1fd4debdb7
Root cause: docker_host auto-mount resolves paths on the HOST filesystem, not inside the runner container. Host has rootless Docker at /run/user/1000/docker.sock, not /var/run/docker.sock. Fix: docker_host="-" (disable auto-mount) + container.options mounts the actual host path into job containers. Also: setup-buildx-action needs driver=docker for rootless Docker (docker-container driver tries to mount sysfs, blocked in rootless).
149 lines
4.7 KiB
YAML
149 lines
4.7 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: https://github.com/docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker
|
|
|
|
- name: Log in to container registry
|
|
uses: https://github.com/docker/login-action@v3
|
|
with:
|
|
registry: gitea.homelab.fhirworx.io
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=${{GITHUB_SHA::8}}" >> "$GITHUB_ENV"
|
|
|
|
- name: Build notebooks
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
context: notebooks/
|
|
file: notebooks/Dockerfile
|
|
push: true
|
|
tags: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/notebooks:latest
|
|
|
|
- name: Build zotero
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
context: zotero/
|
|
file: zotero/Dockerfile
|
|
push: true
|
|
tags: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/zotero:latest
|
|
|
|
- name: Build docs
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docs/Dockerfile
|
|
push: true
|
|
tags: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/docs:latest
|
|
|
|
- name: Build api
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: api/Dockerfile
|
|
push: true
|
|
tags: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/api:latest
|
|
|
|
- name: Build mc
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
context: rustfs/
|
|
file: rustfs/Dockerfile.mc
|
|
push: true
|
|
tags: gitea.homelab.fhirworx.io/homelab/stack/mc:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/mc:latest
|
|
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=${{GITHUB_SHA::8}}" >> "$GITHUB_ENV"
|
|
|
|
- name: Scan notebooks
|
|
uses: https://github.com/aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }}
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "0"
|
|
format: json
|
|
output: notebooks-scan.json
|
|
|
|
- name: Scan zotero
|
|
uses: https://github.com/aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }}
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "0"
|
|
format: json
|
|
output: zotero-scan.json
|
|
|
|
- name: Scan docs
|
|
uses: https://github.com/aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }}
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "0"
|
|
format: json
|
|
output: docs-scan.json
|
|
|
|
- name: Scan api
|
|
uses: https://github.com/aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }}
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "0"
|
|
format: json
|
|
output: api-scan.json
|
|
|
|
- name: Upload scan results
|
|
uses: https://github.com/actions/upload-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
path: "*-scan.json"
|
|
|
|
report-vulns:
|
|
runs-on: ubuntu-latest
|
|
needs: scan
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Download scan results
|
|
uses: https://github.com/actions/download-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
|
|
- name: Report vulnerabilities
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev
|
|
for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
|
|
[ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
|
|
done
|