Merge 切换镜像发布任务到 Pod 后端

ci: 使用 Pod 后端发布镜像
Merge 在 runner 中暴露内置 SPIRE CLI
2026-09-24 07:45:00 +00:00 · 2026-09-24 07:44:46 +00:00 · 2026-09-24 07:08:41 +00:00 · 2026-09-24 07:08:08 +00:00
4 changed files with 8 additions and 16 deletions
@@ -17,7 +17,7 @@ on:
 jobs:
  publish-images:
    name: publish-controller
-    runs-on: [self-hosted, vm]
+    runs-on: [self-hosted, pod]
    timeout-minutes: 45
    permissions:
      contents: read
@@ -7,7 +7,7 @@ on:
 jobs:
  publish-images:
    name: publish-runner
-    runs-on: [self-hosted, vm]
+    runs-on: [self-hosted, pod]
    timeout-minutes: 45
    permissions:
      contents: read
@@ -5,29 +5,20 @@ on:

 jobs:
  jwt-svid:
-    runs-on: self-hosted
-    container:
-      volumes:
-        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
+    runs-on: [self-hosted, pod]
    steps:
-      - name: Fetch pinned SPIRE CLI
+      - name: Verify bundled SPIRE CLI
        shell: bash
        run: |
          set -euo pipefail
-          archive=/tmp/spire.tar.gz
-          curl --fail --location --silent --show-error \
-            --output "$archive" \
-            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
-          printf '%s  %s\n' \
-            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
-            "$archive" | sha256sum --check --status
-          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
+          command -v spire-agent
+          spire-agent -version

      - name: Fetch short-lived zot JWT-SVID
        shell: bash
        run: |
          set -euo pipefail
-          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
+          spire-agent api fetch jwt \
            -audience zot \
            -socketPath /run/spire/agent-sockets/spire-agent.sock \
            >/dev/null
@@ -26,6 +26,7 @@ RUN groupadd --gid 2000 runner \
 COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
 COPY --from=controller /out/gitea-dynamic-runner /usr/local/bin/gitea-dynamic-runner
 COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
+RUN ln -s /opt/spire/bin/spire-agent /usr/local/bin/spire-agent
 COPY config/runner.yaml /etc/gitea-runner/config.yaml
 COPY --chmod=0755 scripts/gitea-job-started /usr/local/libexec/gitea-job-started
 COPY --chmod=0755 scripts/gitea-opensandbox-runner /usr/local/libexec/gitea-opensandbox-runner
Author	SHA1	Message	Date
panxiao81	162f742880	Merge 切换镜像发布任务到 Pod 后端 test / python (push) Successful in 2m57s Details test / shell (push) Successful in 3m44s Details publish controller image / publish-controller (push) Successful in 5m8s Details test / go (push) Successful in 5m31s Details	2026-09-24 07:45:00 +00:00
panxiao81	0571e64b1a	ci: 使用 Pod 后端发布镜像 test / shell (pull_request) Successful in 1m7s Details test / python (pull_request) Successful in 2m5s Details test / go (pull_request) Successful in 5m32s Details	2026-09-24 07:44:46 +00:00
panxiao81	7921840604	Merge 在 runner 中暴露内置 SPIRE CLI test / shell (push) Successful in 55s Details test / python (push) Successful in 1m46s Details test / go (push) Successful in 4m37s Details	2026-09-24 07:08:41 +00:00
panxiao81	45be4a9fd9	fix(runner): 暴露内置 SPIRE CLI test / shell (pull_request) Successful in 40s Details test / python (pull_request) Successful in 1m26s Details test / go (pull_request) Successful in 4m46s Details	2026-09-24 07:08:08 +00:00