Merge pull request #7 from swarupsengupta2007/snyk-fix-0914fd877d8e6d55785455ac01875627

[Snyk] Security upgrade alpine from 3.22.1 to 3.23.3

.github/workflows/cicd.yaml

@@ -0,0 +1,172 @@
+name: CI/CD for Psiphon Docker
+
+on:
+  # Poll upstream Psiphon releases periodically (real builds)
+  schedule:
+    - cron: "0 */6 * * *"  # every 6 hours
+
+  # Manual runs, with an option to do a dry run (no push)
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (build but DO NOT push to Docker Hub)"
+        required: false
+        default: "true"
+        type: choice
+        options:
+          - "true"
+          - "false"
+
+permissions:
+  contents: read
+
+env:
+  DOCKERHUB_REPO: swarupsengupta2007/psiphon
+  TARGET_PLATFORMS: linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU (for multi-arch)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Determine dry-run mode
+        id: dryrun
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
+            echo "dry_run=true" >> "$GITHUB_OUTPUT"
+            echo "Running in DRY-RUN mode (no push to Docker Hub)."
+          else
+            echo "dry_run=false" >> "$GITHUB_OUTPUT"
+            echo "Running in NORMAL mode (will push to Docker Hub if needed)."
+          fi
+
+      - name: Get latest psiphon-tunnel-core release & Go version
+        id: psiphon
+        run: |
+          API_URL="https://api.github.com/repos/Psiphon-Labs/psiphon-tunnel-core/releases/latest"
+
+          echo "Fetching latest release from ${API_URL}"
+          RESPONSE=$(curl -fsSL "$API_URL")
+
+          LATEST_TAG=$(echo "$RESPONSE" | jq -r '.tag_name')
+          if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
+            echo "Failed to fetch latest tag from Psiphon-Labs/psiphon-tunnel-core"
+            exit 1
+          fi
+
+          VERSION=${LATEST_TAG#v}
+
+          echo "Latest upstream tag: $LATEST_TAG"
+          echo "Normalized version (without v): $VERSION"
+
+          GO_MOD_URL="https://raw.githubusercontent.com/Psiphon-Labs/psiphon-tunnel-core/${LATEST_TAG}/go.mod"
+          echo "Fetching go.mod from: $GO_MOD_URL"
+
+          curl -fsSL "$GO_MOD_URL" -o /tmp/go.mod
+
+          GO_VERSION=$(awk '/^go [0-9]+\.[0-9]+/ {print $2; exit}' /tmp/go.mod)
+          if [ -z "$GO_VERSION" ]; then
+            echo "Could not determine Go version from go.mod; contents:"
+            cat /tmp/go.mod
+            exit 1
+          fi
+
+          echo "Detected Go version from go.mod: $GO_VERSION"
+
+          echo "latest_tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "go_version=$GO_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check if this Psiphon version tag already exists on Docker Hub
+        id: check
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+        run: |
+          echo "Checking if ${DOCKERHUB_REPO}:${VERSION} exists on Docker Hub..."
+
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "https://hub.docker.com/v2/repositories/${DOCKERHUB_REPO}/tags/${VERSION}/")
+
+          echo "HTTP status from Docker Hub: $STATUS"
+
+          if [ "$STATUS" -eq 200 ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} already exists on Docker Hub."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "Image tag ${DOCKERHUB_REPO}:${VERSION} does not exist yet."
+          fi
+
+      - name: Build and (maybe) push multi-arch image
+        # In dry-run: always build (even if tag exists), but do NOT push.
+        # In normal mode: only build if tag does not exist, and push.
+        if: steps.dryrun.outputs.dry_run == 'true' || steps.check.outputs.exists != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: ${{ env.TARGET_PLATFORMS }}
+          push: ${{ steps.dryrun.outputs.dry_run != 'true' }}
+          tags: |
+            ${{ env.DOCKERHUB_REPO }}:${{ steps.psiphon.outputs.version }}
+            ${{ env.DOCKERHUB_REPO }}:latest
+          build-args: |
+            TARGETS= ${{ env.TARGET_PLATFORMS }}
+            GO_VERSION=${{ steps.psiphon.outputs.go_version }}
+            PSIPHON_VERSION=${{ steps.psiphon.outputs.version }}
+
+      - name: Summary of run (dry-run vs real)
+        if: always()
+        env:
+          DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          VERSION: ${{ steps.psiphon.outputs.version }}
+          LATEST_TAG: ${{ steps.psiphon.outputs.latest_tag }}
+          GO_VERSION: ${{ steps.psiphon.outputs.go_version }}
+          DRY_RUN: ${{ steps.dryrun.outputs.dry_run }}
+          EXISTS: ${{ steps.check.outputs.exists }}
+          TARGET_PLATFORMS: ${{ env.TARGET_PLATFORMS }}
+        run: |
+          echo "================= CI SUMMARY ================="
+          echo "Upstream Psiphon tag:     ${LATEST_TAG}"
+          echo "Normalized version:       ${VERSION}"
+          echo "Go toolchain version:     ${GO_VERSION}"
+          echo "Target platforms:         ${TARGET_PLATFORMS}"
+          echo "Dry-run mode:             ${DRY_RUN}"
+          echo "Tag existed on DockerHub: ${EXISTS}"
+          echo "Image tags considered:    ${DOCKERHUB_REPO}:${VERSION}, ${DOCKERHUB_REPO}:latest"
+
+          if [ "$DRY_RUN" = "true" ]; then
+            echo ""
+            echo "Result: DRY-RUN"
+            echo " - Image was BUILT locally on the runner."
+            echo " - Image was NOT pushed to Docker Hub."
+          else
+            if [ "$EXISTS" = "true" ]; then
+              echo ""
+              echo "Result: SKIPPED PUSH"
+              echo " - Image tag already existed on Docker Hub."
+              echo " - No new image was built/pushed."
+            else
+              echo ""
+              echo "Result: REAL BUILD & PUSH"
+              echo " - Multi-arch image was built."
+              echo " - Pushed: ${DOCKERHUB_REPO}:${VERSION} and :latest"
+            fi
+          fi
+          echo "==============================================="

