fix(agentex): bump ddtrace to >=4.8.2 (CVE-2026-50271) (#364) #247
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release AgentEx | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| AGENTEX_SERVER_IMAGE_NAME: agentex | |
| jobs: | |
| build-stable-image: | |
| name: "Push Stable Images to GHCR" | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Validate Main Branch | |
| run: | | |
| if [ "${{ github.ref }}" != "refs/heads/main" ]; then | |
| echo "Error: This workflow can only run on main branch" | |
| exit 1 | |
| fi | |
| - name: Check if user is maintainer | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| username: context.actor | |
| }); | |
| const allowedRoles = ['admin', 'maintain']; | |
| if (!allowedRoles.includes(permission.permission)) { | |
| throw new Error(`❌ User ${context.actor} does not have sufficient permissions. Required: ${allowedRoles.join(', ')}. Current: ${permission.permission}`); | |
| } | |
| # Checkout repository | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| # Set up Python and uv for documentation building | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "0.7.3" | |
| # Set up Docker Buildx | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| # Login to GitHub Container Registry | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Build documentation | |
| - name: Build documentation | |
| working-directory: ./agentex | |
| run: | | |
| # Build docs in an isolated env (deps from docs/requirements.txt), | |
| # decoupled from the workspace lock so it never forces backend dep bumps. | |
| cd docs && uv run --isolated --no-project --with-requirements requirements.txt mkdocs build | |
| # Build and push server image to GHCR | |
| - name: Build and push AgentEx server image to GHCR | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./agentex/Dockerfile | |
| push: true | |
| build-args: | | |
| INCLUDE_DOCS=true | |
| labels: | | |
| org.opencontainers.image.source=https://github.com/${{ github.repository }} | |
| org.opencontainers.image.description=AgentEx Platform | |
| org.opencontainers.image.licenses=MIT | |
| tags: | | |
| ghcr.io/${{ github.repository }}/${{ env.AGENTEX_SERVER_IMAGE_NAME }}:${{ github.sha }} | |
| ghcr.io/${{ github.repository }}/${{ env.AGENTEX_SERVER_IMAGE_NAME }}:latest | |
| cache-from: type=gha,scope=${{ env.AGENTEX_SERVER_IMAGE_NAME }}-release | |
| cache-to: type=gha,mode=max,scope=${{ env.AGENTEX_SERVER_IMAGE_NAME }}-release | |
| # Summary | |
| - name: Release Summary | |
| run: | | |
| echo "Release complete!" | |
| echo "Server image: ghcr.io/${{ github.repository }}/${{ env.AGENTEX_SERVER_IMAGE_NAME }}:${{ github.sha }}" | |
| echo "Also tagged as: ghcr.io/${{ github.repository }}/${{ env.AGENTEX_SERVER_IMAGE_NAME }}:latest" | |
| echo "This image is now available as the latest stable version" | |
| echo "Package set to public visibility" |