Update and pin versions of actions #19

Workflow file for this run

.github/workflows/build-and-publish.yml at 2240099

	name: Build and Publish eBPF Tracker

	on:
	push:
	branches: [main]
	paths-ignore:
	- '.github/workflows/test-tracker.yml'
	workflow_dispatch:

	jobs:
	# ---------------------------------------------------------------------------
	# Job 1: compile the Go binary, run tests, push OCI artifact to ghcr.io,
	# and build the Node.js dist. Needs packages:write but NOT
	# contents:write — this job never touches the git tree.
	# ---------------------------------------------------------------------------
	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	# -----------------------------------------------------------------------
	# System dependencies
	# -----------------------------------------------------------------------
	- name: Install build dependencies
	run: \|
	sudo apt-get update -qq
	sudo apt-get install -y --no-install-recommends \
	clang llvm libelf-dev libbpf-dev \
	"linux-headers-$(uname -r)"
	# /usr/bin/bpftool is a wrapper that resolves the real binary via
	# `uname -r` literally. On Azure runners uname -r omits the flavour
	# suffix (e.g. 6.17.0-1013 vs 6.17.0-1013-azure), so the wrapper
	# always fails. Instead: find the real binary under
	# /usr/lib/linux-tools, install linux-tools-generic if it's absent,
	# then symlink into /usr/local/bin to bypass the wrapper.
	BPFTOOL_BIN=$(find /usr/lib/linux-tools -name bpftool 2>/dev/null \| head -1)
	if [ -z "$BPFTOOL_BIN" ]; then
	sudo apt-get install -y --no-install-recommends linux-tools-generic
	BPFTOOL_BIN=$(find /usr/lib/linux-tools -name bpftool 2>/dev/null \| head -1)
	fi
	if [ -z "$BPFTOOL_BIN" ]; then
	echo "ERROR: bpftool binary not found" >&2; exit 1
	fi
	sudo ln -sf "$BPFTOOL_BIN" /usr/local/bin/bpftool
	echo "bpftool → $BPFTOOL_BIN"
	bpftool version

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: '1.24'
	cache-dependency-path: tracker/go.sum

	# -----------------------------------------------------------------------
	# Generate vmlinux.h from the running kernel's BTF
	# -----------------------------------------------------------------------
	- name: Generate vmlinux.h
	run: \|
	bpftool btf dump file /sys/kernel/btf/vmlinux format c > tracker/bpf/vmlinux.h

	# -----------------------------------------------------------------------
	# Compile C → BPF object, then bpf2go → Go skeleton
	# -----------------------------------------------------------------------
	- name: Generate BPF Go bindings
	working-directory: tracker
	run: \|
	go install github.com/cilium/ebpf/cmd/bpf2go@v0.17.0
	go generate ./cmd/...

	# -----------------------------------------------------------------------
	# Run unit tests (platform-agnostic; no Linux/BPF dependency)
	# -----------------------------------------------------------------------
	- name: Run unit tests
	working-directory: tracker
	run: go test ./internal/...

	# -----------------------------------------------------------------------
	# Build fully static Go binary (CGO_ENABLED=0)
	# -----------------------------------------------------------------------
	- name: Build static Go binary
	working-directory: tracker
	env:
	CGO_ENABLED: 0
	GOOS: linux
	GOARCH: amd64
	run: \|
	go build -ldflags="-s -w" -o ebpf-tracker ./cmd/

	# -----------------------------------------------------------------------
	# Install ORAS CLI
	# -----------------------------------------------------------------------
	- name: Install ORAS
	uses: oras-project/setup-oras@f0d18da5c37edac93d2353d47004a527b9d153a2 # v2

	# -----------------------------------------------------------------------
	# Log in to ghcr.io and push the binary as an OCI artifact
	# -----------------------------------------------------------------------
	- name: Log in to GitHub Container Registry
	run: \|
	echo "${{ secrets.GITHUB_TOKEN }}" \
	\| oras login ghcr.io --username "${{ github.actor }}" --password-stdin

	- name: Push binary to ghcr.io
	working-directory: tracker
	run: \|
	oras push \
	ghcr.io/skroutz/ebpf-tracker:latest \
	ebpf-tracker:application/octet-stream \
	--annotation "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
	--annotation "org.opencontainers.image.revision=${{ github.sha }}"

	# -----------------------------------------------------------------------
	# Build Node.js action dist and upload as artifact for the publish job
	# -----------------------------------------------------------------------
	- name: Set up Node
	uses: actions/setup-node@670825a89dc0abd596e7a3abd0f5e3f6e5faf37c # v6.4
	with:
	node-version: '24'
	cache: 'npm'

	- name: Install JS dependencies
	run: npm ci

	- name: Build action dist
	run: npm run build

	- name: Upload dist artifact
	uses: actions/upload-artifact@v4
	with:
	name: dist
	path: dist/
	retention-days: 1

	# ---------------------------------------------------------------------------
	# Job 2: commit the compiled dist/ back to main.
	# Runs only when the build job succeeds and only needs contents:write.
	# Isolated from the build environment so a compromised build step cannot
	# push arbitrary code to the repo.
	# ---------------------------------------------------------------------------
	publish-dist:
	needs: build
	runs-on: ubuntu-latest
	permissions:
	contents: write

	steps:
	- name: Checkout
	uses: actions/checkout@900f2210b1d28bbbd0bd22d17926b9e224e8f231 # v6.0.2

	- name: Download dist artifact
	uses: actions/download-artifact@484a0b528fb4d7bd804637ccb632e47a0e638317 # v8.0.1
	with:
	name: dist
	path: dist/

	- name: Commit dist
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	git add dist/
	if git diff --cached --quiet; then
	echo "No dist changes"
	else
	git commit -m "chore: rebuild dist [skip ci]"
	fi
	git push

Navigation Menu

Uh oh!

Update and pin versions of actions #19

Workflow file

Update and pin versions of actions #19

Uh oh!

Workflow file for this run