panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

恢复本机对动态 Runner 镜像的发布权限 #82

Merged
panxiao81 merged 1 commits from fix/zot-local-publisher-exact-policy into main 2026-09-16 18:39:52 +00:00
Conversation 0 Commits 1 Files Changed 1
+4 -2
panxiao81 commented 2026-09-16 18:38:43 +00:00
Owner
Copy Link
Copy Source

问题

新增两个精确 repository policy 后，zot 使用精确规则覆盖 ** wildcard，导致原本具有发布权限的 spiffe://ddupan.top/dev/panxiao81 在这两个仓库上被拒绝。

变更

将本机开发身份加入：

  • panxiao81/gitea-dynamic-runner-controller
  • panxiao81/gitea-dynamic-runner-runner

只授予 read/create/update，不授予 delete。CI publisher identity 保持不变。

验证

  • 内嵌 Zot JSON 可由 jq 解析
  • git diff --check 通过
## 问题 新增两个精确 repository policy 后，zot 使用精确规则覆盖 `**` wildcard，导致原本具有发布权限的 `spiffe://ddupan.top/dev/panxiao81` 在这两个仓库上被拒绝。 ## 变更 将本机开发身份加入： - `panxiao81/gitea-dynamic-runner-controller` - `panxiao81/gitea-dynamic-runner-runner` 只授予 `read/create/update`，不授予 delete。CI publisher identity 保持不变。 ## 验证 - 内嵌 Zot JSON 可由 jq 解析 - `git diff --check` 通过
panxiao81 added 1 commit 2026-09-16 18:38:44 +00:00
恢复本机对动态 Runner 镜像的发布权限
yaml / yaml (pull_request) Successful in 19s
Details
bb2b5119ab
panxiao81 merged commit a2102e6708 into main 2026-09-16 18:39:52 +00:00
panxiao81 deleted branch fix/zot-local-publisher-exact-policy 2026-09-16 18:39:52 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#82