Dockerfile

@@ -17,7 +17,7 @@ fi
 /go/build.sh ${ARGS}
 __SCRIPT__
 
-FROM alpine:3.22.1
+FROM alpine:3.23.3
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
@@ -26,7 +26,7 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
 	<<__SCRIPT__
     apk add --no-cache tini
 	cp /tmp/assets/start-psiphon /usr/local/bin/start-psiphon
-	cp /tmp/assets/healtcheck /usr/local/bin/healtcheck
+	cp /tmp/assets/healthcheck /usr/local/bin/healthcheck
 	mkdir -p /etc/psiphon
 	cp /tmp/assets/psiphon.config /etc/psiphon/psiphon.config
 	if [ -z "${TARGETVARIANT}" ]; then
@@ -35,9 +35,9 @@ RUN --mount=type=bind,from=psiphon_builder,source=/go/dist,target=/tmp/psiphon \
 		cp /tmp/psiphon/psiphon_${TARGETOS}_${TARGETARCH}_${TARGETVARIANT} /usr/local/bin/psiphon
 	fi
 	chmod +x /usr/local/bin/start-psiphon 
-	chmod +x /usr/local/bin/healtcheck
+	chmod +x /usr/local/bin/healthcheck
 	chmod +x /usr/local/bin/psiphon
 __SCRIPT__
 ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["/usr/local/bin/start-psiphon"]
-HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healtcheck
+HEALTHCHECK --interval=30s --timeout=5s --start-period=2m --retries=3 CMD healthcheck

