Files
PaperClipAI/.github/workflows/exe-dev-image.yml
T
DottaandPaperclip fb28034fb4 Hide registry credentials from SSH argv and pin publishing actions
Use a mode-0600 RemoteCommand file with percent escaping for sensitive management commands.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-17 10:03:49 -05:00

36 lines
1.3 KiB
YAML

name: Experimental exe.dev image
on:
workflow_dispatch:
permissions:
contents: read
packages: write
concurrency:
group: exe-dev-image-${{ github.ref }}
cancel-in-progress: false
jobs:
image:
if: github.repository == 'paperclipai/paperclip'
runs-on: ubuntu-24.04
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
with:
version: 9.15.4
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
with:
node-version: '24'
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- run: pnpm install --frozen-lockfile
- name: Build and publish immutable experimental image
run: node cli/node_modules/tsx/dist/cli.mjs scripts/build-exe-dev-image.ts --push --metadata-file /tmp/exe-image.json
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: exe-dev-image-digest
path: /tmp/exe-image.json