From de98a9952ec25d0df7cf85890d745ddc10419b7e Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 18:32:57 +0000
Subject: [PATCH] =?UTF-8?q?=E6=94=B9=E7=94=A8=E5=B8=B8=E9=A9=BB=20Runner?=
 =?UTF-8?q?=20=E5=8F=91=E5=B8=83=E9=95=9C=E5=83=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/publish-images.yml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/publish-images.yml b/.gitea/workflows/publish-images.yml
index ccb1b36..053f9b4 100644
--- a/.gitea/workflows/publish-images.yml
+++ b/.gitea/workflows/publish-images.yml
@@ -17,10 +17,14 @@ on:
 jobs:
   publish-images:
     name: publish-images
-    runs-on: [self-hosted, vm]
+    runs-on: self-hosted
     timeout-minutes: 45
     permissions:
       contents: read
+    container:
+      image: docker.io/gitea/runner-images:ubuntu-latest@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
+      volumes:
+        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
     env:
       PUSH_REGISTRY: zot-push.ad.ddupan.top
       PULL_REGISTRY: zot.ad.ddupan.top
@@ -41,6 +45,19 @@ jobs:
           apt-get install --yes --no-install-recommends shellcheck
           shellcheck scripts/*
 
+      - name: Fetch pinned SPIRE CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive=/tmp/spire.tar.gz
+          curl --fail --location --silent --show-error \
+            --output "$archive" \
+            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
+          printf '%s  %s\n' \
+            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
+            "$archive" | sha256sum --check --status
+          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
+
       - name: Build and publish
         shell: bash
         run: |
@@ -58,7 +75,7 @@ jobs:
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
 
-          /opt/spire/bin/spire-agent api fetch jwt \
+          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
             -audience zot \
             -socketPath "$SPIRE_AGENT_SOCKET" \
             -output json >"$jwt_file"