Minor design/QoL changes (#216)

.github/renovate.json

@@ -1,4 +1,14 @@
 {
 	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
-	"extends": ["config:recommended"]
+	"extends": ["config:recommended"],
+	"lockFileMaintenance": {
+		"enabled": true,
+		"automerge": true
+	},
+	"packageRules": [
+		{
+			"matchUpdateTypes": ["patch"],
+			"automerge": true
+		}
+	]
 }

.github/workflows/release.yml

@@ -2,6 +2,15 @@ name: CD -> Release
 on:
   workflow_dispatch:
     inputs:
+      artifact-action:
+        description: Artifact action
+        type: choice
+        required: true
+        default: none
+        options:
+          - none
+          - build
+          - build-release
       image-action:
         description: Container image action
         type: choice
@@ -20,6 +29,99 @@ permissions:
   contents: read
 
 jobs:
+  artifact:
+    if: ${{ github.repository_owner == 'jspaste' && inputs.artifact-action != 'none' }}
+    name: Build artifact
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        with:
+          egress-policy: audit
+
+      - name: Setup Go
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version: stable
+          check-latest: true
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
+
+      - name: Setup Task
+        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
+        with:
+          version: 3.x
+
+      - name: Setup tags
+        id: tags-artifact
+        run: |
+          TIMESTAMP="$(date +%Y.%m.%d)"
+          GITHUB_SHA_SHORT="${GITHUB_SHA::7}"
+
+          if [[ "${GITHUB_REF}" == "refs/heads/stable" ]]; then
+            TAG="latest"
+          else
+            TAG="snapshot"
+          fi
+
+          echo "tag=${TAG}" >>"$GITHUB_OUTPUT"
+          echo "extended=${TIMESTAMP}-${GITHUB_SHA_SHORT}" >>"$GITHUB_OUTPUT"
+
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Install deps & build "www/"
+        run: task install-ci build-www
+
+      - name: Build artifact
+        run: |
+          GOOS=darwin GOARCH=arm64 task build-server
+          chmod 755 ./dist/server
+          tar -c --owner=0 --group=0 --mtime='now' --utc .env.example LICENSE README.md -C ./dist/ server | xz -z -6 >./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_darwin-arm64.tar.xz
+          tar -tJf ./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_darwin-arm64.tar.xz >/dev/null
+
+          GOOS=linux GOARCH=amd64 task build-server
+          chmod 755 ./dist/server
+          tar -c --owner=0 --group=0 --mtime='now' --utc .env.example LICENSE README.md -C ./dist/ server | xz -z -6 >./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_linux-amd64.tar.xz
+          tar -tJf ./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_linux-amd64.tar.xz >/dev/null
+
+          GOOS=linux GOARCH=arm64 task build-server
+          chmod 755 ./dist/server
+          tar -c --owner=0 --group=0 --mtime='now' --utc .env.example LICENSE README.md -C ./dist/ server | xz -z -6 >./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_linux-arm64.tar.xz
+          tar -tJf ./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_linux-arm64.tar.xz >/dev/null
+
+          GOOS=windows GOARCH=amd64 task build-server
+          chmod 755 ./dist/server.exe
+          zip -j -X -9 -l -o ./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_windows-amd64.zip .env.example LICENSE README.md ./dist/server.exe
+          zip -T ./dist/frontend_${{ steps.tags-artifact.outputs.tag }}_windows-amd64.zip
+
+      - if: ${{ inputs.artifact-action == 'build-release' }}
+        name: Release artifact
+        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
+        with:
+          name: ${{ steps.tags-artifact.outputs.extended }}
+          tag: ${{ steps.tags-artifact.outputs.extended }}
+          artifacts: dist/*.tar.xz,dist/*.zip
+          makeLatest: true
+          prerelease: ${{ github.ref != 'refs/heads/stable' }}
+          generateReleaseNotes: ${{ github.ref == 'refs/heads/stable' }}
+
+      - if: ${{ inputs.artifact-action == 'build-release' }}
+        name: Attest artifact
+        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
+        with:
+          subject-path: |
+            dist/*.tar.xz
+            dist/*.zip
+
   container:
     if: ${{ github.repository_owner == 'jspaste' && inputs.image-action != 'none' }}
     name: Build container image
@@ -38,11 +140,6 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Setup QEMU
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y qemu-user-static
-
       - name: Setup tags
         id: tags-image
         run: |
@@ -77,6 +174,8 @@ jobs:
           layers: true
           oci: true
           tags: ${{ steps.tags-image.outputs.tags }}
+          extra-args: |
+            --squash
 
