改用常驻 Runner 发布镜像

Reviewed-on: #16

.gitea/workflows/publish-images.yml

@@ -17,10 +17,14 @@ on:
 jobs:
   publish-images:
     name: publish-images
-    runs-on: [self-hosted, pod]
+    runs-on: self-hosted
     timeout-minutes: 45
     permissions:
       contents: read
+    container:
+      image: docker.io/gitea/runner-images:ubuntu-latest@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
+      volumes:
+        - /run/spire/agent-sockets:/run/spire/agent-sockets:ro
     env:
       PUSH_REGISTRY: zot-push.ad.ddupan.top
       PULL_REGISTRY: zot.ad.ddupan.top
@@ -41,23 +45,18 @@ jobs:
           apt-get install --yes --no-install-recommends shellcheck
           shellcheck scripts/*
 
-      - name: Start Docker
+      - name: Fetch pinned SPIRE CLI
         shell: bash
         run: |
           set -euo pipefail
-          dockerd >/tmp/dockerd.log 2>&1 &
+          archive=/tmp/spire.tar.gz
-          for _ in $(seq 1 60); do
+          curl --fail --location --silent --show-error \
-            if docker info >/dev/null 2>&1; then
+            --output "$archive" \
-              exit 0
+            https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
-            fi
+          printf '%s  %s\n' \
-            if ! kill -0 "$!" 2>/dev/null; then
+            ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
-              cat /tmp/dockerd.log >&2
+            "$archive" | sha256sum --check --status
-              exit 1
+          tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
-            fi
-            sleep 1
-          done
-          cat /tmp/dockerd.log >&2
-          exit 1
 
       - name: Build and publish
         shell: bash
@@ -70,13 +69,13 @@ jobs:
           docker_config=$(mktemp -d)
           jwt_file=$(mktemp)
           cleanup() {
-            rm -rf -- "$docker_config" "$jwt_file"
             docker buildx rm ci-builder >/dev/null 2>&1 || true
+            rm -rf -- "$docker_config" "$jwt_file"
           }
           trap cleanup EXIT
           export DOCKER_CONFIG="$docker_config"
 
-          /opt/spire/bin/spire-agent api fetch jwt \
+          /tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
             -audience zot \
             -socketPath "$SPIRE_AGENT_SOCKET" \
             -output json >"$jwt_file"
@@ -84,7 +83,10 @@ jobs:
           jq -er '.[0].svids[0].svid' "$jwt_file" | \
             docker login "$PUSH_REGISTRY" --username zot --password-stdin
 
-          docker buildx create --name ci-builder --driver docker-container --use
+          docker buildx create \
+            --name ci-builder \
+            --driver docker-container \
+            --use
 
           publish() {
             local repository=$1