fix: 🐛 上流CodiMD 2.5.0を取り込み画像アップロードのTLSエラーを修復

.buildpacks

@@ -1,2 +1,2 @@
-https://github.com/alex88/heroku-buildpack-vips
+https://github.com/Scalingo/apt-buildpack
 https://github.com/Scalingo/nodejs-buildpack

.devcontainer/Dockerfile

@@ -0,0 +1,14 @@
+# [Choice] Node.js version: 16, 14
+ARG VARIANT=14-buster
+FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:0-${VARIANT}
+
+# [Optional] Uncomment this section to install additional OS packages.
+# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+#     && apt-get -y install --no-install-recommends <your-package-list-here>
+
+# [Optional] Uncomment if you want to install an additional version of node using nvm
+# ARG EXTRA_NODE_VERSION=10
+# RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}"
+
+# [Optional] Uncomment if you want to install more global node modules
+RUN su node -c "npm install -g npm@6"

.devcontainer/devcontainer.json

@@ -0,0 +1,58 @@
+{
+	"name": "CodiMD",
+	"dockerComposeFile": "docker-compose.yml",
+	"service": "app",
+	"workspaceFolder": "/workspace",
+
+	// Set *default* container specific settings.json values on container create.
+	"settings": {
+		"terminal.integrated.shell.linux": "/bin/zsh",
+		"sqltools.connections": [{
+			"name": "Container Database",
+			"driver": "PostgreSQL",
+			"previewLimit": 50,
+			"server": "localhost",
+			"port": 5432,
+			"database": "codimd",
+			"username": "codimd",
+			"password": "codimd"
+		}],
+	},
+
+	// Add the IDs of extensions you want installed when the container is created.
+	"extensions": [
+		"dbaeumer.vscode-eslint",
+		"visualstudioexptteam.vscodeintellicode",
+		"christian-kohler.path-intellisense",
+		"standard.vscode-standard",
+		"mtxr.sqltools",
+		"mtxr.sqltools-driver-pg",
+		"eamodio.gitlens",
+		"codestream.codestream",
+		"github.vscode-pull-request-github",
+		"cschleiden.vscode-github-actions",
+		"hbenl.vscode-mocha-test-adapter",
+		"hbenl.vscode-test-explorer"
+	],
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	"portsAttributes": {
+		"3000": {
+			"label": "CodiMD server",
+			"onAutoForward": "notify"
+		},
+		"5432": {
+			"label": "PostgreSQL",
+			"onAutoForward": "notify"
+		}
+	},
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "yarn install",
+	"postCreateCommand": "sudo chown -R node:node node_modules && /workspace/bin/setup",
+
+	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
+	"remoteUser": "node"
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,46 @@
+version: '3'
+
+services:
+  app:
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+      args:
+        VARIANT: 14-buster
+    environment:
+      - CMD_DB_URL=postgres://codimd:codimd@localhost/codimd
+      - CMD_USECDN=false
+    volumes:
+      - ..:/workspace:cached
+      - node_modules:/workspace/node_modules:cached
+
+    # Overrides default command so things don't shut down after the process ends.
+    command: sleep infinity
+
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+    network_mode: service:db
+
+    # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function.
+
+    # Uncomment the next line to use a non-root user for all processes.
+    # user: vscode
+
+    # Use "forwardPorts" in **devcontainer.json** to forward an app port locally.
+    # (Adding the "ports" property to this file will not forward from a Codespace.)
+
+  db:
+    image: postgres:12.7-alpine
+    restart: unless-stopped
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=codimd
+      - POSTGRES_PASSWORD=codimd
+      - POSTGRES_DB=codimd
+
+    # Add "forwardPorts": ["5432"] to **devcontainer.json** to forward PostgreSQL locally.
+    # (Adding the "ports" property to this file will not forward from a Codespace.)
+
+volumes:
+  node_modules:
+  postgres-data:

.github/workflows/build.yml

@@ -0,0 +1,59 @@
+name: 'Test and Build'
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test-and-build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [14.x, 16.x]
+
+    steps:
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+    - name: Reconfigure git to use HTTP authentication
+      run: >
+        git config --global url."https://github.com/".insteadOf
+        ssh://git@github.com/
+
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        path: ~/.npm
+        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-node-
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      name: Use Node.js ${{ matrix.node-version }}
+      with:
+        node-version: ${{ matrix.node-version }}
+        check-latest: true
+
+    - run: npm ci
+    - run: npm run test:ci
+    - run: npm run build
+
+  doctoc:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/master' || github.event.pull_request
+
+    steps:
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      name: Use Node.js 14
+      with:
+        node-version: 14
+        check-latest: true
+    - name: Install doctoc-check
+      run: |
+        npm install -g doctoc@1.4.0
+        cp README.md README.md.orig
+        npm run doctoc
+        diff -q README.md README.md.orig