       - if: ${{ inputs.image-action == 'build-release' }}
         name: Login to GHCR

.github/workflows/test.yml

@@ -1,6 +1,7 @@
 name: CI -> Test
 on:
   workflow_dispatch:
+  merge_group:
   push:
     branches:
       - dev
@@ -35,33 +36,24 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
-          go-version: '~1.23.0'
+          go-version: stable
+          check-latest: true
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
 
       - name: Setup Task
         uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
         with:
           version: 3.x
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
-
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
-      - name: Install "www/" dependencies
-        run: task install-www-ci
-
-      - name: Build "www/"
-        run: task build-www
-
-      - name: Test run "www/"
-        run: |
-          task start-www &
-          SERVER_PID=$!
-          sleep 10
-          kill $SERVER_PID
+      - name: Install deps & build "www/"
+        run: task install-ci build-www
 
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@e0ebdd245eea59746bb0b28ea6a9871d3e35fbc9 # v6.3.3

Dockerfile

@@ -1,17 +1,13 @@
-FROM docker.io/oven/bun:1-alpine AS builder-www
+FROM --platform=$BUILDPLATFORM docker.io/oven/bun:1-alpine AS builder-www
 WORKDIR /build/
 
-# TODO: Still on Alpine 3.20, so only golang 1.22 is available
-COPY --from=docker.io/library/golang:1.24-alpine /usr/local/go/ /usr/local/go/
 COPY . ./
 
-ENV PATH="/usr/local/go/bin:${PATH}"
-
 # Vite requires Node.js on build process
-RUN apk add --no-cache go-task nodejs
+RUN apk add --no-cache go go-task nodejs
 RUN go-task install-www build-www
 
-FROM docker.io/library/golang:1.24-alpine AS builder-server
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.24-alpine AS builder-server
 WORKDIR /build/
 
 # TODO: Uncomment when CI updates to buildah >=v1.38.0
@@ -20,10 +16,13 @@ WORKDIR /build/
 #COPY --from=builder-www --exclude=./www/ /build/. ./
 COPY --from=builder-www /build/. ./
 
+ARG TARGETOS
+ARG TARGETARCH
+
 RUN apk add --no-cache go-task
-RUN go-task install-server build-server
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go-task install-server build-server
 
-FROM docker.io/library/alpine:3.21
+FROM --platform=$BUILDPLATFORM docker.io/library/alpine:3.21
 WORKDIR /frontend/
 
 RUN addgroup jspaste && \

go.mod

@@ -1,16 +1,18 @@
 module github.com/jspaste/frontend
 
-go 1.23
+go 1.22
+
+toolchain go1.24
 
 require (
 	github.com/andybalholm/brotli v1.1.1
 	github.com/joho/godotenv v1.5.1
+	github.com/klauspost/compress v1.17.11
 	github.com/tdewolff/minify/v2 v2.21.3
-	github.com/valyala/fasthttp v1.58.0
+	github.com/valyala/fasthttp v1.58.1-0.20250212055838-8e25db024a70
 )
 
 require (
-	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/tdewolff/parse/v2 v2.7.20 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 )

go.sum

@@ -13,7 +13,7 @@ github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739 h1:IkjBCtQOOjIn03
 github.com/tdewolff/test v1.0.11-0.20240106005702-7de5f7df4739/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.58.0 h1:GGB2dWxSbEprU9j0iMJHgdKYJVDyjrOwF9RE59PbRuE=
-github.com/valyala/fasthttp v1.58.0/go.mod h1:SYXvHHaFp7QZHGKSHmoMipInhrI5StHrhDTYVEjK/Kw=
+github.com/valyala/fasthttp v1.58.1-0.20250212055838-8e25db024a70 h1:fyauCnbazYH4nmztOxr5rlciPuUUI9F39OgJ+NIgsZc=
+github.com/valyala/fasthttp v1.58.1-0.20250212055838-8e25db024a70/go.mod h1:GTxNb9Bc6r2a9D0TWNSPwDz78UxnTGBViY3xZNEqyYU=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=

server.go

@@ -22,6 +22,7 @@ func main() {
 		FS:             www.Bundle(),
 		Compress:       true,
 		CompressBrotli: true,
+		CompressZstd:   true,
 	}
 
 	requestHandler := fs.NewRequestHandler()
@@ -55,10 +56,6 @@ func main() {
 			ctx.Response.Header.Set("Cache-Control", "max-age=600, public, no-transform")
 		}
 
-		if len(ctx.Response.Header.Peek("Content-Encoding")) > 0 {
-			ctx.Response.Header.Set("Vary", "Accept-Encoding")
-		}
-
 		ctx.Response.Header.Del("Last-Modified")
 	}