assets/start-psiphon

@@ -19,6 +19,9 @@ if [ ! -f /config/psiphon.config ]; then
     if [ -n "${EGRESS_REGION}" ]; then
         sed -i -E 's/"EgressRegion"[[:space:]]*:[[:space:]]*"[^"]*"/"EgressRegion": "'${EGRESS_REGION}'"/' /config/psiphon.config
     fi
+    if [ -n "${UPSTREAM_PROXY}" ]; then
+        sed -i -E 's|"UpstreamProxyUrl"[[:space:]]*:[[:space:]]*"[^"]*"|"UpstreamProxyUrl": "'${UPSTREAM_PROXY}'"|' /config/psiphon.config
+    fi
 fi
 
 id psiphon > /dev/null 2>&1

make.bash

@@ -3,12 +3,17 @@
 set -euo pipefail
 IFS=$'\n\t'
 
+MYPATH=$(dirname "$(readlink -f "$0")")
+source "${MYPATH}/latest_version.sh"
+
 function help_message() {
 	echo "Usage: $0 [OPTIONS]"
 	echo "Options:"
 	echo "  --targets, -t <targets>      Comma-separated list of target platforms (default: current, use 'all' for all supported targets)"
 	echo "  --version, -v <version>      Psiphon version to build (default: latest available)"
 	echo "  --go, -g <version>           Go version to use (default: 1.22.7)"
+	echo "  --nodockerhub		     Don't push image to docker.io"
+	echo "  --noghcr		     Don't push image to gchr.io"
 	echo "  --load                       Load the built image into local Docker (cannot be used with --push)"
 	echo "  --push                       Push the built image to Docker Hub (cannot be used with --load)"
 	echo "  --supported-targets          Show supported targets and exit"
@@ -19,6 +24,8 @@ function help_message() {
 
 EXTRA_BUILD_ARGS=""
 VERSION=""
+PUSH_DOCKERHUB=1
+PUSH_GHCR=1
 
 while [[ $# -gt 0 ]]; do
 	case "$1" in
@@ -49,6 +56,14 @@ while [[ $# -gt 0 ]]; do
 			GO_VERSION="$2"
 			shift 2
 			;;
+		--nodockerhub)
+			PUSH_DOCKERHUB=0
+			shift
+			;;
+		--noghcr)
+			PUSH_GHCR=0
+			shift
+			;;
 		--supported-targets)
 			echo "Supported targets: $(get_supported_targets)"
 			exit 0
@@ -80,6 +95,11 @@ while [[ $# -gt 0 ]]; do
 	esac
 done
 
+if [[ "${PUSH_GHCR}" == "0" && "${PUSH_DOCKERHUB}" == "0" && "${EXTRA_BUILD_ARGS}" == "--push" ]]; then
+	echo "Cannot disable both ghcr and dockerhub with --push"
+	help_message
+fi
+
 TARGETS=${TARGETS:-"current"}
 GO_VERSION=${GO_VERSION:-1.22.7}
 
@@ -104,9 +124,20 @@ fi
 
 DECIPHERED_TARGETS=$(decipher_targets "${TARGETS}")
 
-docker buildx build \
+TAGS=()
+
+if [[ "${PUSH_DOCKERHUB}" == "1" ]]; then
+	TAGS+=(-t swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t swarupsengupta2007/psiphon:latest)
+fi
+
+if [[ "${PUSH_GHCR}" == "1" ]]; then
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:"${VERSION#v}")
+	TAGS+=(-t ghcr.io/swarupsengupta2007/psiphon:latest)
+fi
+
+echo docker buildx build \
 				"${DOCKER_BUILD_ARGS[@]}" \
-				-t swarupsengupta2007/psiphon:"${VERSION#v}" \
-				-t swarupsengupta2007/psiphon:latest \
+				"${TAGS[@]}" \
 				--platform "${DECIPHERED_TARGETS}" . \
 				${EXTRA_BUILD_ARGS}