.github/workflows/main.yml

@@ -6,12 +6,18 @@ on:
       - traP
       - traP-*
 
+permissions:
+  contents: read
+
 env:
   IMAGE_NAME: codimd
 
 jobs:
   image:
     name: Build Docker Image
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     steps:
       - name: Set IMAGE_TAG env (non traP branch)
@@ -20,21 +26,22 @@ jobs:
       - name: Set IMAGE_TAG env (traP branch)
         run: echo "IMAGE_TAG=latest" >> $GITHUB_ENV
         if: github.ref == 'refs/heads/traP'
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1
         with:
           registry: ghcr.io
           username: traptitech
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a # v2
         with:
           context: .
           file: ./deployments/Dockerfile
           push: true
           build-args: |
-            RUNTIME=hackmdio/runtime:node-10-cjk-d27854ef
+            RUNTIME=hackmdio/runtime:16.20.2-35fe7e39
+            BUILDPACK=hackmdio/buildpack:16.20.2-35fe7e39
           tags: |
             ghcr.io/traptitech/codimd:${{ env.IMAGE_TAG }}
   deploy-staging:
@@ -43,7 +50,7 @@ jobs:
     needs: [image]
     steps:
       - name: Install SSH key
-        uses: shimataro/ssh-key-action@v2
+        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2
         with:
           key: ${{ secrets.STAGING_SSH_KEY }}
           known_hosts: ${{ secrets.STAGING_KNOWN_HOSTS }}

.nvmrc

@@ -1 +1 @@
-v10.20.1
+v16.20.2

Aptfile

@@ -0,0 +1 @@
+libvips-dev

README.md

@@ -81,7 +81,7 @@ CodiMD is a service that runs on Node.js, while users use the service through br
 - <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/chrome/chrome_48x48.png" alt="Chrome" width="24px" height="24px" /> Chrome >= 47, Chrome for Android >= 47
 - <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/safari/safari_48x48.png" alt="Safari" width="24px" height="24px" /> Safari >= 9, iOS Safari >= 8.4
 - <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/firefox/firefox_48x48.png" alt="Firefox" width="24px" height="24px" /> Firefox >= 44
-- <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/edge/edge_48x48.png" alt="IE / Edge" width="24px" height="24px" /> IE >= 9, Edge >= 12
+- <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/edge/edge_48x48.png" alt="Edge" width="24px" height="24px" /> Edge >= 12
 - <img src="https://raw.githubusercontent.com/alrra/browser-logos/master/src/opera/opera_48x48.png" alt="Opera" width="24px" height="24px" /> Opera >= 34, Opera Mini not supported
 - Android Browser >= 4.4
 

app.json

@@ -80,6 +80,14 @@
             "description": "GitHub API client secret",
             "required": false
         },
+        "CMD_GITHUB_ORGANIZATIONS": {
+            "description": "GitHub whitelist of orgs",
+            "required": false
+        },
+        "CMD_GITHUB_SCOPES": {
+            "description": "GitHub OAuth API scopes",
+            "required": false
+        },
         "CMD_BITBUCKET_CLIENTID": {
             "description": "Bitbucket API client id",
             "required": false

config.json.example

@@ -53,7 +53,9 @@
         },
         "github": {
             "clientID": "change this",
-            "clientSecret": "change this"
+            "clientSecret": "change this",
+            "organizations": ["names of github organizations allowed, optional"],
+            "scopes": ["defaults to 'read:user' scope for auth user"]
         },
         "gitlab": {
             "baseURL": "change this",

deployments/Dockerfile

@@ -1,8 +1,10 @@
 ARG RUNTIME
+ARG BUILDPACK
 
-FROM hackmdio/buildpack:node-10-0baafb79 as BUILD
+FROM $BUILDPACK as BUILD
 
 COPY --chown=hackmd:hackmd . .
+ENV QT_QPA_PLATFORM=offscreen
 
 RUN set -xe && \
     git reset --hard && \
@@ -18,6 +20,7 @@ RUN set -xe && \
 
 FROM $RUNTIME
 USER hackmd
+ENV QT_QPA_PLATFORM=offscreen
 WORKDIR /home/hackmd/app
 COPY --chown=1500:1500 --from=BUILD /home/hackmd/app .
 RUN npm install --production && npm cache clean --force && rm -rf /tmp/{core-js-banners,phantomjs}

deployments/build.sh

@@ -1,8 +1,13 @@
 #!/usr/bin/env bash
 
-set -euo pipefail
+set -eo pipefail
 set -x
 
+if [[ -z $1 || -z $2 ]];then
+    echo "build.sh [runtime image] [buildpack image]"
+    exit 1
+fi
+
 CURRENT_DIR=$(dirname "$BASH_SOURCE")
 
 GIT_SHA1="$(git rev-parse HEAD)"
@@ -11,6 +16,6 @@ GIT_TAG=$(git describe --exact-match --tags $(git log -n1 --pretty='%h') 2>/dev/
 
 DOCKER_TAG="${GIT_TAG:-$GIT_SHORT_ID}"
 
-docker build --build-arg RUNTIME=hackmdio/runtime:node-10-d27854ef -t "hackmdio/hackmd:$DOCKER_TAG" -f "$CURRENT_DIR/Dockerfile" "$CURRENT_DIR/.."
+docker build --build-arg RUNTIME=$1 --build-arg BUILDPACK=$2 -t "hackmdio/hackmd:$DOCKER_TAG" -f "$CURRENT_DIR/Dockerfile" "$CURRENT_DIR/.."
 
-docker build --build-arg RUNTIME=hackmdio/runtime:node-10-cjk-d27854ef -t "hackmdio/hackmd:$DOCKER_TAG-cjk" -f "$CURRENT_DIR/Dockerfile" "$CURRENT_DIR/.."
+docker build --build-arg RUNTIME=$1 --build-arg BUILDPACK=$2 -t "hackmdio/hackmd:$DOCKER_TAG-cjk" -f "$CURRENT_DIR/Dockerfile" "$CURRENT_DIR/.."