[pull] main from liveblocks:main

.github/workflows/docker-image.yml

@@ -1,4 +1,4 @@
-# Reusable workflow: build, scan, sign and publish a Docker image to GHCR.
+# Reusable workflow: build and publish a Docker image to GHCR.
 name: "[reusable] Build Docker image"
 
 on:
@@ -23,15 +23,18 @@ on:
       is_release:
         required: true
         type: string
-        description: "'true' for release builds (tag push or workflow_dispatch with version), 'false' otherwise. Controls whether latest tag and version tags are applied."
+        description:
+          "'true' for release builds (tag push or workflow_dispatch with
+          version), 'false' otherwise. Controls whether latest tag and version
+          tags are applied."
       release_version:
         required: true
         type: string
-        description: "Explicit semver for tagging (e.g. 1.0.6, without v prefix). Non-empty only for workflow_dispatch triggers where there is no git tag for type=semver to derive from. Pass empty string for tag-push and non-release builds."
-      scan:
-        required: false
-        type: boolean
-        default: false
+        description:
+          "Explicit semver for tagging (e.g. 1.0.6, without v prefix). Non-empty
+          only for workflow_dispatch triggers where there is no git tag for
+          type=semver to derive from. Pass empty string for tag-push and
+          non-release builds."
     outputs:
       tags:
         value: ${{ jobs.build.outputs.tags }}
@@ -49,8 +52,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
-      security-events: write
 
     steps:
       - name: Checkout
@@ -124,66 +125,3 @@ jobs:
           build-args: ${{ inputs.build-args }}
           cache-from: type=gha,scope=${{ inputs.image }}
           cache-to: type=gha,mode=max,scope=${{ inputs.image }}
-
-      # --- Security scanning ---
-
-      - name: Vulnerability scan with Grype
-        if: inputs.scan && github.event_name != 'pull_request'
-        uses: anchore/scan-action@v6
-        id: grype
-        with:
-          image: ghcr.io/${{ inputs.image }}@${{ steps.build.outputs.digest }}
-          fail-build: false
-          output-format: sarif
-
-      - name: Upload Grype SARIF to GitHub Security
-        if: inputs.scan && always() && github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: ${{ steps.grype.outputs.sarif }}
-
-      - name: Generate SBOM with Syft
-        if: inputs.scan && github.event_name != 'pull_request'
-        uses: anchore/sbom-action@v0
-        id: sbom
-        with:
-          image: ghcr.io/${{ inputs.image }}@${{ steps.build.outputs.digest }}
-          format: cyclonedx-json
-          output-file: sbom.cdx.json
-
-      # --- Signing ---
-
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@v3
-
-      - name: Sign image with cosign
-        if: github.event_name != 'pull_request'
-        run: |
-          cosign sign --yes \
-            "ghcr.io/${{ inputs.image }}@${{ steps.build.outputs.digest }}"
-
-      - name: Attest SBOM with cosign
-        if: inputs.scan && github.event_name != 'pull_request'
-        run: |
-          cosign attest --yes \
-            --predicate sbom.cdx.json \
-            --type cyclonedx \
-            "ghcr.io/${{ inputs.image }}@${{ steps.build.outputs.digest }}"
-
-      - name: Compute SBOM artifact name
-        if: inputs.scan && github.event_name != 'pull_request'
-        id: sbom-name
-        run: |
-          SAFE_NAME="${IMAGE_NAME//\//-}"
-          echo "artifact=sbom-${SAFE_NAME}" >> "$GITHUB_OUTPUT"
-        env:
-          IMAGE_NAME: ${{ inputs.image }}
-
-      - name: Upload SBOM artifact
-        if: inputs.scan && github.event_name != 'pull_request'
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ steps.sbom-name.outputs.artifact }}
-          path: sbom.cdx.json
-          retention-days: 90

.github/workflows/publish-docker-images.yml

@@ -30,7 +30,6 @@ jobs:
     outputs:
       version: ${{ steps.v.outputs.version }}
       is_release: ${{ steps.v.outputs.is_release }}
-      cli_tag: ${{ steps.v.outputs.cli_tag }}
       # Non-empty only for workflow_dispatch triggers. Passed to docker-image.yml
       # so it can apply explicit version tags (type=raw) since there is no git tag
       # for docker/metadata-action's type=semver to derive versions from.
@@ -46,45 +45,29 @@ jobs:
             VERSION="${{ inputs.version }}"
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "is_release=true" >> "$GITHUB_OUTPUT"
-            echo "cli_tag=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "release_version=${VERSION}" >> "$GITHUB_OUTPUT"
           elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then
             # Tag push (e.g. v1.0.6). docker/metadata-action derives semver tags
             # from the git tag automatically, so release_version is left empty.
             VERSION="${GITHUB_REF_NAME#v}"
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "is_release=true" >> "$GITHUB_OUTPUT"
-            echo "cli_tag=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "release_version=" >> "$GITHUB_OUTPUT"
           else
             # Non-release build (branch push, PR). No version tags applied.
             VERSION=$(npm view liveblocks version)
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "is_release=false" >> "$GITHUB_OUTPUT"
-            echo "cli_tag=sha-${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT"
             echo "release_version=" >> "$GITHUB_OUTPUT"
           fi
 
-  publish-cli-image:
+  publish:
     needs: version
     uses: ./.github/workflows/docker-image.yml
     with:
-      image: liveblocks/cli
+      image: liveblocks/dev-server
       is_release: ${{ needs.version.outputs.is_release }}
       release_version: ${{ needs.version.outputs.release_version }}
-      scan: true
       build-args: |
         CLI_VERSION=${{ needs.version.outputs.version }}
         VERSION=${{ needs.version.outputs.version }}
-
-  publish-dev-server-image:
-    needs: [version, publish-cli-image]
-    uses: ./.github/workflows/docker-image.yml
-    with:
-      image: liveblocks/dev-server
-      dockerfile: Dockerfile.dev-server
-      is_release: ${{ needs.version.outputs.is_release }}
-      release_version: ${{ needs.version.outputs.release_version }}
-      scan: true
-      build-args: |
-        CLI_TAG=${{ needs.version.outputs.cli_tag }}

CHANGELOG_SERVER.md

@@ -0,0 +1 @@
+tools/liveblocks-cli/CHANGELOG.md