Peta dunia

 

EN

Dunia C2: Pipeline Container · Cabaran bos

Talian hijau

Anda akan belajar: buat setiap PR bina, uji dan imbas, dan setiap merge hantar image bertag.

Teks BM belum disemak oleh penutur asli.

Disemak dengan GitHub Actions 2026-10 pada 31 Okt 2026

Masalahnya

Pilih satu event. Tekan Run dan tengok tali sawat.

Pull request dari fork jalankan talian. Build cuba push ke ghcr.io dan ditolak.

Apa yang berlaku di GitHub

Fail workflow .github/workflows/green-line.yml

name: Green line
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
packages: write
jobs:
image:
runs-on: ubuntu-latest
steps:
- uses: docker/setup-buildx-action@v4
- uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v7
with:
push: true
tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

Tali sawat

Pull request dari fork · stranger:feature → main

Bos: talian hijau! Mei hantar PR pertamanya dari fork. Talian jadi merah. Tekan Run dan baca baris merah.

Semak

Maksudnya: satu PR cuba push, dengan kunci baca sahaja. Patutkah PR push image langsung?

Cuba

Bilik 1: baiki baris kuning. PR patut bina sahaja. Main patut push.

Tali sawat merah. Betulkan baris kuning, kemudian run semula.

Apa yang berlaku di GitHub

Fail workflow .github/workflows/green-line.yml

name: Green line
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
packages: write
jobs:
image:
runs-on: ubuntu-latest
steps:
- uses: docker/setup-buildx-action@v4
- uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v7
with:
push: true
tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

Kuning: baris 21–21. Anda boleh ubah baris ini.

Pilih satu pembetulan

Tali sawat

Pull request dari fork · stranger:feature → main

Semak

Bilik 2: apa berlaku di mana pada talian hijau?

Seret kad ke dalam kotak. Atau ketik kad, kemudian ketik kotak.

      Cuba

      Bilik 3: ujian API perlukan Postgres, dan ia tak jumpa. Beri job ini pangkalan data.

      Tali sawat merah. Betulkan baris kuning, kemudian run semula.

      Apa yang berlaku di GitHub

      Fail workflow .github/workflows/test.yml

      name: Test
on:
pull_request:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 24
- run: npm ci
- run: npm test
env:
DATABASE_URL: postgres://postgres:test@localhost:5432/postgres

      Kuning: baris 8–8. Anda boleh ubah baris ini.

      Pilih satu pembetulan

      Tali sawat

      Pull request · feature → main

      Semak

      Bilik 4: image sebuah PR ada CVE CRITICAL. Apa patut talian buat?

      Teka

      Bilik akhir: seluruh talian, dengan CVE CRITICAL dalam image. Ketik stesen yang akan hentikannya, kemudian tekan Run.

      Stesen mana akan hentikan tali sawat? Tekan stesen itu, kemudian Run.

      Apa yang berlaku di GitHub

      Fail workflow .github/workflows/green-line.yml

      name: Green line
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: docker compose up -d --wait
- run: docker compose run --rm api npm test
image:
needs: test
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: docker/setup-buildx-action@v4
- id: meta
uses: docker/metadata-action@v6
with:
images: ghcr.io/${{ github.repository }}
- uses: docker/build-push-action@v7
with:
load: true
tags: kedai-kancil:scan
cache-from: type=gha
cache-to: type=gha,mode=max
- uses: aquasecurity/trivy-action@v0.36.0
with:
image-ref: kedai-kancil:scan
severity: CRITICAL
exit-code: '1'
- if: github.event_name != 'pull_request'
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v7
with:
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha

      Tali sawat

      Pull request · feature → main

      Anda berjaya!

      Kini anda boleh semak setiap PR dan hantar setiap merge.

      Nak tahu lebih (pilihan)

      Inilah seluruh talian hijau. Compose jalankan ujian. Kemudian image dibina dan diimbas. Hanya main log masuk dan push. Imbasan datang sebelum push, jadi pek rosak tak pernah dihantar. Misi 2 letak talian ini dalam repo anda sendiri.

      Pilih satu event. Tekan Run dan tengok tali sawat.

      Seluruh talian hijau. Pada PR: ujian, build, imbas, tiada push. Pada main: sama, tambah log masuk dan push.

      Apa yang berlaku di GitHub

      Fail workflow .github/workflows/green-line.yml

      name: Green line
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: docker compose up -d --wait
- run: docker compose run --rm api npm test
image:
needs: test
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: docker/setup-buildx-action@v4
- id: meta
uses: docker/metadata-action@v6
with:
images: ghcr.io/${{ github.repository }}
- uses: docker/build-push-action@v7
with:
load: true
tags: kedai-kancil:scan
cache-from: type=gha
cache-to: type=gha,mode=max
- uses: aquasecurity/trivy-action@v0.36.0
with:
image-ref: kedai-kancil:scan
severity: CRITICAL
exit-code: '1'
- if: github.event_name != 'pull_request'
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v7
with:
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha

      Tali sawat

      Pull request · feature → main