140 lines
4.6 KiB
YAML
140 lines
4.6 KiB
YAML
---
|
|
name: publish images
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '.gitea/workflows/publish-images.yml'
|
|
- 'config/**'
|
|
- 'container/**'
|
|
- 'scripts/**'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'README.md'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
publish-images:
|
|
name: publish-images
|
|
runs-on: self-hosted
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: read
|
|
container:
|
|
image: docker.io/gitea/runner-images:ubuntu-latest@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
|
|
volumes:
|
|
- /run/spire/agent-sockets:/run/spire/agent-sockets:ro
|
|
env:
|
|
PUSH_REGISTRY: zot-push.ad.ddupan.top
|
|
PULL_REGISTRY: zot.ad.ddupan.top
|
|
CONTROLLER_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
|
|
RUNNER_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
|
|
SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Test source
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
python3 -m pip install --break-system-packages -e '.[test]'
|
|
pytest -q
|
|
python3 -m compileall -q src tests
|
|
apt-get update
|
|
apt-get install --yes --no-install-recommends shellcheck
|
|
shellcheck scripts/*
|
|
|
|
- name: Fetch pinned SPIRE CLI
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
archive=/tmp/spire.tar.gz
|
|
curl --fail --location --silent --show-error \
|
|
--output "$archive" \
|
|
https://github.com/spiffe/spire/releases/download/v1.15.3/spire-1.15.3-linux-amd64-musl.tar.gz
|
|
printf '%s %s\n' \
|
|
ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7 \
|
|
"$archive" | sha256sum --check --status
|
|
tar -xzf "$archive" -C /tmp spire-1.15.3/bin/spire-agent
|
|
|
|
- name: Build and publish
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
set +x
|
|
|
|
: "${GITHUB_SHA:?GITHUB_SHA is required}"
|
|
image_tag="sha-${GITHUB_SHA}"
|
|
docker_config=$(mktemp -d)
|
|
jwt_file=$(mktemp)
|
|
cleanup() {
|
|
docker buildx rm ci-builder >/dev/null 2>&1 || true
|
|
rm -rf -- "$docker_config" "$jwt_file"
|
|
}
|
|
trap cleanup EXIT
|
|
export DOCKER_CONFIG="$docker_config"
|
|
|
|
/tmp/spire-1.15.3/bin/spire-agent api fetch jwt \
|
|
-audience zot \
|
|
-socketPath "$SPIRE_AGENT_SOCKET" \
|
|
-output json >"$jwt_file"
|
|
# shellcheck disable=SC2016
|
|
jq -er '.[0].svids[0].svid' "$jwt_file" | \
|
|
docker login "$PUSH_REGISTRY" --username zot --password-stdin
|
|
|
|
docker buildx create \
|
|
--name ci-builder \
|
|
--driver docker-container \
|
|
--use
|
|
|
|
publish() {
|
|
local repository=$1
|
|
local dockerfile=$2
|
|
local metadata=$3
|
|
docker buildx build \
|
|
--builder ci-builder \
|
|
--platform linux/amd64 \
|
|
--file "$dockerfile" \
|
|
--tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \
|
|
--tag "${PUSH_REGISTRY}/${repository}:main" \
|
|
--provenance=mode=max \
|
|
--sbom=true \
|
|
--metadata-file "$metadata" \
|
|
--push \
|
|
.
|
|
}
|
|
|
|
publish \
|
|
"$CONTROLLER_REPOSITORY" \
|
|
container/controller.Dockerfile \
|
|
controller-metadata.json
|
|
publish \
|
|
"$RUNNER_REPOSITORY" \
|
|
container/runner.Dockerfile \
|
|
runner-metadata.json
|
|
|
|
controller_digest=$(
|
|
# shellcheck disable=SC2016
|
|
jq -er '."containerimage.digest"' controller-metadata.json
|
|
)
|
|
runner_digest=$(
|
|
# shellcheck disable=SC2016
|
|
jq -er '."containerimage.digest"' runner-metadata.json
|
|
)
|
|
controller_ref="${PULL_REGISTRY}/${CONTROLLER_REPOSITORY}@${controller_digest}"
|
|
runner_ref="${PULL_REGISTRY}/${RUNNER_REPOSITORY}@${runner_digest}"
|
|
|
|
printf 'controller=%s\nrunner=%s\n' "$controller_ref" "$runner_ref"
|
|
if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
|
|
{
|
|
printf '## Published images\n\n'
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Controller: `%s`\n' "$controller_ref"
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Runner: `%s`\n' "$runner_ref"
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Source: `%s`\n' "$GITHUB_SHA"
|
|
} >>"$GITHUB_STEP_SUMMARY"
|
|
fi
|