forked from cloud/ovgate
iceBear67andClaude Opus 5
40b47a8f66
The Dockerfile's builder stage already runs the unit suite, so the workflow deliberately has no separate test job -- a red test cannot produce an image. After pushing, the published artifact is smoke-tested by digest: `--version` covers a runtime stage missing a shared library, and `--check` against a throwaway credentials file covers the config baked into the image. Both were failure modes a green build would not have caught. The `--check` invocation is verified locally against docker/openvpngate.conf. `latest` follows the newest v* tag rather than the branch head; master head is published as `master`. Registry paths are lowercased explicitly rather than relying on metadata-action, since the same value is reused for the smoke test. GHCR_TOKEN / GHCR_USER / GHCR_IMAGE override the built-ins so this still works from a mirror or a Gitea/Forgejo runner, where the ambient token authenticates to the wrong registry. On github.com none of them need to be set. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
# The build context is COPYied wholesale into the builder stage. Without this
|
|
# the two local build trees (~1 GB with the openvpn3 objects) would be shipped
|
|
# to the daemon on every `docker build`, only to be overwritten by the
|
|
# container's own cmake run.
|
|
build/
|
|
build-tunnel/
|
|
build*/
|
|
|
|
# The image builds from the working tree, not from git history.
|
|
.git/
|
|
.gitignore
|
|
.dockerignore
|
|
|
|
# CI definitions cannot affect the build, and leaving them in means editing a
|
|
# workflow invalidates the COPY layer and recompiles openvpn3 for nothing.
|
|
.github/
|
|
|
|
# Runtime state. The node cache and the outcome history belong to whichever
|
|
# machine produced them; the container gets its own in a volume.
|
|
var/
|
|
|
|
# Local operator config and credentials. The container reads its config from a
|
|
# mount (see docker-compose.yml), never from something baked into the layer.
|
|
etc/
|
|
# Patterns match the whole context-relative path, so a bare *.auth would only
|
|
# cover the top level -- and the credential file lives in docker/.
|
|
**/*.auth
|
|
|
|
# Editor and OS noise
|
|
*.swp
|
|
*~
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|
|
.cache/
|
|
compile_commands.json
|