stack/.gitea/workflows/harden.yml

# DO NOT EDIT — generated by gen_config.py from stack.toml
# Re-generate: uv run python dev/scripts/gen_config.py

name: Harden

on:
  workflow_dispatch:
  schedule:
    - cron: "0 2 * * 0"

jobs:
  build-scan-report:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Install crane
        run: |
          cd /tmp
          base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
          tgz=go-containerregistry_Linux_x86_64.tar.gz
          curl -fsSLO "$base/$tgz"
          curl -fsSL "$base/checksums.txt" | grep -F "  $tgz" | sha256sum -c -
          tar xzf "$tgz" -C /usr/local/bin crane

      - name: Log in to registry
        run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
        env:
          CRANE_INSECURE: "true"

      - name: Install trivy
        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.1/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.1

      - name: Set up uv
        run: curl -LsSf https://astral.sh/uv/install.sh | sh
        env:
          UV_INSTALL_DIR: /usr/local/bin

      - name: Build notebooks
        id: build_notebooks
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/notebooks.Dockerfile -t local/notebooks:build .

      - name: Scan notebooks
        if: ${{ steps.build_notebooks.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build

      - name: Push notebooks
        if: ${{ steps.build_notebooks.outcome == 'success' }}
        run: |
          docker save local/notebooks:build -o /tmp/notebooks.tar
          crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:hardened --insecure
          crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:latest --insecure

      - name: Build zotero
        id: build_zotero
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/zotero.Dockerfile -t local/zotero:build .

      - name: Scan zotero
        if: ${{ steps.build_zotero.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build

      - name: Push zotero
        if: ${{ steps.build_zotero.outcome == 'success' }}
        run: |
          docker save local/zotero:build -o /tmp/zotero.tar
          crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:hardened --insecure
          crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:latest --insecure

      - name: Build docs
        id: build_docs
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/docs.Dockerfile -t local/docs:build .

      - name: Scan docs
        if: ${{ steps.build_docs.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build

      - name: Push docs
        if: ${{ steps.build_docs.outcome == 'success' }}
        run: |
          docker save local/docs:build -o /tmp/docs.tar
          crane push /tmp/docs.tar git:3000/homelab/stack/docs:hardened --insecure
          crane push /tmp/docs.tar git:3000/homelab/stack/docs:latest --insecure

      - name: Build api
        id: build_api
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/api.Dockerfile -t local/api:build .

      - name: Scan api
        if: ${{ steps.build_api.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build

      - name: Push api
        if: ${{ steps.build_api.outcome == 'success' }}
        run: |
          docker save local/api:build -o /tmp/api.tar
          crane push /tmp/api.tar git:3000/homelab/stack/api:hardened --insecure
          crane push /tmp/api.tar git:3000/homelab/stack/api:latest --insecure

      - name: Build bcda
        id: build_bcda
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/bcda.Dockerfile -t local/bcda:build .

      - name: Scan bcda
        if: ${{ steps.build_bcda.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o bcda-scan.json local/bcda:build

      - name: Push bcda
        if: ${{ steps.build_bcda.outcome == 'success' }}
        run: |
          docker save local/bcda:build -o /tmp/bcda.tar
          crane push /tmp/bcda.tar git:3000/homelab/stack/bcda:hardened --insecure
          crane push /tmp/bcda.tar git:3000/homelab/stack/bcda:latest --insecure

      - name: Build llm
        id: build_llm
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/llm.Dockerfile -t local/llm:build .

      - name: Scan llm
        if: ${{ steps.build_llm.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o llm-scan.json local/llm:build

      - name: Push llm
        if: ${{ steps.build_llm.outcome == 'success' }}
        run: |
          docker save local/llm:build -o /tmp/llm.tar
          crane push /tmp/llm.tar git:3000/homelab/stack/llm:hardened --insecure
          crane push /tmp/llm.tar git:3000/homelab/stack/llm:latest --insecure

      - name: Build mc
        id: build_mc
        continue-on-error: true
        run: docker build --pull --no-cache -f infra/images/mc.Dockerfile -t local/mc:build infra/rustfs/

      - name: Scan mc
        if: ${{ steps.build_mc.outcome == 'success' }}
        run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o mc-scan.json local/mc:build

      - name: Push mc
        if: ${{ steps.build_mc.outcome == 'success' }}
        run: |
          docker save local/mc:build -o /tmp/mc.tar
          crane push /tmp/mc.tar git:3000/homelab/stack/mc:hardened --insecure
          crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure

      - name: Close resolved or file new vuln issues
        env:
          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
        run: |
          uv sync --no-dev
          for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json bcda-scan.json llm-scan.json mc-scan.json; do
            if [ -f "$f" ]; then
              uv run python -m api.diag.vuln --close "$f" || \
              uv run python -m api.diag.vuln "$f" || true
            fi
          done

      - name: Fail if any image failed to build
        run: |
          failed=""
          [ "${{ steps.build_notebooks.outcome }}" = success ] || failed="$failed notebooks"
          [ "${{ steps.build_zotero.outcome }}" = success ] || failed="$failed zotero"
          [ "${{ steps.build_docs.outcome }}" = success ] || failed="$failed docs"
          [ "${{ steps.build_api.outcome }}" = success ] || failed="$failed api"
          [ "${{ steps.build_bcda.outcome }}" = success ] || failed="$failed bcda"
          [ "${{ steps.build_llm.outcome }}" = success ] || failed="$failed llm"
          [ "${{ steps.build_mc.outcome }}" = success ] || failed="$failed mc"
          if [ -n "$failed" ]; then
            echo "Images that failed to build (not scanned, not pushed):$failed"
            exit 1
          fi

      - name: File failure issue
        if: failure() && !startsWith(github.head_ref || github.ref_name, 'renovate/')
        env:
          GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
        run: |
          # Jobs that never install uv (image builds, infra checks) still
          # need it here — otherwise the filer dies with "uv: command not
          # found" and the failure is never filed.
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          export PATH="$HOME/.local/bin:$PATH"
          uv sync --no-dev --quiet 2>/dev/null || true
          uv run python -m api.diag.ci \
            --workflow "Harden" --job "build-scan-report" \
            --run "${{ github.run_number }}" \
            --sha "${{ github.sha }}" \
            --ref "${{ github.ref }}" || true