAIExamples
91+
92+
- name: Checkout GenAIComps
93+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
94+
with:
95+
repository: opea-project/GenAIComps
96+
path: GenAIComps
97+
98+
- name: Checkout vllm-openvino
99+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
100+
with:
101+
repository: vllm-project/vllm
102+
path: vllm
103+
104+
- name: Checkout vllm-gaudi
105+
uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2
106+
with:
107+
repository: HabanaAI/vllm-fork
108+
ref: habana_main
109+
path: vllm-fork
110+
111+
- name: add dockerhub description
112+
uses: peter-evans/dockerhub-description@v4
113+
with:
114+
username: ${{ secrets.DOCKERHUB_USER }}
115+
password: ${{ secrets.DOCKERHUB_TOKEN }}
116+
repository: ${{ matrix.image.repository }}
117+
short-description: ${{ matrix.image.short-description }}
118+
readme-filepath: ${{ matrix.image.readme-filepath }}
119+
enable-url-completion: false

‎.github/workflows/pr-image-size.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ jobs:
128128
129129
- name: Download origin artifact log
130130
if: env.skip != 'true'
131-
uses: actions/download-artifact@v4.1.3
131+
uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4
132132
with:
133133
name: build-comments
134134
path: merged-files
@@ -159,7 +159,7 @@ jobs:
159159
all_comments: ${{ steps.summary.outputs.all_comments }}
160160
steps:
161161
- name: Download Summary
162-
uses: actions/download-artifact@v4.1.3
162+
uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4
163163
with:
164164
name: build-comments
165165
path: downloaded-files

‎ChatQnA/ui/docker/Dockerfile.react.openEuler‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
# Use node 20.11.1 as the base image
5-
FROM openeuler/node:20.11.1-oe2403lts as vite-app
6-
5+
FROM openeuler/node:20.11.1-oe2403lts@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd as vite-app
6+
77
COPY react /usr/app/react
88
WORKDIR /usr/app/react
99

10-
11-
RUN ["npm", "install"]
10+
RUN ["npm", "install", "--package-lock-only"]
11+
RUN ["npm", "ci"]
1212
RUN ["npm", "run", "build"]
1313

1414

@@ -18,4 +18,4 @@ COPY --from=vite-app /usr/app/react/dist /usr/share/nginx/html
1818
COPY ./react/env.sh /docker-entrypoint.d/env.sh
1919

2020
COPY ./react/nginx.conf /etc/nginx/conf.d/default.conf
21-
RUN chmod +x /docker-entrypoint.d/env.sh
21+
RUN chmod +x /docker-entrypoint.d/env.sh

‎CodeGen/ui/docker/Dockerfile.react.openEuler‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,8 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
# Use node 20.11.1 as the base image
5-
<<<<<<< HEAD
65
FROM openeuler/node@sha256:25c790f93c2243b361919620c069812319f614fd697e32e433402ae706a19ffd as vite-app
76

8-
=======
9-
FROM openeuler/node:20.11.1-oe2403lts as vite-app
10-
11-
>>>>>>> 650571e8 (Fixed more CI Errors)
127
COPY react /usr/app/react
138
WORKDIR /usr/app/react
149

0 commit comments

Comments
 (0)