bbc1c5431f
Root cause analysis (5 whys): 1. Trivy scan fails → can't pull image from gitea:3000 2. Can't resolve gitea → docker run trivy creates a sibling container that inherits host DNS, not Docker network DNS 3. Host DNS can't resolve gitea → host is not on any Docker network 4. Why use the registry at all? → we already have the image locally 5. Why not scan local images? → no reason not to Fix: install trivy as a native binary in the job container, scan local/NAME:build which exists in the host daemon's image store (accessible via the mounted Docker socket). No registry pull, no DNS resolution, no Docker-in-Docker. Complete daemonless registry architecture: - docker build: host socket (local build, no registry) - crane push: job container DNS (daemonless push to gitea:3000) - trivy scan: local Docker images (no registry pull)
128 lines
4.4 KiB
YAML
128 lines
4.4 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
|
|
|
|
- name: Install crane
|
|
run: curl -sL https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz | tar xz -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login gitea:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build notebooks
|
|
run: docker build -f notebooks/Dockerfile -t local/notebooks:build notebooks/
|
|
|
|
- name: Push notebooks
|
|
run: |
|
|
docker save local/notebooks:build -o /tmp/notebooks.tar
|
|
crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/notebooks.tar gitea:3000/homelab/stack/notebooks:latest --insecure
|
|
|
|
- name: Build zotero
|
|
run: docker build -f zotero/Dockerfile -t local/zotero:build zotero/
|
|
|
|
- name: Push zotero
|
|
run: |
|
|
docker save local/zotero:build -o /tmp/zotero.tar
|
|
crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/zotero.tar gitea:3000/homelab/stack/zotero:latest --insecure
|
|
|
|
- name: Build docs
|
|
run: docker build -f docs/Dockerfile -t local/docs:build .
|
|
|
|
- name: Push docs
|
|
run: |
|
|
docker save local/docs:build -o /tmp/docs.tar
|
|
crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/docs.tar gitea:3000/homelab/stack/docs:latest --insecure
|
|
|
|
- name: Build api
|
|
run: docker build -f api/Dockerfile -t local/api:build .
|
|
|
|
- name: Push api
|
|
run: |
|
|
docker save local/api:build -o /tmp/api.tar
|
|
crane push /tmp/api.tar gitea:3000/homelab/stack/api:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/api.tar gitea:3000/homelab/stack/api:latest --insecure
|
|
|
|
- name: Build mc
|
|
run: docker build -f rustfs/Dockerfile.mc -t local/mc:build rustfs/
|
|
|
|
- name: Push mc
|
|
run: |
|
|
docker save local/mc:build -o /tmp/mc.tar
|
|
crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/mc.tar gitea:3000/homelab/stack/mc:latest --insecure
|
|
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Scan notebooks
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
|
|
|
|
- name: Scan zotero
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
|
|
|
|
- name: Scan docs
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
|
|
|
|
- name: Scan api
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
|
|
|
|
- name: Upload scan results
|
|
uses: https://github.com/actions/upload-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
path: "*-scan.json"
|
|
|
|
report-vulns:
|
|
runs-on: ubuntu-latest
|
|
needs: scan
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Download scan results
|
|
uses: https://github.com/actions/download-artifact@v4
|
|
with:
|
|
name: trivy-scans
|
|
|
|
- name: Report vulnerabilities
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev
|
|
for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
|
|
[ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
|
|
done
|