cd81a6999f
Root cause: docker/build-push-action pushes via HTTPS to the FQDN registry, hitting the self-signed cert. Also, GitHub Actions (setup-buildx, login-action, trivy-action) have compatibility issues with Gitea's act_runner. Fix: replace ALL GitHub Actions with plain docker CLI commands: - docker login gitea:3000 (internal HTTP, no TLS) - docker build -t ... -f Dockerfile context/ - docker push (each tag) - trivy via docker run (no action resolution needed) ci_registry = "gitea:3000" in [ci.gitea] for internal push. Host Docker daemon configured with insecure-registries for gitea:3000.
142 lines
4.7 KiB
YAML
142 lines
4.7 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
|
|
|
|
- name: Log in to container registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build notebooks
|
|
run: docker build -f notebooks/Dockerfile -t gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/notebooks:latest notebooks/
|
|
|
|
- name: Push notebooks
|
|
run: |
|
|
docker push gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
|
|
docker push gitea:3000/homelab/stack/notebooks:latest
|
|
|
|
- name: Build zotero
|
|
run: docker build -f zotero/Dockerfile -t gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/zotero:latest zotero/
|
|
|
|
- name: Push zotero
|
|
run: |
|
|
docker push gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
|
|
docker push gitea:3000/homelab/stack/zotero:latest
|
|
|
|
- name: Build docs
|
|
run: docker build -f docs/Dockerfile -t gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/docs:latest .
|
|
|
|
- name: Push docs
|
|
run: |
|
|
docker push gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
|
|
docker push gitea:3000/homelab/stack/docs:latest
|
|
|
|
- name: Build api
|
|
run: docker build -f api/Dockerfile -t gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/api:latest .
|
|
|
|
- name: Push api
|
|
run: |
|
|
docker push gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
|
|
docker push gitea:3000/homelab/stack/api:latest
|
|
|
|
- name: Build mc
|
|
run: docker build -f rustfs/Dockerfile.mc -t gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} -t gitea:3000/homelab/stack/mc:latest rustfs/
|
|
|
|
- name: Push mc
|
|
run: |
|
|
docker push gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }}
|
|
docker push gitea:3000/homelab/stack/mc:latest
|
|
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Scan notebooks
|
|
run: >-
|
|
docker run --rm
|
|
-v /var/run/docker.sock:/var/run/docker.sock
|
|
ghcr.io/aquasecurity/trivy:latest image
|
|
--severity HIGH,CRITICAL --exit-code 0
|
|
--format json -o /dev/null
|
|
gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}
|
|
|
|
- name: Scan zotero
|
|
run: >-
|
|
docker run --rm
|
|
-v /var/run/docker.sock:/var/run/docker.sock
|
|
ghcr.io/aquasecurity/trivy:latest image
|
|
--severity HIGH,CRITICAL --exit-code 0
|
|
--format json -o /dev/null
|
|
gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}
|
|
|
|
- name: Scan docs
|
|
run: >-
|
|
docker run --rm
|
|
-v /var/run/docker.sock:/var/run/docker.sock
|
|
ghcr.io/aquasecurity/trivy:latest image
|
|
--severity HIGH,CRITICAL --exit-code 0
|
|
--format json -o /dev/null
|
|
gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}
|
|
|
|
- name: Scan api
|
|
run: >-
|
|
docker run --rm
|
|
-v /var/run/docker.sock:/var/run/docker.sock
|
|
ghcr.io/aquasecurity/trivy:latest image
|
|
--severity HIGH,CRITICAL --exit-code 0
|
|
--format json -o /dev/null
|
|
gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}
|
|
|
|
- name: Upload scan results
|
|
uses: https://github.com/actions/upload-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
path: "*-scan.json"
|
|
|
|
report-vulns:
|
|
runs-on: ubuntu-latest
|
|
needs: scan
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Download scan results
|
|
uses: https://github.com/actions/download-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
|
|
- name: Report vulnerabilities
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev
|
|
for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
|
|
[ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
|
|
done
|