f6f47b9a13
Some checks failed
CI / skinny-install (aco) (push) Successful in 44s
CI / lint-test (push) Failing after 1m27s
CI / skinny-install (api) (push) Successful in 51s
CI / skinny-install (bcda) (push) Successful in 32s
CI / skinny-install (bib) (push) Successful in 28s
CI / skinny-install (bls) (push) Successful in 28s
CI / skinny-install (ccw) (push) Successful in 26s
CI / skinny-install (cli) (push) Successful in 32s
CI / skinny-install (cms) (push) Successful in 27s
CI / skinny-install (conf) (push) Successful in 30s
CI / skinny-install (perf) (push) Successful in 33s
CI / skinny-install (pfs) (push) Successful in 31s
CI / skinny-install (rex) (push) Successful in 30s
Infra CI / notebooks (push) Successful in 7s
Infra CI / zotero (push) Successful in 6s
Deploy / build-scan-report (push) Has been cancelled
Infra CI / mc (push) Has been cancelled
Infra CI / api (push) Has been cancelled
Infra CI / docs (push) Has been cancelled
Gitea reserves the GITEA_ prefix for Actions secrets, so secrets.GITEA_TOKEN resolved to empty, causing 401 on all package uploads in pkg-supply-chain workflow. - Rename CI secret from GITEA_TOKEN to DEPLOY_TOKEN (env var stays GITEA_TOKEN for code compatibility) - Add provision_gitea_actions() to provisioning system — syncs DEPLOY_TOKEN, REGISTRY_USER, REGISTRY_TOKEN to Gitea Actions - Wired into both provision() and bootstrap() flows - All 7 Gitea Actions workflows updated Refs #229, refs #230
114 lines
4.3 KiB
YAML
114 lines
4.3 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Harden
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 2 * * 0"
|
|
|
|
jobs:
|
|
build-scan-report:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Build notebooks
|
|
run: docker build --no-cache -f infra/images/notebooks.Dockerfile -t local/notebooks:build notebooks/
|
|
|
|
- name: Push notebooks
|
|
run: |
|
|
docker save local/notebooks:build -o /tmp/notebooks.tar
|
|
crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:hardened --insecure
|
|
crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:latest --insecure
|
|
|
|
- name: Build zotero
|
|
run: docker build --no-cache -f infra/images/zotero.Dockerfile -t local/zotero:build data/zotero/
|
|
|
|
- name: Push zotero
|
|
run: |
|
|
docker save local/zotero:build -o /tmp/zotero.tar
|
|
crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:hardened --insecure
|
|
crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:latest --insecure
|
|
|
|
- name: Build docs
|
|
run: docker build --no-cache -f infra/images/docs.Dockerfile -t local/docs:build .
|
|
|
|
- name: Push docs
|
|
run: |
|
|
docker save local/docs:build -o /tmp/docs.tar
|
|
crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:hardened --insecure
|
|
crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:latest --insecure
|
|
|
|
- name: Build api
|
|
run: docker build --no-cache -f infra/images/api.Dockerfile -t local/api:build .
|
|
|
|
- name: Push api
|
|
run: |
|
|
docker save local/api:build -o /tmp/api.tar
|
|
crane push /tmp/api.tar gitea:3000/homelab/stack/api:hardened --insecure
|
|
crane push /tmp/api.tar gitea:3000/homelab/stack/api:latest --insecure
|
|
|
|
- name: Build mc
|
|
run: docker build --no-cache -f infra/images/mc.Dockerfile -t local/mc:build infra/rustfs/
|
|
|
|
- name: Push mc
|
|
run: |
|
|
docker save local/mc:build -o /tmp/mc.tar
|
|
crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:hardened --insecure
|
|
crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure
|
|
|
|
- name: Scan notebooks
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
|
|
|
|
- name: Scan zotero
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
|
|
|
|
- name: Scan docs
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
|
|
|
|
- name: Scan api
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
|
|
|
|
- name: Close resolved or file new vuln issues
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev
|
|
for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
|
|
if [ -f "$f" ]; then
|
|
uv run python -m api.diag.vuln --close "$f" || \
|
|
uv run python -m api.diag.vuln "$f" || true
|
|
fi
|
|
done
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Harden" --job "build-scan-report" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|