stack/.gitea/workflows/deploy.yml

# DO NOT EDIT — generated by gen_config.py from stack.toml
# Re-generate: uv run python dev/scripts/gen_config.py

name: Deploy

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4



      - name: Install crane
        run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane

      - name: Log in to registry
        run: crane auth login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
        env:
          CRANE_INSECURE: "true"

      - name: Compute short SHA
        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"

      - name: Build notebooks
        run: docker build -f notebooks/Dockerfile -t local/notebooks:build notebooks/

      - name: Push notebooks
        run: |
          docker save local/notebooks:build -o /tmp/notebooks.tar
          crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} --insecure
          crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:latest --insecure

      - name: Build zotero
        run: docker build -f zotero/Dockerfile -t local/zotero:build zotero/

      - name: Push zotero
        run: |
          docker save local/zotero:build -o /tmp/zotero.tar
          crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} --insecure
          crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:latest --insecure

      - name: Build docs
        run: docker build -f docs/Dockerfile -t local/docs:build .

      - name: Push docs
        run: |
          docker save local/docs:build -o /tmp/docs.tar
          crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }} --insecure
          crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:latest --insecure

      - name: Build api
        run: docker build -f api/Dockerfile -t local/api:build .

      - name: Push api
        run: |
          docker save local/api:build -o /tmp/api.tar
          crane push /tmp/api.tar gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }} --insecure
          crane push /tmp/api.tar gitea:3000/homelab/stack/api:latest --insecure

      - name: Build mc
        run: docker build -f rustfs/Dockerfile.mc -t local/mc:build rustfs/

      - name: Push mc
        run: |
          docker save local/mc:build -o /tmp/mc.tar
          crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
          crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure

  scan:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Compute short SHA
        run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"

      - name: Scan notebooks
        run: >-
          docker run --rm
          -v /var/run/docker.sock:/var/run/docker.sock
          ghcr.io/aquasecurity/trivy:latest image
          --severity HIGH,CRITICAL --exit-code 0
          --format json -o /dev/null
          gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }}

      - name: Scan zotero
        run: >-
          docker run --rm
          -v /var/run/docker.sock:/var/run/docker.sock
          ghcr.io/aquasecurity/trivy:latest image
          --severity HIGH,CRITICAL --exit-code 0
          --format json -o /dev/null
          gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }}

      - name: Scan docs
        run: >-
          docker run --rm
          -v /var/run/docker.sock:/var/run/docker.sock
          ghcr.io/aquasecurity/trivy:latest image
          --severity HIGH,CRITICAL --exit-code 0
          --format json -o /dev/null
          gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }}

      - name: Scan api
        run: >-
          docker run --rm
          -v /var/run/docker.sock:/var/run/docker.sock
          ghcr.io/aquasecurity/trivy:latest image
          --severity HIGH,CRITICAL --exit-code 0
          --format json -o /dev/null
          gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }}

      - name: Upload scan results
        uses: https://github.com/actions/upload-artifact@v4
        with:
          name: trivy-scans
          path: "*-scan.json"

  report-vulns:
    runs-on: ubuntu-latest
    needs: scan
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Set up uv
        run: curl -LsSf https://astral.sh/uv/install.sh | sh
        env:
          UV_INSTALL_DIR: /usr/local/bin

      - name: Download scan results
        uses: https://github.com/actions/download-artifact@v4
        with:
          name: trivy-scans

      - name: Report vulnerabilities
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          uv sync --no-dev
          for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
            [ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
          done